Edit tour

Windows Analysis Report
BDFirm180.exe

Overview

General Information

Sample name:	BDFirm180.exe
Analysis ID:	1432310
MD5:	d1d78d33fb33f1d0a0d217c77febb364
SHA1:	f1eb83f04a4d6a57f546164846f99db6a4e3c569
SHA256:	3493225143e3b0935083fd7b2c66cead25b4d639486520934e2f18e6b4540254
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

BDFirm180.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\BDFirm180.exe" MD5: D1D78D33FB33F1D0A0D217C77FEBB364)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: BDFirm180.exe

Virustotal: Detection: 16%

Perma Link

Source: BDFirm180.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BDFirm180.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: BDFirm180.exe

Static PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: BDFirm180.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\BDFirm180.exe	Mutant created: \Sessions\1\BaseNamedObjects\Roland Firmware Installer
Source: C:\Users\user\Desktop\BDFirm180.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\RemoteController ROBI

Source: C:\Users\user\Desktop\BDFirm180.exe

File created: C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL

Source: BDFirm180.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BDFirm180.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: BDFirm180.exe

Virustotal: Detection: 16%

Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: snmpapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: mgmtapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wsnmp32.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\BDFirm180.exe	Section loaded: rasadhlp.dll

Source: BDFirm180.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: BDFirm180.exe

Static file information: File size 6023168 > 1048576

Source: BDFirm180.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x14e000
Source: BDFirm180.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x3b9600

Source: BDFirm180.exe

Static PE information: More than 200 imports for USER32.dll

Source: BDFirm180.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: BDFirm180.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: BDFirm180.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: BDFirm180.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: BDFirm180.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: BDFirm180.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\BDFirm180.exe

File created: C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL

Jump to dropped file

Source: C:\Users\user\Desktop\BDFirm180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\BDFirm180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\BDFirm180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\BDFirm180.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\BDFirm180.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL

Jump to dropped file

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BDFirm180.exe	17%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432310
Start date and time:	2024-04-26 20:44:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	BDFirm180.exe
Detection:	MAL
Classification:	mal48.winEXE@1/1@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL

Download File

Process:	C:\Users\user\Desktop\BDFirm180.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	5.609642457588111
Encrypted:	false
SSDEEP:
MD5:	09F1A7B67302A71EA2EA1B42C48E8D7C
SHA1:	84DD174986CA6D03D9D7166E42315987FDD5BF7F
SHA-256:	5AE3F1CC2D31693AF555093D73985F678DCE8E34F0D43A998E64A6E56B457DB1
SHA-512:	8FD9CEEC43777CCCBA078CE2053E270DF3DB9731FE9755105013955BFD992612958EA3764EDB965EC296664A00B80D2D19BFFD4E22EB008641EB56EBA34A9A00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................................R.....j.....Rich...........................PE..L......R...........!.....`...0.......H.......p..........................................................................y...........0..X"...................`..\|....................................................p...............................text...NR.......`.................. ..`.rdata..yJ...p...P...p..............@..@.data...@n.......@..................@....rsrc...X"...0...0..................@..@.reloc..*0...`...@...0..............@..B........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.422332789308003
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BDFirm180.exe
File size:	6'023'168 bytes
MD5:	d1d78d33fb33f1d0a0d217c77febb364
SHA1:	f1eb83f04a4d6a57f546164846f99db6a4e3c569
SHA256:	3493225143e3b0935083fd7b2c66cead25b4d639486520934e2f18e6b4540254
SHA512:	926a863e57ac213b171307fd518f35c59f95b8f010021904546e43342a3254969800f4e7b15ce28802e8efcc72502aa02fc27246cce70353bb83f11cabf74952
SSDEEP:	98304:SKInouWSR9VquHQ7VzQ69Rh/h+rrL+/wUbfoblz73CkCgiHRBFeC:g3HQu69Rh/ATEbAB33CkCvxBh
TLSH:	F7560232F9918076D5731271DB9CB3B866EDBB700F320287A7A45E2D6E718835938763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'..fIA.fIA.fIA<..A.fIA<..A.fIA<..A.fIA<..A.fIA...A.fIA...AtfIA...A.gIA.i.A.fIA.fHA.eIA...A.fIA...A.fIA.f.A.fIA...A.fIARich.fI

File Icon


Icon Hash:	0f33313353f8a667

Static PE Info

General

Entrypoint:	0x5255bb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66221E90 [Fri Apr 19 07:34:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	777669d4de7505c9eca41244575a69cd

