Play interactive tour

Edit tour

Analysis Report BL FOR SHIPMENT_doc.gz.exe

Overview

General Information

Sample Name:	BL FOR SHIPMENT_doc.gz.exe
Analysis ID:	338152
MD5:	04e43f3aee65c1d03b8c7adfa6d9fce9
SHA1:	1bce09b3a5c827d412feea47a86619fa9a7ac94f
SHA256:	9fecb65659cb47a10afab901b14904f54384f5481e0ef0331e009bfc580cfe29
Tags:	exe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

BL FOR SHIPMENT_doc.gz.exe (PID: 6440 cmdline: 'C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe' MD5: 04E43F3AEE65C1D03B8C7ADFA6D9FCE9)

BL FOR SHIPMENT_doc.gz.exe (PID: 3976 cmdline: {path} MD5: 04E43F3AEE65C1D03B8C7ADFA6D9FCE9)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "kyqjbOqsGP2YKsV", "URL: ": "https://M2zxRmp3kpObpEIzJWTy.com", "To: ": "sydney@dicon.md", "ByHost: ": "mail.dicon.md:587", "Password: ": "Hoq8zXmvKJ", "From: ": "sydney@dicon.md"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 6440	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 6440	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 3976	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 3976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: BL FOR SHIPMENT_doc.gz.exe.3976.1.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "kyqjbOqsGP2YKsV", "URL: ": "https://M2zxRmp3kpObpEIzJWTy.com", "To: ": "sydney@dicon.md", "ByHost: ": "mail.dicon.md:587", "Password: ": "Hoq8zXmvKJ", "From: ": "sydney@dicon.md"}

Multi AV Scanner detection for submitted file

Show sources

Source: BL FOR SHIPMENT_doc.gz.exe	Virustotal: Detection: 28%			Perma Link
Source: BL FOR SHIPMENT_doc.gz.exe	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Show sources

Source: BL FOR SHIPMENT_doc.gz.exe

Joe Sandbox ML: detected

Source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://M2zxRmp3kpObpEIzJWTy.com

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 194.33.40.40:587

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 194.33.40.40:587

Source: unknown

DNS traffic detected: queries for: mail.dicon.md

Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://dicon.md
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	String found in binary or memory: http://fwuwEZ.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://mail.dicon.md
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/05
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010139904.00000000031FE000.00000004.00000001.sdmp	String found in binary or memory: https://M2zxRmp3kpObpEIzJWTy.com
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp, BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b918F0518u002d7F6Eu002d4A76u002d9126u002dC7CB299D37B9u007d/D9348C2Cu002d20BFu002d4203u002d981Bu002d2157C2180C58.cs

Large array initialization: .cctor: array initializer size 11923

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: BL FOR SHIPMENT_doc.gz.exe

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 0_2_07C9D380	0_2_07C9D380
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 0_2_07C9DA30	0_2_07C9DA30
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_0133B518	1_2_0133B518
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_01336490	1_2_01336490
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_053746A0	1_2_053746A0
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_05373CF6	1_2_05373CF6
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_05374630	1_2_05374630
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_05374652	1_2_05374652
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_05374690	1_2_05374690
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_064026C3	1_2_064026C3
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_0640BC50	1_2_0640BC50
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06408D18	1_2_06408D18
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06409A78	1_2_06409A78
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06405A08	1_2_06405A08
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06400040	1_2_06400040
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06408158	1_2_06408158

Source: BL FOR SHIPMENT_doc.gz.exe	Binary or memory string: OriginalFilename vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.669113666.00000000078C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamewhlDyMZDpWePGzIbeEPZpLr.exe4 vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000000.641105525.0000000000CE2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenE vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe	Binary or memory string: OriginalFilename vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1013045409.0000000006430000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1008727298.0000000000DA8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1008623295.0000000000B42000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenE vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamewhlDyMZDpWePGzIbeEPZpLr.exe4 vs BL FOR SHIPMENT_doc.gz.exe
Source: BL FOR SHIPMENT_doc.gz.exe	Binary or memory string: OriginalFilenamenE vs BL FOR SHIPMENT_doc.gz.exe

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BL FOR SHIPMENT_doc.gz.exe.log

