Loading ...

Play interactive tourEdit tour

Analysis Report Material Description_PDF.exe

Overview

General Information

Sample Name:Material Description_PDF.exe
Analysis ID:299476
MD5:d0339fd4789b35ee0248c842b132dddc
SHA1:5a6b414b64143409c9bb8dd0930d528f11aa2ac6
SHA256:5bca9dcc5cad6329944f72114d7273103b7b9157fb640de07b05af598a5191fe
Tags:exeHawkEye

Most interesting Screenshot:

Detection

HawkEye MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected HawkEye Rat
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected HawkEye Keylogger
Yara detected MailPassView
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
AV process strings found (often used to terminate AV products)
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Keylogger Generic
Yara signature match

Classification

Startup

  • System is w10x64
  • Material Description_PDF.exe (PID: 6384 cmdline: 'C:\Users\user\Desktop\Material Description_PDF.exe' MD5: D0339FD4789B35EE0248C842B132DDDC)
    • Material Description_PDF.exe (PID: 6448 cmdline: 'C:\Users\user\Desktop\Material Description_PDF.exe' MD5: D0339FD4789B35EE0248C842B132DDDC)
      • vbc.exe (PID: 6764 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
      • vbc.exe (PID: 6776 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
  • cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.259609630.0000000000400000.00000040.00000001.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
    00000006.00000002.267186066.0000000000400000.00000040.00000001.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
      00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
        00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
          00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmpRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
          • 0x7b94f:$key: HawkEyeKeylogger
          • 0x7db2d:$salt: 099u787978786
          • 0x7bf5c:$string1: HawkEye_Keylogger
          • 0x7cd9b:$string1: HawkEye_Keylogger
          • 0x7da8d:$string1: HawkEye_Keylogger
          • 0x7c331:$string2: holdermail.txt
          • 0x7c351:$string2: holdermail.txt
          • 0x7c273:$string3: wallet.dat
          • 0x7c28b:$string3: wallet.dat
          • 0x7c2a1:$string3: wallet.dat
          • 0x7d66f:$string4: Keylog Records
          • 0x7d987:$string4: Keylog Records
          • 0x7db85:$string5: do not script -->
          • 0x7b937:$string6: \pidloc.txt
          • 0x7b991:$string7: BSPLIT
          • 0x7b9a1:$string7: BSPLIT
          Click to see the 51 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          6.2.vbc.exe.400000.0.raw.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
            5.2.vbc.exe.400000.0.raw.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
              5.2.vbc.exe.400000.0.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
                6.2.vbc.exe.400000.0.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
                  0.2.Material Description_PDF.exe.41d0000.2.unpackRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
                  • 0xdd74f:$key: HawkEyeKeylogger
                  • 0xdf92d:$salt: 099u787978786
                  • 0xddd5c:$string1: HawkEye_Keylogger
                  • 0xdeb9b:$string1: HawkEye_Keylogger
                  • 0xdf88d:$string1: HawkEye_Keylogger
                  • 0xde131:$string2: holdermail.txt
                  • 0xde151:$string2: holdermail.txt
                  • 0xde073:$string3: wallet.dat
                  • 0xde08b:$string3: wallet.dat
                  • 0xde0a1:$string3: wallet.dat
                  • 0xdf46f:$string4: Keylog Records
                  • 0xdf787:$string4: Keylog Records
                  • 0xdf985:$string5: do not script -->
                  • 0xdd737:$string6: \pidloc.txt
                  • 0xdd791:$string7: BSPLIT
                  • 0xdd7a1:$string7: BSPLIT
                  Click to see the 39 entries