Entrypoint Preview

Instruction
call 00007FD6F18B2A69h
jmp 00007FD6F18AA800h
cmp ecx, dword ptr [005A2740h]
jne 00007FD6F18AA974h
rep ret
jmp 00007FD6F18AC0B3h
push ecx
mov dword ptr [ecx], 0057920Ch
call 00007FD6F18B2D41h
pop ecx
ret
push ebp
mov ebp, esp
lea eax, dword ptr [ecx+09h]
push eax
mov eax, dword ptr [ebp+08h]
add eax, 09h
push eax
call 00007FD6F18B2CA0h
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
pop ebp
retn 0004h
push ebp
mov ebp, esp
push esi
mov esi, ecx
call 00007FD6F18AA93Eh
test byte ptr [ebp+08h], 00000001h
je 00007FD6F18AA979h
push esi
call 00007FD6F17952EFh
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
push dword ptr [ebp+18h]
push 00000000h
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FD6F18AA97Ah
add esp, 18h
pop ebp
ret
push ebp
mov ebp, esp
push ecx
cmp dword ptr [ebp+14h], 00000000h
jne 00007FD6F18AA987h
call 00007FD6F18AD6C4h
mov dword ptr [eax], 00000016h
call 00007FD6F18B2E96h
or eax, FFFFFFFFh
leave
ret
push ebx
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov edi, dword ptr [ebp+10h]
test edi, edi
jne 00007FD6F18AA986h
test esi, esi
jne 00007FD6F18AA98Ah
cmp dword ptr [ebp+0Ch], esi
jne 00007FD6F18AAA24h
xor eax, eax
jmp 00007FD6F18AAA2Fh
test esi, esi
je 00007FD6F18AAA15h

Rich Headers

Programming Language:

[RES] VS2012 build 50727
[LNK] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19a700	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1ac000	0x3b9450	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x566000	0x1c8a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x180b18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14f000	0xa5c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14df33	0x14e000	b7066e358c834afa4b282c7383d79247	False	0.5564834686096557	data	6.542419943843688	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14f000	0x4eefe	0x4f000	c0cb6e5af38e4a92c2cb432a060bc9dc	False	0.27534735957278483	data	4.997763322955576	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19e000	0xdfb8	0x6400	aa62322af65801ed0e3ab276ea4d795b	False	0.2782421875	MPEG-4 LOAS, single stream	4.726504345231075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1ac000	0x3b9450	0x3b9600	e370d164eaea0e2298d3d8efe62e239b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x566000	0x6186c	0x61a00	a3cb163c2ae5f8107b00900eb1fc7020	False	0.1226867597631242	data	2.7049225718682943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DLL	0x527de8	0x27000	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows			0.44139372996794873
FIRMWARE	0x1ad050	0x37ad92	data			0.9871482849121094
RT_CURSOR	0x560cf0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.4805194805194805
RT_CURSOR	0x560e28	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Japanese	Japan	0.7
RT_CURSOR	0x560f08	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Japanese	Japan	0.36363636363636365
RT_CURSOR	0x561058	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.35714285714285715
RT_CURSOR	0x5611a8	0x134	data	Japanese	Japan	0.37337662337662336
RT_CURSOR	0x5612f8	0x134	data	Japanese	Japan	0.37662337662337664
RT_CURSOR	0x561448	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.36688311688311687
RT_CURSOR	0x561598	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.37662337662337664
RT_CURSOR	0x5616e8	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.36688311688311687
RT_CURSOR	0x561838	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Japanese	Japan	0.38636363636363635
RT_CURSOR	0x561988	0x134	data	Japanese	Japan	0.44155844155844154
RT_CURSOR	0x561ad8	0x134	data	Japanese	Japan	0.4155844155844156
RT_CURSOR	0x561c28	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Japanese	Japan	0.5422077922077922
RT_CURSOR	0x561d78	0x134	data	Japanese	Japan	0.2662337662337662
RT_CURSOR	0x561ec8	0x134	data	Japanese	Japan	0.2824675324675325
RT_CURSOR	0x562018	0x134	data	Japanese	Japan	0.3246753246753247
RT_BITMAP	0x55e268	0xc10	Device independent bitmap graphic, 144 x 29 x 8, 1 compression, image size 2024, 256 important colors			0.7470854922279793
RT_BITMAP	0x55ee78	0x4e8	Device independent bitmap graphic, 144 x 29 x 8, 1 compression, image size 192, 256 important colors			0.7746815286624203
RT_BITMAP	0x55f360	0x1478	Device independent bitmap graphic, 144 x 29 x 8, image size 4176, 256 important colors			0.4347328244274809
RT_BITMAP	0x562288	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Japanese	Japan	0.44565217391304346
RT_BITMAP	0x562340	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Japanese	Japan	0.37962962962962965
RT_ICON	0x54ede8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.32875722543352603
RT_ICON	0x54f350	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.44584837545126355
RT_ICON	0x54fbf8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688			0.46668443496801704
RT_ICON	0x550aa0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5859929078014184
RT_ICON	0x550f08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.3925891181988743
RT_ICON	0x551fb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.3421161825726141
RT_ICON	0x5545b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.35124481327800827
RT_ICON	0x556b78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.35383817427385894
RT_ICON	0x559138	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.350103734439834
RT_ICON	0x55b6f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.3578838174273859
RT_DIALOG	0x55dcb8	0x1c0	data			0.5580357142857143
RT_DIALOG	0x560a70	0x27e	data	English	United States	0.46865203761755486
RT_DIALOG	0x5607d8	0x298	data	Japanese	Japan	0.49849397590361444
RT_DIALOG	0x55de78	0x9e	data			0.7341772151898734
RT_DIALOG	0x562168	0xe8	data	Japanese	Japan	0.6336206896551724
RT_DIALOG	0x562250	0x34	data	Japanese	Japan	0.9038461538461539
RT_STRING	0x562bd8	0xfe	data	English	United States	0.6181102362204725
RT_STRING	0x562520	0x9c	data	Japanese	Japan	0.9358974358974359
RT_STRING	0x562cd8	0x672	data	English	United States	0.30242424242424243
RT_STRING	0x5625c0	0x428	data	Japanese	Japan	0.4605263157894737
RT_STRING	0x563350	0x2b8	data	English	United States	0.382183908045977
RT_STRING	0x5629e8	0x192	data	Japanese	Japan	0.6119402985074627
RT_STRING	0x562488	0x94	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0			0.7297297297297297
RT_STRING	0x563608	0x52	data	English	United States	0.6585365853658537
RT_STRING	0x562b80	0x52	data	Japanese	Japan	0.6585365853658537
RT_STRING	0x563660	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	Japanese	Japan	0.7153846153846154
RT_STRING	0x5636e8	0x2a	data	Japanese	Japan	0.5476190476190477
RT_STRING	0x563718	0x184	data	Japanese	Japan	0.48711340206185566
RT_STRING	0x5638a0	0x4e6	data	Japanese	Japan	0.37719298245614036
RT_STRING	0x564118	0x264	data	Japanese	Japan	0.3333333333333333
RT_STRING	0x563e38	0x2da	data	Japanese	Japan	0.3698630136986301
RT_STRING	0x564b60	0x8a	data	Japanese	Japan	0.6594202898550725
RT_STRING	0x563d88	0xac	data	Japanese	Japan	0.45348837209302323
RT_STRING	0x564a50	0xde	data	Japanese	Japan	0.536036036036036
RT_STRING	0x564380	0x4a8	data	Japanese	Japan	0.3221476510067114
RT_STRING	0x564828	0x228	data	Japanese	Japan	0.4003623188405797
RT_STRING	0x564b30	0x2c	data	Japanese	Japan	0.5227272727272727
RT_STRING	0x564bf0	0x53c	data	Japanese	Japan	0.2947761194029851
RT_GROUP_CURSOR	0x560ee0	0x22	Lotus unknown worksheet or configuration, revision 0x2	Japanese	Japan	1.0294117647058822
RT_GROUP_CURSOR	0x5616d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561040	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561580	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561430	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561d60	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x5612e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561970	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561190	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561820	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561ac0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561c10	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x561eb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x562000	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_CURSOR	0x562150	0x14	Lotus unknown worksheet or configuration, revision 0x1	Japanese	Japan	1.3
RT_GROUP_ICON	0x554558	0x5a	data			0.7
RT_GROUP_ICON	0x559120	0x14	data			1.25
RT_GROUP_ICON	0x55b6e0	0x14	data			1.25
RT_GROUP_ICON	0x55dca0	0x14	data			1.25
RT_GROUP_ICON	0x556b60	0x14	data			1.25
RT_VERSION	0x55df18	0x34c	data			0.4549763033175355
RT_MANIFEST	0x565130	0x31c	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (736), with CRLF line terminators	English	United States	0.5238693467336684