Jump to behavior

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: BL FOR SHIPMENT_doc.gz.exe	Virustotal: Detection: 28%
Source: BL FOR SHIPMENT_doc.gz.exe	ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe 'C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe'
Source: unknown	Process created: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe {path}
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process created: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BL FOR SHIPMENT_doc.gz.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: BL FOR SHIPMENT_doc.gz.exe, ?dde??Vjy?i/zHK???cn???.cs	.Net Code: pSSOFDNSnX System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.BL FOR SHIPMENT_doc.gz.exe.ce0000.0.unpack, ?dde??Vjy?i/zHK???cn???.cs	.Net Code: pSSOFDNSnX System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.BL FOR SHIPMENT_doc.gz.exe.ce0000.0.unpack, ?dde??Vjy?i/zHK???cn???.cs	.Net Code: pSSOFDNSnX System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.BL FOR SHIPMENT_doc.gz.exe.b40000.0.unpack, ?dde??Vjy?i/zHK???cn???.cs	.Net Code: pSSOFDNSnX System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.BL FOR SHIPMENT_doc.gz.exe.b40000.1.unpack, ?dde??Vjy?i/zHK???cn???.cs	.Net Code: pSSOFDNSnX System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_014ED95C push eax; ret	1_2_014ED95D
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_014EE28A push eax; ret	1_2_014EE349
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Code function: 1_2_06407606 push es; iretd	1_2_06407610

Source: initial sample

Static PE information: section name: .text entropy: 7.68132853589

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match

File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 6440, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Window / User API: threadDelayed 1684			Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Window / User API: threadDelayed 8167			Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe TID: 6444	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe TID: 2192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe TID: 6900	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe TID: 6896	Thread sleep count: 1684 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe TID: 6896	Thread sleep count: 8167 > 30	Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.663963919.000000000336D000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Code function: 1_2_06409A78 LdrInitializeThunk,

1_2_06409A78

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Process created: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe {path}

Jump to behavior

Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009523603.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009523603.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009523603.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009523603.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 6440, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 3976, type: MEMORY
Source: Yara match	File source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 3976, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 6440, type: MEMORY
Source: Yara match	File source: Process Memory Space: BL FOR SHIPMENT_doc.gz.exe PID: 3976, type: MEMORY
Source: Yara match	File source: 1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion13	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion13	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol111	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BL FOR SHIPMENT_doc.gz.exe	28%	Virustotal		Browse
BL FOR SHIPMENT_doc.gz.exe	17%	ReversingLabs	Win32.Trojan.Pwsx
BL FOR SHIPMENT_doc.gz.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.BL FOR SHIPMENT_doc.gz.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
dicon.md	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://dicon.md	0%	Virustotal		Browse
http://dicon.md	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://M2zxRmp3kpObpEIzJWTy.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://fwuwEZ.com	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/05	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://mail.dicon.md	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dicon.md	194.33.40.40	true	true	0%, Virustotal, Browse	unknown
mail.dicon.md	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://M2zxRmp3kpObpEIzJWTy.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.letsencrypt.org0	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.tiro.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://dicon.md	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fwuwEZ.com	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/05	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.dicon.md	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.fonts.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.667695107.0000000006160000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	BL FOR SHIPMENT_doc.gz.exe, 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp, BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.root-x1.letsencrypt.org0	BL FOR SHIPMENT_doc.gz.exe, 00000001.00000002.1010094051.00000000031DD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.33.40.40	unknown	Moldova Republic of		206698	AMPLICAMD	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	338152
Start date:	11.01.2021
Start time:	18:12:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BL FOR SHIPMENT_doc.gz.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 52.255.188.83, 51.104.139.180, 92.122.213.247, 92.122.213.194, 52.155.217.156, 20.54.26.129, 8.248.133.254, 8.248.149.254, 67.26.137.254, 8.248.131.254, 67.27.233.254, 51.11.168.160 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, skypedataprdcolwus15.cloudapp.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:13:00	API Interceptor	1100x Sleep call for process: BL FOR SHIPMENT_doc.gz.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMPLICAMD	15#U043e #U0437#U0430#U043a#U0430#U0437#U0435.js	Get hash	malicious	Browse	185.165.242.5

