Loading... Additional Content is being loaded
Analysis Report p1cture3.dll
Overview
General Information
| Sample Name: | p1cture3.dll |
| Analysis ID: | 332237 |
| MD5: | 363430ba47c7d69f75e9bc90dbbc1d8c |
| SHA1: | 47fe41dd67e0245c1ece8fcd2c10c713823db833 |
| SHA256: | 00af5f13551c5e20fe29ec3d12dca555a56cd1edcd0a8633373872334de485ae |
| Tags: | dllenelgaseluceGoziISFBUrsnif |
|
Most interesting Screenshot:  |
|
Detection
Ursnif
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Creates a COM Internet Explorer object
Writes or reads registry keys via WMI
Writes registry values via WMI
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Classification
AV Detection: |
  |
|---|
| Multi AV Scanner detection for submitted file |
| Source: |
Virustotal: |
Perma Link | ||
| Source: |
ReversingLabs: |
|||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Code function: |
1_2_00DF32BA | |
Networking: |
|
|---|
| Creates a COM Internet Explorer object |
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
HTTP traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: | ||