Imports

DLL	Import
iphlpapi.dll	GetIfEntry, GetIpAddrTable
KERNEL32.dll	SetUnhandledExceptionFilter, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, TerminateProcess, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, QueryPerformanceCounter, GetConsoleCP, GetConsoleMode, ReadConsoleW, SetFilePointerEx, OutputDebugStringW, LCMapStringEx, WriteConsoleW, SetEnvironmentVariableA, GetStartupInfoW, InitOnceExecuteOnce, GetProcessHeap, GetStdHandle, GetFileType, SetStdHandle, GetSystemTimeAsFileTime, HeapQueryInformation, HeapSize, InitializeCriticalSectionEx, ExitThread, CreateThread, VirtualQuery, VirtualAlloc, GetSystemInfo, SetThreadStackGuarantee, HeapReAlloc, RtlUnwind, RaiseException, HeapAlloc, HeapFree, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleExW, ExitProcess, DecodePointer, EncodePointer, GetCommandLineW, GetUserDefaultUILanguage, FindResourceExW, VirtualProtect, SearchPathW, GetProfileIntW, Sleep, GetTempFileNameW, VerifyVersionInfoW, VerSetConditionMask, GetWindowsDirectoryW, GetCurrentDirectoryW, SetErrorMode, GetFileTime, GetFileSizeEx, GetFileAttributesExW, FileTimeToLocalFileTime, FileTimeToSystemTime, GlobalGetAtomNameW, LocalReAlloc, LocalAlloc, GlobalHandle, GlobalReAlloc, TlsFree, UnhandledExceptionFilter, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsGetValue, TlsAlloc, InitializeCriticalSection, InterlockedIncrement, GlobalFlags, CompareStringEx, GlobalFindAtomW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, GlobalAddAtomW, WritePrivateProfileStringW, GetPrivateProfileStringW, GetPrivateProfileIntW, ResumeThread, SetThreadPriority, WaitForSingleObject, FreeResource, GetLocaleInfoEx, GetThreadPreferredUILanguages, ApplicationRecoveryFinished, ApplicationRecoveryInProgress, RegisterApplicationRestart, RegisterApplicationRecoveryCallback, lstrcmpW, lstrcmpA, GlobalDeleteAtom, GetVersionExW, GetCurrentThreadId, GetCurrentThread, InterlockedExchange, LoadLibraryA, lstrcmpiW, LoadLibraryExW, GetModuleHandleW, GetModuleHandleA, GetVersion, GetCurrentProcess, DuplicateHandle, OutputDebugStringA, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetFullPathNameW, GetFileSize, GetFileAttributesW, FlushFileBuffers, FindFirstFileW, FindClose, DeleteFileW, InterlockedDecrement, SetLastError, CopyFileW, FormatMessageW, LocalFree, GlobalFree, GlobalSize, GlobalAlloc, GetModuleFileNameW, GetCurrentProcessId, GlobalUnlock, GlobalLock, WriteFile, DeviceIoControl, CreateFileW, CloseHandle, GetTickCount, lstrcpyW, lstrcpynW, GetLastError, CreateMutexW, WideCharToMultiByte, MultiByteToWideChar, GetProcAddress, LoadLibraryW, LockResource, LoadResource, SizeofResource, FindResourceW, GetTempPathW, FreeLibrary, MulDiv, TlsSetValue, GetTickCount64, GetTimeZoneInformation
USER32.dll	GetComboBoxInfo, TrackMouseEvent, MonitorFromPoint, UpdateLayeredWindow, IsMenu, SetWindowRgn, DrawFrameControl, DrawEdge, DrawStateW, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, EnumDisplayMonitors, SetLayeredWindowAttributes, LockWindowUpdate, SetRect, NotifyWinEvent, InvertRect, HideCaret, EnableScrollBar, GetAsyncKeyState, MessageBeep, GetIconInfo, DrawIconEx, DrawFocusRect, GetNextDlgGroupItem, SetParent, IsRectEmpty, UnionRect, MapVirtualKeyW, GetKeyNameTextW, GetMenuDefaultItem, ReuseDDElParam, UnpackDDElParam, OffsetRect, SetRectEmpty, InsertMenuItemW, CreatePopupMenu, TranslateAcceleratorW, LoadAcceleratorsW, BringWindowToTop, DestroyIcon, IsIconic, SendDlgItemMessageA, InvalidateRect, DeleteMenu, CopyImage, ReleaseCapture, UnregisterClassW, LoadCursorW, GetSysColorBrush, RealChildWindowFromPoint, IntersectRect, LoadMenuW, WindowFromPoint, InflateRect, GetMenuItemInfoW, DestroyMenu, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, GetTopWindow, GetClassNameW, GetClassLongW, PtInRect, EqualRect, CopyRect, MapWindowPoints, AdjustWindowRectEx, GetWindowRect, GetClientRect, RemovePropW, CopyIcon, CharUpperBuffW, IsZoomed, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, SetForegroundWindow, GetForegroundWindow, UpdateWindow, TrackPopupMenu, SetMenu, GetMenu, GetCapture, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, IsChild, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, DefWindowProcW, GetMessageTime, GetMessagePos, RegisterWindowMessageW, SetWindowLongW, GetWindowTextLengthW, GetWindowTextW, SetWindowTextW, SetFocus, GetDlgCtrlID, CheckDlgButton, SetDlgItemTextW, SetWindowPos, MoveWindow, ShowWindow, SetCursor, ShowOwnedPopups, CallNextHookEx, SetWindowsHookExW, GetCursorPos, ValidateRect, GetKeyState, IsWindowVisible, GetMessageW, GetDoubleClickTime, ChangeWindowMessageFilter, LoadBitmapW, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, RegisterClipboardFormatW, ModifyMenuW, EnableMenuItem, CheckMenuItem, GetFocus, GetDesktopWindow, SetActiveWindow, GetActiveWindow, GetNextDlgTabItem, GetDlgItem, EndDialog, CreateDialogIndirectParamW, DestroyWindow, IsWindow, WaitMessage, PostQuitMessage, PostMessageW, PostThreadMessageW, GetKeyboardLayout, IsCharLowerW, MapVirtualKeyExW, ToUnicodeEx, GetKeyboardState, CreateAcceleratorTableW, DestroyAcceleratorTable, CopyAcceleratorTableW, SetCursorPos, DrawIcon, GetWindowRgn, DestroyCursor, MapDialogRect, CreateMenu, GetSystemMetrics, CharUpperW, SubtractRect, GetUpdateRect, IsClipboardFormatAvailable, TranslateMDISysAccel, DefMDIChildProcW, DefFrameProcW, DrawMenuBar, ShowScrollBar, FrameRect, SetPropW, SetMenuDefaultItem, GetPropW, SetClassLongW, UnhookWindowsHookEx, RemoveMenu, InsertMenuW, GetMenuItemCount, GetMenuItemID, GetSubMenu, GetMenuState, GetMenuStringW, GetLastActivePopup, GetWindowThreadProcessId, GetParent, GetWindowLongW, MessageBoxW, IsWindowEnabled, FillRect, ScreenToClient, ClientToScreen, EndPaint, BeginPaint, GetWindowDC, TabbedTextOutW, GrayStringW, DrawTextExW, DrawTextW, GetWindow, SystemParametersInfoW, KillTimer, SetTimer, DispatchMessageW, TranslateMessage, IsDialogMessageW, PeekMessageW, EnableWindow, ReleaseDC, GetDC, GetSysColor, SendMessageW, AppendMenuW, GetSystemMenu, LoadIconW, LoadImageW, SetCapture
GDI32.dll	MoveToEx, TextOutW, ExtTextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CopyMetaFileW, CreateDCW, CombineRgn, CreateRectRgnIndirect, PatBlt, SetRectRgn, DPtoLP, GetTextMetricsW, CreateCompatibleBitmap, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, GetBkColor, CreateDIBitmap, EnumFontFamiliesW, GetTextCharsetInfo, SetPixel, StretchBlt, SetDIBColorTable, CreateEllipticRgn, Ellipse, GetTextColor, Polygon, Polyline, Rectangle, EnumFontFamiliesExW, GetRgnBox, OffsetRgn, CreateRoundRectRgn, RoundRect, FrameRgn, PtInRegion, SetPixelV, ExtFloodFill, SetPaletteEntries, FillRgn, GetBoundsRect, GetWindowOrgEx, LPtoDP, GetViewportOrgEx, GetTextFaceW, SetPolyFillMode, GetLayout, SetLayout, SetMapMode, SetBkMode, SetROP2, SetTextAlign, SetTextColor, CreatePolygonRgn, DeleteObject, SetBkColor, SelectPalette, SelectObject, ExtSelectClipRgn, SelectClipRgn, SaveDC, RestoreDC, RectVisible, PtVisible, LineTo, IntersectClipRect, GetWindowExtEx, GetViewportExtEx, GetStockObject, GetPixel, GetObjectType, GetDeviceCaps, GetClipBox, ExcludeClipRect, Escape, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateBitmap, CreateFontIndirectW, GetTextExtentPoint32W, BitBlt, GetDIBColorTable, CreateCompatibleDC, CreateDIBSection, GetObjectW