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BL FOR SHIPMENT_doc.gz.exe.log Download File
Process:	C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.672462819594914
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BL FOR SHIPMENT_doc.gz.exe
File size:	868352
MD5:	04e43f3aee65c1d03b8c7adfa6d9fce9
SHA1:	1bce09b3a5c827d412feea47a86619fa9a7ac94f
SHA256:	9fecb65659cb47a10afab901b14904f54384f5481e0ef0331e009bfc580cfe29
SHA512:	0150f88de48b441f8280a57afa2da62db8d96030aa7d76216ea27a2ebec2077aba2bd6944940fb2241f26e8f45d996d7d49760a205e12f9797aaff2549d6dcd9
SSDEEP:	12288:8+YIt10emnVKrlQksJo6DIDn5WT54ETEE5VJAoWEaDr/HZiB41ab5qMp9meTH:NYq1bmn4rjsywT3YE5VJAxvD08op9/T
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p._.................4..........^R... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4d525e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FFC7099 [Mon Jan 11 15:36:57 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd5208	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd3264	0xd3400	False	0.813755085059	data	7.68132853589	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x800	0x800	False	0.3330078125	data	3.49311095127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd6090	0x388	data
RT_MANIFEST	0xd6428	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Overwolf 2011 - 2020
Assembly Version	2.159.0.0
InternalName	n.exe
FileVersion	2.159.0.0
CompanyName	Overwolf Ltd.
LegalTrademarks
Comments	Overwolf Launcher
ProductName	OverwolfLauncher
ProductVersion	2.159.0.0
FileDescription	OverwolfLauncher
OriginalFilename	n.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 18:14:42.559436083 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:42.637659073 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:42.637816906 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:42.861222029 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:42.861852884 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:42.945286036 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:42.945712090 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.030203104 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.074209929 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.118367910 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.236181974 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.239213943 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.239265919 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.239305019 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.239357948 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.248747110 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.327022076 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.327749014 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.371118069 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.613140106 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.693869114 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.695502043 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.774070024 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.775563002 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.869687080 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.871118069 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:43.949812889 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:43.950710058 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.029705048 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.030528069 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.108799934 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.111227036 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.111510038 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.112556934 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.112760067 CET	49771	587	192.168.2.4	194.33.40.40
Jan 11, 2021 18:14:44.189486027 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.189588070 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.190604925 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.190726995 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.427582026 CET	587	49771	194.33.40.40	192.168.2.4
Jan 11, 2021 18:14:44.468312979 CET	49771	587	192.168.2.4	194.33.40.40

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 18:12:49.464170933 CET	64549	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:49.512180090 CET	53	64549	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:50.583703995 CET	63153	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:50.631527901 CET	53	63153	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:52.270781040 CET	52991	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:52.318659067 CET	53	52991	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:53.491065979 CET	53700	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:53.540293932 CET	53	53700	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:54.771020889 CET	51726	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:54.819034100 CET	53	51726	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:55.708014965 CET	56794	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:55.755938053 CET	53	56794	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:56.842890978 CET	56534	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:56.902055025 CET	53	56534	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:58.026612997 CET	56627	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:58.077466011 CET	53	56627	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:58.837728977 CET	56621	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:58.888622046 CET	53	56621	8.8.8.8	192.168.2.4
Jan 11, 2021 18:12:59.635940075 CET	63116	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:12:59.683841944 CET	53	63116	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:00.618387938 CET	64078	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:00.669015884 CET	53	64078	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:01.396958113 CET	64801	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:01.444984913 CET	53	64801	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:02.156285048 CET	61721	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:02.204107046 CET	53	61721	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:02.917515039 CET	51255	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:02.968255043 CET	53	51255	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:14.248281002 CET	61522	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:14.299212933 CET	53	61522	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:17.927120924 CET	52337	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:17.985075951 CET	53	52337	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:31.205475092 CET	55046	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:31.309273958 CET	53	55046	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:31.873848915 CET	49612	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:31.985476017 CET	53	49612	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:32.586378098 CET	49285	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:32.642829895 CET	53	49285	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:33.081886053 CET	50601	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:33.140909910 CET	53	50601	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:33.206767082 CET	60875	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:33.265825033 CET	53	60875	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:33.604794025 CET	56448	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:33.661056995 CET	53	56448	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:34.221616030 CET	59172	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:34.280769110 CET	53	59172	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:34.867137909 CET	62420	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:34.926578045 CET	53	62420	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:35.735361099 CET	60579	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:35.794492006 CET	53	60579	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:36.685787916 CET	50183	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:36.733956099 CET	53	50183	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:37.153882027 CET	61531	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:37.213567972 CET	53	61531	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:39.725151062 CET	49228	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:39.776146889 CET	53	49228	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:49.024144888 CET	59794	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:49.072282076 CET	53	59794	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:49.217411041 CET	55916	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:49.289505005 CET	53	55916	8.8.8.8	192.168.2.4
Jan 11, 2021 18:13:51.394382000 CET	52752	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:13:51.454652071 CET	53	52752	8.8.8.8	192.168.2.4
Jan 11, 2021 18:14:24.312299013 CET	60542	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:14:24.363344908 CET	53	60542	8.8.8.8	192.168.2.4
Jan 11, 2021 18:14:26.142430067 CET	60689	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:14:26.208874941 CET	53	60689	8.8.8.8	192.168.2.4
Jan 11, 2021 18:14:42.143096924 CET	64206	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:14:42.242369890 CET	53	64206	8.8.8.8	192.168.2.4
Jan 11, 2021 18:14:42.278589010 CET	50904	53	192.168.2.4	8.8.8.8
Jan 11, 2021 18:14:42.466648102 CET	53	50904	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 11, 2021 18:14:42.143096924 CET	192.168.2.4	8.8.8.8	0x1c8e	Standard query (0)	mail.dicon.md	A (IP address)	IN (0x0001)
Jan 11, 2021 18:14:42.278589010 CET	192.168.2.4	8.8.8.8	0x83e6	Standard query (0)	mail.dicon.md	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 11, 2021 18:14:42.242369890 CET	8.8.8.8	192.168.2.4	0x1c8e	No error (0)	mail.dicon.md	dicon.md		CNAME (Canonical name)	IN (0x0001)
Jan 11, 2021 18:14:42.242369890 CET	8.8.8.8	192.168.2.4	0x1c8e	No error (0)	dicon.md		194.33.40.40	A (IP address)	IN (0x0001)
Jan 11, 2021 18:14:42.466648102 CET	8.8.8.8	192.168.2.4	0x83e6	No error (0)	mail.dicon.md	dicon.md		CNAME (Canonical name)	IN (0x0001)
Jan 11, 2021 18:14:42.466648102 CET	8.8.8.8	192.168.2.4	0x83e6	No error (0)	dicon.md		194.33.40.40	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 11, 2021 18:14:42.861222029 CET	587	49771	194.33.40.40	192.168.2.4	220-web2.amplica.net ESMTP Exim 4.93 #2 Mon, 11 Jan 2021 19:14:42 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 11, 2021 18:14:42.861852884 CET	49771	587	192.168.2.4	194.33.40.40	EHLO 830021
Jan 11, 2021 18:14:42.945286036 CET	587	49771	194.33.40.40	192.168.2.4	250-web2.amplica.net Hello 830021 [84.17.52.74] 250-SIZE 83886080 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 11, 2021 18:14:42.945712090 CET	49771	587	192.168.2.4	194.33.40.40	STARTTLS
Jan 11, 2021 18:14:43.030203104 CET	587	49771	194.33.40.40	192.168.2.4	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: BL FOR SHIPMENT_doc.gz.exe PID: 6440 Parent PID: 5904