                  Sigma Overview

                  No Sigma rule has matched

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: Material Description_PDF.exe.6384.0.memstrMalware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: Material Description_PDF.exeReversingLabs: Detection: 35%
                  Machine Learning detection for sampleShow sources
                  Source: Material Description_PDF.exeJoe Sandbox ML: detected
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.unpackAvira: Label: TR/Inject.vcoldi
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpackAvira: Label: TR/AD.MExecute.lzrac
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpackAvira: Label: SPR/Tool.MailPassView.473
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpackAvira: Label: TR/AD.MExecute.lzrac
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpackAvira: Label: SPR/Tool.MailPassView.473
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpackAvira: Label: TR/AD.MExecute.lzrac
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpackAvira: Label: SPR/Tool.MailPassView.473
                  Source: 0.2.Material Description_PDF.exe.41d0000.2.unpackAvira: Label: TR/Patched.Ren.Gen
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpackAvira: Label: TR/AD.MExecute.lzrac
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpackAvira: Label: SPR/Tool.MailPassView.473
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpackAvira: Label: TR/AD.MExecute.lzrac
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpackAvira: Label: SPR/Tool.MailPassView.473
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmpBinary or memory string: autorun.inf
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmpBinary or memory string: [autorun]
                  Source: Material Description_PDF.exeBinary or memory string: [autorun]
                  Source: Material Description_PDF.exeBinary or memory string: autorun.inf
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00408868 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,0_2_00408868
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004059F8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,0_2_004059F8
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,5_2_00406EC3
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,6_2_00408441
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,6_2_00407E0E

                  Networking:

                  barindex
                  Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                  Source: TrafficSnort IDS: 2019926 ET TROJAN HawkEye Keylogger Report SMTP 192.168.2.5:49729 -> 162.241.216.83:587
                  May check the online IP address of the machineShow sources
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: unknownDNS query: name: whatismyipaddress.com
                  Source: global trafficTCP traffic: 192.168.2.5:49729 -> 162.241.216.83:587
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 104.16.154.36 104.16.154.36
                  Source: Joe Sandbox ViewIP Address: 104.16.154.36 104.16.154.36
                  Source: Joe Sandbox ViewIP Address: 104.16.155.36 104.16.155.36
                  Source: global trafficTCP traffic: 192.168.2.5:49729 -> 162.241.216.83:587
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                  Source: vbc.exe, 00000006.00000003.266708715.0000000000ADE000.00000004.00000001.sdmpString found in binary or memory: &ct=1601451842&rver=6.0.5286.0&wp=MBI_SSL&wreply=https:%2F%2fwww.bing.com%2Fsecure%2FPassport.aspx%3Fpopup%3D1%26ssl%3D1&lc=2055&id=264960&checkda=1https://login.live.com/login.srfhttps://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fabout:blankhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/logine%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehp equals www.facebook.com (Facebook)
                  Source: vbc.exe, 00000006.00000003.266708715.0000000000ADE000.00000004.00000001.sdmpString found in binary or memory: &ct=1601451842&rver=6.0.5286.0&wp=MBI_SSL&wreply=https:%2F%2fwww.bing.com%2Fsecure%2FPassport.aspx%3Fpopup%3D1%26ssl%3D1&lc=2055&id=264960&checkda=1https://login.live.com/login.srfhttps://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fabout:blankhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/logine%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehp equals www.yahoo.com (Yahoo)
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmp, vbc.exe, 00000006.00000002.267186066.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmp, vbc.exe, 00000006.00000002.267186066.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                  Source: Material Description_PDF.exe, vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: unknownDNS traffic detected: queries for: 56.14.11.0.in-addr.arpa
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
                  Source: Material Description_PDF.exe, 00000002.00000003.238165935.0000000004FED000.00000004.00000001.sdmpString found in binary or memory: http://en.wikipedia
                  Source: Material Description_PDF.exe, 00000002.00000003.238467897.0000000005015000.00000004.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: Material Description_PDF.exe, 00000002.00000003.238467897.0000000005015000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.comD
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                  Source: Material Description_PDF.exe, 00000002.00000002.509722656.0000000002AE1000.00000004.00000001.sdmpString found in binary or memory: http://whatismyipaddress.com
                  Source: Material Description_PDF.exeString found in binary or memory: http://whatismyipaddress.com/
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmpString found in binary or memory: http://whatismyipaddress.com/-
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: Material Description_PDF.exe, 00000002.00000003.245016064.0000000004FF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: Material Description_PDF.exe, 00000002.00000002.511787875.0000000004FE0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                  Source: Material Description_PDF.exe, 00000002.00000002.511787875.0000000004FE0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comdiaa
                  Source: Material Description_PDF.exe, 00000002.00000003.245016064.0000000004FF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comdn
                  Source: Material Description_PDF.exe, 00000002.00000002.511787875.0000000004FE0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comicetW
                  Source: Material Description_PDF.exe, 00000002.00000002.511787875.0000000004FE0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como3
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: Material Description_PDF.exe, 00000002.00000003.238393772.0000000005015000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comvB
                  Source: Material Description_PDF.exe, 00000002.00000003.241022475.0000000004FED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: Material Description_PDF.exe, 00000002.00000003.239923296.0000000004FF1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnayo
                  Source: Material Description_PDF.exe, 00000002.00000003.239923296.0000000004FF1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cncoc
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511787875.0000000004FE0000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmp, Material Description_PDF.exe, 00000002.00000003.242395482.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: Material Description_PDF.exe, 00000002.00000003.243587411.0000000004FEB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/3
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/://w
                  Source: Material Description_PDF.exe, 00000002.00000003.243587411.0000000004FEB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/E
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/N
                  Source: Material Description_PDF.exe, 00000002.00000003.243587411.0000000004FEB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-bi
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0r1
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/httpW
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/icro3
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/j
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/E
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/N
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ogra
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/r
                  Source: Material Description_PDF.exe, 00000002.00000003.243204402.0000000004FEA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/s/
                  Source: Material Description_PDF.exe, 00000002.00000003.242850753.0000000004FE4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ww.m
                  Source: Material Description_PDF.exe, 00000002.00000003.245758509.000000000501D000.00000004.00000001.sdmp, Material Description_PDF.exe, 00000002.00000003.245670271.000000000501C000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.
                  Source: Material Description_PDF.exe, 00000002.00000003.246433444.000000000501D000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.(
                  Source: vbc.exe, 00000006.00000002.268068062.00000000006E8000.00000004.00000020.sdmpString found in binary or memory: http://www.msn.com/?ocid=iehpshLMEM
                  Source: vbc.exe, 00000006.00000002.268068062.00000000006E8000.00000004.00000020.sdmpString found in binary or memory: http://www.msn.com/de-ch/?ocid=iehpLMEMhHCphCp
                  Source: vbc.exe, vbc.exe, 00000006.00000002.267186066.0000000000400000.00000040.00000001.sdmpString found in binary or memory: http://www.nirsoft.net/
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: Material Description_PDF.exe, 00000002.00000002.509722656.0000000002AE1000.00000004.00000001.sdmpString found in binary or memory: http://www.site.com/logs.php
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: Material Description_PDF.exe, 00000002.00000002.512761818.0000000006272000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://contextual.media.net/checksy
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://contextual.media.net/checksync.p3
                  Source: vbc.exe, 00000006.00000003.264541096.00000000022AC000.00000004.00000001.sdmpString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37R
                  Source: vbc.exe, 00000006.00000003.264541096.00000000022AC000.00000004.00000001.sdmpString found in binary or memory: https://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&
                  Source: vbc.exe, 00000006.00000003.264541096.00000000022AC000.00000004.00000001.sdmpString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://c
                  Source: vbc.exe, 00000006.00000003.266708715.0000000000ADE000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com/login.srfhttps://www.google.com/chrome/https://www.google.com/chrome/thank-yo
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f
                  Source: vbc.exe, 00000006.00000003.264541096.00000000022AC000.00000004.00000001.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
                  Source: Material Description_PDF.exe, vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
                  Source: Material Description_PDF.exe, 00000002.00000002.509906851.0000000002B1E000.00000004.00000001.sdmpString found in binary or memory: https://whatismyipaddress.com
                  Source: Material Description_PDF.exe, 00000002.00000002.509722656.0000000002AE1000.00000004.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.509906851.0000000002B1E000.00000004.00000001.sdmpString found in binary or memory: https://whatismyipaddress.com/
                  Source: Material Description_PDF.exe, vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                  Source: vbc.exe, 00000006.00000002.268068062.00000000006E8000.00000004.00000020.sdmpString found in binary or memory: https://www.google.com/chrome/3LMEM
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
                  Source: vbc.exe, 00000006.00000002.268112929.00000000006FC000.00000004.00000020.sdmpString found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0LMEM
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443

