Windows Analysis Report
Minutes_of_15th_Session_of_PSC.pdf.exe

Overview

General Information

Sample name: Minutes_of_15th_Session_of_PSC.pdf.exe
Analysis ID: 1431476
MD5: a51493ca2948491e60759223c3be8502
SHA1: 87c1d51cea91b80dd236b1f2ef12d78867ece1ca
SHA256: dcdae583da8a1b01a8ad0caef6a7f6f3b6f1eb6dd3298ac7d904200f52712446
Tags: aptBitterexe
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Initial sample is a PE file and has a suspicious name
Uses an obfuscated file name to hide its real file extension (double extension)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Virustotal: Detection: 11% Perma Link
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.241.39.200 188.241.39.200
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic HTTP traffic detected: GET /log.php?computername=715575&username=user HTTP/1.1Host: oraclewebonline.com
Source: global traffic DNS traffic detected: DNS query: oraclewebonline.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:22:36 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:22:47 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:22:49 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:22:56 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:11 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:15 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:18 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:28 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:39 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:49 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:51 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:53 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:23:56 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:05 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:14 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:26 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:29 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:30 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:24:43 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 07:25:01 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033AA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003399000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003288000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000323A000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003391000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://oraclewebonline.com
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033AA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003399000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003288000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000323A000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://oraclewebonline.comd
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000317C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000317C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oraclewebonline.com
Source: Minutes_of_15th_Session_of_PSC.pdf.exe String found in binary or memory: https://oraclewebonline.com/log.php
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003222000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032E5000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033AA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003399000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000317C000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003288000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000323A000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003391000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oraclewebonline.com/log.php?computername=715575&username=user
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003222000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032E5000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033AA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003399000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000317C000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003288000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000323A000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003391000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oraclewebonline.com/log.php?computername=715575&username=usert
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032E5000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033AA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032BA000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003399000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.000000000317C000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003288000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4110027405.0000000003391000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oraclewebonline.comD
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.241.39.200:443 -> 192.168.2.4:49755 version: TLS 1.2

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Minutes_of_15th_Session_of_PSC.pdf.exe
Sample file is different than original file name gathered from version info
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000000.00000002.4108552790.000000000138E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Minutes_of_15th_Session_of_PSC.pdf.exe
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000000.00000000.1642336004.0000000000F32000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamerest.exe* vs Minutes_of_15th_Session_of_PSC.pdf.exe
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Binary or memory string: OriginalFilenamerest.exe* vs Minutes_of_15th_Session_of_PSC.pdf.exe
Source: classification engine Classification label: mal72.evad.winEXE@9/0@1/1
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Virustotal: Detection: 11%
Source: unknown Process created: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe "C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe"
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Section loaded: gpapi.dll Jump to behavior
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Binary contains a suspicious time stamp
Source: Minutes_of_15th_Session_of_PSC.pdf.exe Static PE information: 0x9DB05A09 [Sat Nov 1 03:24:57 2053 UTC]

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: download (31).png
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Minutes_of_15th_Session_of_PSC.pdf.exe
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 3080000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 3240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 5240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 2F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 3170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: 2F20000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Window / User API: threadDelayed 5057 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Window / User API: threadDelayed 2088 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Window / User API: threadDelayed 8592 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Window / User API: threadDelayed 1230 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 6288 Thread sleep count: 5057 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 6288 Thread sleep count: 2088 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 3636 Thread sleep count: 8592 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 7128 Thread sleep count: 1230 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -31359464925306218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69628s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69503s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69378s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69253s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69121s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -69019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68769s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68644s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68519s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68394s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68144s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -68019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67769s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67644s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67519s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67394s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67144s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -67019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66769s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66644s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66519s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66394s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66144s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -66019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65769s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65644s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65519s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65394s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65144s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -65019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64769s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64644s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64519s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64394s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64269s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64144s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -64019s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -63894s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe TID: 4412 Thread sleep time: -63769s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69628 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69503 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69378 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69253 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69121 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 69019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68769 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68644 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68519 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68394 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68269 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68144 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 68019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67769 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67644 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67519 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67394 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67269 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67144 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 67019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66769 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66644 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66519 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66394 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66269 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66144 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 66019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65769 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65644 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65519 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65394 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65269 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65144 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 65019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64769 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64644 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64519 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64394 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64269 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64144 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 64019 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 63894 Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Thread delayed: delay time: 63769 Jump to behavior
Source: Minutes_of_15th_Session_of_PSC.pdf.exe, 00000003.00000002.4108473106.0000000001286000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Enables debug privileges
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Queries volume information: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Queries volume information: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Minutes_of_15th_Session_of_PSC.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431476 Sample: Minutes_of_15th_Session_of_... Startdate: 25/04/2024 Architecture: WINDOWS Score: 72 23 oraclewebonline.com 2->23 27 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Sigma detected: Suspicious Double Extension File Execution 2->31 33 2 other signatures 2->33 10 Minutes_of_15th_Session_of_PSC.pdf.exe 2->10         started        signatures3 process4 process5 12 cmd.exe 1 10->12         started        process6 14 Minutes_of_15th_Session_of_PSC.pdf.exe 15 2 12->14         started        17 conhost.exe 12->17         started        dnsIp7 25 oraclewebonline.com 188.241.39.200, 443, 49736, 49737 BANDWIDTH-ASGB Belize 14->25 19 cmd.exe 1 14->19         started        process8 process9 21 conhost.exe 19->21         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.241.39.200
 oraclewebonline.com Belize
25369 BANDWIDTH-ASGB false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
oraclewebonline.com 188.241.39.200 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://oraclewebonline.com/log.php?computername=715575&username=user false
  • Avira URL Cloud: safe
 unknown