General

Start time:	18:12:54
Start date:	11/01/2021
Path:	C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe'
Imagebase:	0xce0000
File size:	868352 bytes
MD5 hash:	04E43F3AEE65C1D03B8C7ADFA6D9FCE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.665888158.00000000045C4000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BL FOR SHIPMENT_doc.gz.exe PID: 3976 Parent PID: 6440

General

Start time:	18:13:03
Start date:	11/01/2021
Path:	C:\Users\user\Desktop\BL FOR SHIPMENT_doc.gz.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xb40000
File size:	868352 bytes
MD5 hash:	04E43F3AEE65C1D03B8C7ADFA6D9FCE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1009653360.0000000002E81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1008577891.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: BL FOR SHIPMENT_doc.gz.exe PID: 6440 Parent PID: 5904 BL FOR SHIPMENT_doc.gz.exeCOMMON

Executed Functions

Function 07C9D380, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669878299.0000000007C90000.00000040.00000001.sdmp, Offset: 07C90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69ad7c540c261e9f63d5f2b7a55b95fa59e1e833312943ecb2bb8474b69b749
Instruction ID: 68ffb531f2f7a80843252d8c75ef05d9b7cde441e43580e9509bc8c13ed556c3
Opcode Fuzzy Hash: e69ad7c540c261e9f63d5f2b7a55b95fa59e1e833312943ecb2bb8474b69b749
Instruction Fuzzy Hash: 15125B74A10219CFCF54DF68D888A9DB7B2FF85304F5185A5E90AAB225DB30EE85CF50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07C9DA30, Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669878299.0000000007C90000.00000040.00000001.sdmp, Offset: 07C90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffabbb82dc230d28f9d1dc8f915e02249fdb9d7229f65d06096d2eea944016d
Instruction ID: 18effe5a1d4e7fbefac78e60d563a8779adc9631904ba6ee0e79b1d7e05fd619
Opcode Fuzzy Hash: 1ffabbb82dc230d28f9d1dc8f915e02249fdb9d7229f65d06096d2eea944016d
Instruction Fuzzy Hash: 4B724AB5E0021ACFCF54CFA8C888AADBBB1FF45300F1585A9D546BB255D7309E91CB51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BL FOR SHIPMENT_doc.gz.exe PID: 3976 Parent PID: 6440 BL FOR SHIPMENT_doc.gz.exeCOMMON