MSIMG32.dll	AlphaBlend, TransparentBlt
WINSPOOL.DRV	OpenPrinterW, StartDocPrinterW, StartPagePrinter, WritePrinter, ClosePrinter, DocumentPropertiesW, EndDocPrinter, EndPagePrinter
ADVAPI32.dll	RegSetValueExW, RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegOpenKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegQueryValueExW, RegCloseKey
SHELL32.dll	SHBrowseForFolderW, SHGetFileInfoW, InitNetworkAddressControl, SHCreateItemFromParsingName, SHGetKnownFolderPath, DragQueryFileW, DragFinish, ShellExecuteW, SHGetPathFromIDListW, SHAppBarMessage, SHGetSpecialFolderPathW, SHGetDesktopFolder, SHGetSpecialFolderLocation
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	SHGetValueW, PathAppendW, PathFileExistsW, SHEnumKeyExW, PathIsUNCW, PathStripToRootW, PathFindExtensionW, PathFindFileNameW, StrFormatKBSizeW, PathRemoveFileSpecW
UxTheme.dll	BeginBufferedPaint, GetThemeColor, GetCurrentThemeName, GetThemeSysColor, GetWindowTheme, BufferedPaintUnInit, BufferedPaintInit, DrawThemeTextEx, IsAppThemed, GetThemePartSize, CloseThemeData, OpenThemeData, DrawThemeParentBackground, IsThemeBackgroundPartiallyTransparent, DrawThemeBackground, EndBufferedPaint
dwmapi.dll	DwmIsCompositionEnabled, DwmDefWindowProc, DwmSetWindowAttribute
ole32.dll	DoDragDrop, OleDuplicateData, ReleaseStgMedium, CoUninitialize, CoCreateGuid, CoCreateInstance, CoInitialize, CoInitializeEx, CreateStreamOnHGlobal, OleLockRunning, CoTaskMemFree, CoTaskMemAlloc, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleGetClipboard, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor
OLEAUT32.dll	SysFreeString, VarBstrFromDate, VariantTimeToSystemTime, SystemTimeToVariantTime, SysStringLen, VariantChangeType, VariantClear, VariantInit, SysAllocStringLen, SysAllocString
WSOCK32.dll	inet_addr, WSAGetLastError, setsockopt, accept, bind, closesocket, getservbyname, htons, htonl, ioctlsocket, ntohl, ntohs, connect, recv, WSAAsyncSelect, WSASetLastError, WSACleanup, WSAStartup, socket, sendto, send, select, recvfrom
snmpapi.dll	SnmpUtilMemAlloc, SnmpUtilVarBindListFree
mgmtapi.dll	SnmpMgrRequest, SnmpMgrStrToOid, SnmpMgrOpen, SnmpMgrClose
RPCRT4.dll	UuidFromStringW
SETUPAPI.dll	SetupDiGetClassDevsW, SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces
OLEACC.dll	CreateStdAccessibleObject, AccessibleObjectFromWindow, LresultFromObject
gdiplus.dll	GdipFree, GdiplusStartup, GdiplusShutdown, GdipCloneImage, GdipDisposeImage, GdipGetImageGraphicsContext, GdipGetImageWidth, GdipGetImageHeight, GdipAlloc, GdipGetImagePalette, GdipGetImagePaletteSize, GdipSetInterpolationMode, GdipDrawImageRectI, GdipCreateBitmapFromStream, GdipDeleteGraphics, GdipDrawImageI, GdipCreateBitmapFromHBITMAP, GdipGetImagePixelFormat, GdipCreateFromHDC, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipBitmapUnlockBits
IMM32.dll	ImmGetOpenStatus, ImmReleaseContext, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan
English	United States

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BDFirm180.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RemoteCTR.DLL

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
BDFirm180.exe