Loading ...

Play interactive tourEdit tour

Analysis Report SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe

Overview

General Information

Sample Name:SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
Analysis ID:299670
MD5:751a08ca844f1ec61ccccc0f4b53a608
SHA1:1b02f9685b81e6038f81ebcaf15b57804fc22fe2
SHA256:80f45086395417ea3bda68a20d2fc5b0bc5050c000023d82544fd2b5b5a8ce89
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.587410435.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.589104882.0000000002D56000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          00000000.00000002.330699871.0000000002A81000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Suspicious Double ExtensionShow sources
              Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, CommandLine: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, CommandLine|base64offset|contains: 0CS, Image: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, NewProcessName: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, OriginalFileName: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe' , ParentImage: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, ParentProcessId: 4248, ProcessCommandLine: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, ProcessId: 7072

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for submitted fileShow sources
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeVirustotal: Detection: 26%Perma Link
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeReversingLabs: Detection: 16%
              Machine Learning detection for sampleShow sources
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeJoe Sandbox ML: detected
              Source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: http://XsZjyO.com
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330699871.0000000002A81000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.331091227.0000000003A89000.00000004.00000001.sdmp, SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.587410435.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.331091227.0000000003A89000.00000004.00000001.sdmp, SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.587410435.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b3293E656u002d0318u002d458Fu002d964Bu002d50A2E286CD2Cu007d/C1957F36u002d1293u002d402Bu002dB110u002dE8EDDCF874A4.csLarge array initialization: .cctor: array initializer size 11811
              Initial sample is a PE file and has a suspicious nameShow sources
              Source: initial sampleStatic PE information: Filename: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_028A6A500_2_028A6A50
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_028A6A600_2_028A6A60
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_028ACD200_2_028ACD20
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_028A97540_2_028A9754
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_050AA0F00_2_050AA0F0
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_050ADCE80_2_050ADCE8
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_050A782E0_2_050A782E
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_05DAB4780_2_05DAB478
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_05DA00400_2_05DA0040
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_05DA00070_2_05DA0007
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_05DA62D80_2_05DA62D8
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 0_2_05DA62C80_2_05DA62C8
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B446A01_2_02B446A0
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B4359C1_2_02B4359C
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B43D501_2_02B43D50
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B446901_2_02B44690
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B453901_2_02B45390
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_02B4D9801_2_02B4D980
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330004114.0000000000682000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAnmU.exe: vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.333779851.0000000005080000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameexag vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.334267406.0000000005C60000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameKedermister.dllT vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.331091227.0000000003A89000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameBFvTaOGpUHayyqsSdVMJpTMT.exe4 vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588397485.000000000105A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.587764737.0000000000D38000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000000.329048729.00000000008C2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAnmU.exe: vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.587488655.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameBFvTaOGpUHayyqsSdVMJpTMT.exe4 vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeBinary or memory string: OriginalFilenameAnmU.exe: vs SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@0/0
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.logJump to behavior
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330004114.0000000000682000.00000002.00020000.sdmp, SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000000.329048729.00000000008C2000.00000002.00020000.sdmpBinary or memory string: select Insurance_Details_ID from insurance_details order by Insurance_Details_ID desc limit 1;Minsert into insurance_details values (
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeVirustotal: Detection: 26%
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeReversingLabs: Detection: 16%
              Source: unknownProcess created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe 'C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe'
              Source: unknownProcess created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_0125E333 push eax; ret 1_2_0125E349
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeCode function: 1_2_0125D95C push eax; ret 1_2_0125D95D
              Source: initial sampleStatic PE information: section name: .text entropy: 7.56339932852
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.330699871.0000000002A81000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 4248, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeWindow / User API: threadDelayed 739Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 7012Thread sleep time: -51348s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1724Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -3689348814741908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 3540Thread sleep count: 57 > 30Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 3540Thread sleep count: 739 > 30Jump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -88968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -58594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -58406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -86718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -57500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -56906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -85032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -83718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -83391s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -54906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -54500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -81468s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -53812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -106812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -106376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -79500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -79218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -104624s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -52094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -51188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -50094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -49000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -73218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -72891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -71250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -70968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -47094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -46906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -46688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -69609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -69282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -45812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -68391s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -67968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -67641s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -67032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -44500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -44312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -66000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -65718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -43594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -43406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -64782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -42906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -64032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -63750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -63468s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -63141s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -62718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -83188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -62109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -61782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -81000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -39688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -59109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -58782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -38812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -38594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -38312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -76188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -37906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -37688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -37500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -55500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -35906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -53532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -34594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -33812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -31312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -60624s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -35250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -34968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -89718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -59594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -58906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -58688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -57594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -57406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -56312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -55406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -54094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -53906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -53688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -52594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -51906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -77532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -51500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -51312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -76500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -76218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -75891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -50406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -74859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -49688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -49500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -49312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -47812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -38906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -36500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -36312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -32812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -32500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -48468s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -47859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -31688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -31406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -31000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -46218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -30594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -44859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -43218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -41859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -41250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -39609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -38250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -37968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -36609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -35718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -32718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -30468s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -46812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -46594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -44188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -40000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -37406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -35406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -34312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe TID: 1876Thread sleep time: -33406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeLast function: Thread delayed
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II|update users set password = @password where user_id = @user_id
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000000.00000002.330752162.0000000002ACB000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeMemory written: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeProcess created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeJump to behavior
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588626452.0000000001600000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588626452.0000000001600000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588626452.0000000001600000.00000002.00000001.sdmpBinary or memory string: &Program Manager
              Source: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe, 00000001.00000002.588626452.0000000001600000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000001.00000002.587410435.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.589104882.0000000002D56000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.331091227.0000000003A89000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 4248, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 7072, type: MEMORY
              Source: Yara matchFile source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS CI,PL.BL.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Yara matchFile source: 00000001.00000002.588857397.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 7072, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000001.00000002.587410435.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.589104882.0000000002D56000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.331091227.0000000003A89000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 4248, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe PID: 7072, type: MEMORY
              Source: Yara matchFile source: 1.2.SHIPMENT DOCUMENTS CI,PL.BL.pdf.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Masquerading1OS Credential Dumping2Security Software Discovery211Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion13LSASS MemoryVirtualization/Sandbox Evasion13Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsSystem Information Discovery114SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.