                  Key, Mouse, Clipboard, Microphone and Screen Capturing:

                  barindex
                  Yara detected HawkEye KeyloggerShow sources
                  Source: Yara matchFile source: 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.502568737.0000000002312000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.501093910.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.502406935.0000000002222000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.501396536.0000000000497000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.241144168.00000000042C7000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000001.235680106.0000000000497000.00000040.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.509906851.0000000002B1E000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Material Description_PDF.exe PID: 6384, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Material Description_PDF.exe PID: 6448, type: MEMORY
                  Source: Yara matchFile source: 0.2.Material Description_PDF.exe.41d0000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.1.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.Material Description_PDF.exe.2310000.3.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.Material Description_PDF.exe.8b0000.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.Material Description_PDF.exe.8b0000.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.Material Description_PDF.exe.4230000.3.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.Material Description_PDF.exe.2220000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPE
                  Contains functionality to log keystrokes (.Net Source)Show sources
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.cs.Net Code: HookKeyboard
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.cs.Net Code: HookKeyboard
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.cs.Net Code: HookKeyboard
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.cs.Net Code: HookKeyboard
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_0040AC8A GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,5_2_0040AC8A
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00424BD4 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,0_2_00424BD4
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00435C3C GetKeyboardState,0_2_00435C3C
                  Source: Yara matchFile source: Process Memory Space: Material Description_PDF.exe PID: 6384, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Material Description_PDF.exe PID: 6448, type: MEMORY

                  System Summary:

                  barindex
                  Malicious sample detected (through community Yara rule)Show sources
                  Source: 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000002.502568737.0000000002312000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000002.502568737.0000000002312000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000002.501093910.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000002.501093910.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000002.502406935.0000000002222000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000002.502406935.0000000002222000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000002.501396536.0000000000497000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000002.501396536.0000000000497000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000000.00000002.241144168.00000000042C7000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000000.00000002.241144168.00000000042C7000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000001.235680106.0000000000497000.00000040.00020000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 00000002.00000001.235680106.0000000000497000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 00000002.00000002.509906851.0000000002B1E000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 0.2.Material Description_PDF.exe.41d0000.2.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 0.2.Material Description_PDF.exe.41d0000.2.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                  Initial sample is a PE file and has a suspicious nameShow sources
                  Source: initial sampleStatic PE information: Filename: Material Description_PDF.exe
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00438B74 NtdllDefWindowProc_A,GetCapture,0_2_00438B74
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00453908 NtdllDefWindowProc_A,0_2_00453908
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00454084 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,0_2_00454084
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00454134 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,0_2_00454134
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004484F8 GetSubMenu,SaveDC,RestoreDC,7378B080,SaveDC,RestoreDC,NtdllDefWindowProc_A,0_2_004484F8
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0042C860 NtdllDefWindowProc_A,0_2_0042C860
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00490159 NtCreateSection,2_2_00490159
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,FindCloseChangeNotification,_wcsicmp,FindCloseChangeNotification,FreeLibrary,6_2_00408836
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004484F80_2_004484F8
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0044DFDC0_2_0044DFDC
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0040D4262_2_0040D426
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0040D5232_2_0040D523
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0041D5AE2_2_0041D5AE
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004176462_2_00417646
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004429BE2_2_004429BE
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00446AF42_2_00446AF4
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0046ABFC2_2_0046ABFC
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00463C4D2_2_00463C4D
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00463CBE2_2_00463CBE
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0040ED032_2_0040ED03
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00463D2F2_2_00463D2F
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_00463DC02_2_00463DC0
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0040CF922_2_0040CF92
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0041AFA62_2_0041AFA6
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0048F13D2_2_0048F13D
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004899762_2_00489976
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004F90172_2_004F9017
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004F90A82_2_004F90A8
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004A227A2_2_004A227A
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_004B028E2_2_004B028E
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 2_2_0043C7BC2_2_0043C7BC
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_00404DDB5_2_00404DDB
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_0040BD8A5_2_0040BD8A
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_00404E4C5_2_00404E4C
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_00404EBD5_2_00404EBD
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 5_2_00404F4E5_2_00404F4E
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004044196_2_00404419
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004045166_2_00404516
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004135386_2_00413538
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004145A16_2_004145A1
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040E6396_2_0040E639
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004337AF6_2_004337AF
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004399B16_2_004399B1
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0043DAE76_2_0043DAE7
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00405CF66_2_00405CF6
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00403F856_2_00403F85
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00411F996_2_00411F99
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413F8E appears 66 times
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413E2D appears 34 times
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00442A90 appears 36 times
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 004141D6 appears 88 times
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00411538 appears 35 times
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: String function: 00404258 appears 76 times
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: String function: 0044BA9D appears 35 times
                  Source: Material Description_PDF.exeStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
                  Source: Material Description_PDF.exe, 00000000.00000000.233274560.000000000047F000.00000002.00020000.sdmpBinary or memory string: OriginalFilename$ vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000000.00000002.241094606.00000000042B2000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamePhulli.exe0 vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameCMemoryExecute.dll@ vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameWebBrowserPassView.exeF vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamemailpv.exe< vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000000.00000002.237496393.0000000002160000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Material Description_PDF.exe
                  Source: Material Description_PDF.exeBinary or memory string: OriginalFilename vs Material Description_PDF.exe
                  Source: Material Description_PDF.exeBinary or memory string: OriginalFileName vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamemailpv.exe< vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWebBrowserPassView.exeF vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000002.513493272.0000000006B00000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCMemoryExecute.dll@ vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamePhulli.exe0 vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000000.234720598.000000000047F000.00000002.00020000.sdmpBinary or memory string: OriginalFilename$ vs Material Description_PDF.exe
                  Source: Material Description_PDF.exe, 00000002.00000002.514401518.0000000007230000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Material Description_PDF.exe
                  Source: Material Description_PDF.exeBinary or memory string: OriginalFilename$ vs Material Description_PDF.exe
                  Source: 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000002.502172694.00000000008B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000002.502568737.0000000002312000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000002.502568737.0000000002312000.00000040.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000002.501093910.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000002.501093910.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000002.502406935.0000000002222000.00000004.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000002.502406935.0000000002222000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000002.501396536.0000000000497000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000002.501396536.0000000000497000.00000040.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000000.00000002.241144168.00000000042C7000.00000040.00000001.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000000.00000002.241144168.00000000042C7000.00000040.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000001.235680106.0000000000497000.00000040.00020000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 00000002.00000001.235680106.0000000000497000.00000040.00020000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 00000002.00000002.509906851.0000000002B1E000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 0.2.Material Description_PDF.exe.41d0000.2.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 0.2.Material Description_PDF.exe.41d0000.2.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.1.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.2.Material Description_PDF.exe.8b0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor'
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csCryptographic APIs: 'CreateDecryptor'
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csBase64 encoded string: 'VMRqxs8h7wF3QvADE+KoUFPmaqJE//xbemSpKgDjTW2roFBhoA2NhvjqJxA10MUFZTVp5zaBp/UVfyLB9dygHA==', 'M0AI4oGXYois6zO82tIYyAaFCmuqQaZUCx40WOPQ1/r/NijvpJihd2YGRwf6FzCr', '/uIc2JIJgTMzI1iODyn2W2nI3XK62JBW+NacD3k5vjweBh+/YtTGNksD8yE2wKGJL3Ox9TeSq1JjwGmDh8/VnA==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csBase64 encoded string: 'VMRqxs8h7wF3QvADE+KoUFPmaqJE//xbemSpKgDjTW2roFBhoA2NhvjqJxA10MUFZTVp5zaBp/UVfyLB9dygHA==', 'M0AI4oGXYois6zO82tIYyAaFCmuqQaZUCx40WOPQ1/r/NijvpJihd2YGRwf6FzCr', '/uIc2JIJgTMzI1iODyn2W2nI3XK62JBW+NacD3k5vjweBh+/YtTGNksD8yE2wKGJL3Ox9TeSq1JjwGmDh8/VnA==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.csBase64 encoded string: 'VMRqxs8h7wF3QvADE+KoUFPmaqJE//xbemSpKgDjTW2roFBhoA2NhvjqJxA10MUFZTVp5zaBp/UVfyLB9dygHA==', 'M0AI4oGXYois6zO82tIYyAaFCmuqQaZUCx40WOPQ1/r/NijvpJihd2YGRwf6FzCr', '/uIc2JIJgTMzI1iODyn2W2nI3XK62JBW+NacD3k5vjweBh+/YtTGNksD8yE2wKGJL3Ox9TeSq1JjwGmDh8/VnA==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.csBase64 encoded string: 'VMRqxs8h7wF3QvADE+KoUFPmaqJE//xbemSpKgDjTW2roFBhoA2NhvjqJxA10MUFZTVp5zaBp/UVfyLB9dygHA==', 'M0AI4oGXYois6zO82tIYyAaFCmuqQaZUCx40WOPQ1/r/NijvpJihd2YGRwf6FzCr', '/uIc2JIJgTMzI1iODyn2W2nI3XK62JBW+NacD3k5vjweBh+/YtTGNksD8yE2wKGJL3Ox9TeSq1JjwGmDh8/VnA==', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                  Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winEXE@7/3@4/4
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00421CEC GetLastError,FormatMessageA,0_2_00421CEC
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004089E0 GetDiskFreeSpaceA,0_2_004089E0
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,FindCloseChangeNotification,free,Process32NextW,FindCloseChangeNotification,6_2_00411196
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00415558 FindResourceA,0_2_00415558
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile created: C:\Users\user\AppData\Roaming\pid.txtJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile created: C:\Users\user\AppData\Local\Temp\holdermail.txtJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformationJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                  Source: Material Description_PDF.exe, 00000000.00000002.240847276.0000000004232000.00000040.00000001.sdmp, Material Description_PDF.exe, 00000002.00000002.511026557.0000000003AE1000.00000004.00000001.sdmp, vbc.exe, 00000006.00000002.267186066.0000000000400000.00000040.00000001.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                  Source: Material Description_PDF.exe, vbc.exeBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                  Source: Material Description_PDF.exeReversingLabs: Detection: 35%
                  Source: unknownProcess created: C:\Users\user\Desktop\Material Description_PDF.exe 'C:\Users\user\Desktop\Material Description_PDF.exe'
                  Source: unknownProcess created: C:\Users\user\Desktop\Material Description_PDF.exe 'C:\Users\user\Desktop\Material Description_PDF.exe'
                  Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
                  Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeProcess created: C:\Users\user\Desktop\Material Description_PDF.exe 'C:\Users\user\Desktop\Material Description_PDF.exe' Jump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'Jump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'Jump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                  Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: Material Description_PDF.exe
                  Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: Material Description_PDF.exe, vbc.exe
                  Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: Material Description_PDF.exe, vbc.exe

                  Data Obfuscation:

                  barindex
                  Detected unpacking (changes PE section rights)Show sources
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeUnpacked PE file: 2.2.Material Description_PDF.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rsrc:R;.reloc:R;
                  Detected unpacking (creates a PE file in dynamic memory)Show sources
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeUnpacked PE file: 2.2.Material Description_PDF.exe.2310000.3.unpack
                  Detected unpacking (overwrites its own PE header)Show sources
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeUnpacked PE file: 2.2.Material Description_PDF.exe.400000.0.unpack
                  .NET source code contains potential unpackerShow sources
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 0.2.Material Description_PDF.exe.4230000.3.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2310000.3.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.2220000.2.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: 2.2.Material Description_PDF.exe.400000.0.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0045EB30 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateThread,WaitForSingleObject,0_2_0045EB30
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0043FF60 push 0043FFEDh; ret 0_2_0043FFE5
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0042A000 push 0042A02Ch; ret 0_2_0042A024
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004281AC push 004281D8h; ret 0_2_004281D0
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00428434 push 00428460h; ret 0_2_00428458
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004064E2 push 00406535h; ret 0_2_0040652D
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004064E4 push 00406535h; ret 0_2_0040652D
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004564A8 push ecx; mov dword ptr [esp], ecx0_2_004564AD
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0042E658 push 0042E6B1h; ret 0_2_0042E6A9
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0045E668 push 0045E6DEh; ret 0_2_0045E6D6
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_00418604 push ecx; mov dword ptr [esp], edx0_2_00418606
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0042E6E0 push 0042E718h; ret 0_2_0042E710
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_004066B4 push 004066E0h; ret 0_2_004066D8
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0042E774 push 0042E7A0h; ret 0_2_0042E798
                  Source: C:\Users\user\Desktop\Material Description_PDF.exeCode function: 0_2_0040672C push 0