Executed Functions

Function 06409A78, Relevance: 2.8, APIs: 1, Instructions: 1293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69010f2832ff5ed30631b7fec4358e9ce26ee030234320b91b709112844d50a
Instruction ID: bf827a3bc7593d992f6a392e288e9c0332bb2a9f75fa5cd50ed92eeab762c442
Opcode Fuzzy Hash: a69010f2832ff5ed30631b7fec4358e9ce26ee030234320b91b709112844d50a
Instruction Fuzzy Hash: 85B27030E002198FDB65DF78C85479EB7F1AF89300F1185AAD509EB3A5EB349D85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05373CF6, Relevance: 1.8, APIs: 1, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43aa7858e2b755abfa413ee80f20dad902a0905f9badd03367339e2f38921a24
Instruction ID: 7e797952a67c919716401f05cb112dad423a14f6432a9deb98a8b8da0daa2ccf
Opcode Fuzzy Hash: 43aa7858e2b755abfa413ee80f20dad902a0905f9badd03367339e2f38921a24
Instruction Fuzzy Hash: 4BC17474B006098FDB24EF79C49465EBBF2FF88204B108A2DD51ADB755DF78E9018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0537691F, Relevance: 6.1, APIs: 4, Instructions: 134threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 053769A0
GetCurrentThread.KERNEL32 ref: 053769DD
GetCurrentProcess.KERNEL32 ref: 05376A1A
GetCurrentThreadId.KERNEL32 ref: 05376A73

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2bbf3cf036e8143dd141f1f06af5885ccbf8aeebecc5e302a489c8c209611be5
Instruction ID: eba5aa6ccda0bcc280272cd854e9c57db78070fb9fecc703f4076b3be270d748
Opcode Fuzzy Hash: 2bbf3cf036e8143dd141f1f06af5885ccbf8aeebecc5e302a489c8c209611be5
Instruction Fuzzy Hash: 275167B0D046499FDB14CFAAC949BDEBFF0EF89314F24846AE449A7390DB785844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05376940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 053769A0
GetCurrentThread.KERNEL32 ref: 053769DD
GetCurrentProcess.KERNEL32 ref: 05376A1A
GetCurrentThreadId.KERNEL32 ref: 05376A73

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c9cc7813948e28c050ca6c904777df9a1dabdcb846ce67cd9f260e430df63568
Instruction ID: 8cc5b2287981c407de57545a489a0e45afc93ca3d0693e573ed92b9bfd815dbd
Opcode Fuzzy Hash: c9cc7813948e28c050ca6c904777df9a1dabdcb846ce67cd9f260e430df63568
Instruction Fuzzy Hash: 2C5144B0D006499FDB14CFAAC649BDEBFF1AF88314F24846AE449A7390DB785844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0640B960, Relevance: 1.7, APIs: 1, Instructions: 175libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0640BA1F

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 589a77403e411b8ac8dd8bfb2d654b1f4e389b31b1c7cf40691260c2f06d09bb
Instruction ID: ba9276b295a81d2cca5adb6cd1a9656b332c6edc96e66f2c07bbaefb058b6145
Opcode Fuzzy Hash: 589a77403e411b8ac8dd8bfb2d654b1f4e389b31b1c7cf40691260c2f06d09bb
Instruction Fuzzy Hash: 78511231B002059FDB54EBB4D844AAE77F6EF85210F14856AE506DB3A5DF74E804CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0537500F, Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1a3a3aff0379c9a2fa51d478dc4c251e43822ae019888427f15f3ac9b78fee
Instruction ID: 89eaf9d18928bd8dd890df89215b4f07414552ec4c57186ec3802e7e6ecac1fd
Opcode Fuzzy Hash: bc1a3a3aff0379c9a2fa51d478dc4c251e43822ae019888427f15f3ac9b78fee
Instruction Fuzzy Hash: 386112B1C0424DAFDF16CFA5C884ACDBFB1BF49310F25816AE808AB261D7759855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0640B9C0, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0640BA1F

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2cfd73a4833a92dc3c28769e83999a3d1655cafc0dba77572ade7cebb022591c
Instruction ID: 31f7ab35e179f5a29001200f559216c8c34faac5a002413fa187bbbf77636885
Opcode Fuzzy Hash: 2cfd73a4833a92dc3c28769e83999a3d1655cafc0dba77572ade7cebb022591c
Instruction Fuzzy Hash: 1751A371B0021A9FDB14EFB4D854AAEB7E5FF85214B148A29D502DB395DF74EC04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0640E038, Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1fe190b601436c76aa34fd3111e6a11d1ca54bfc48c8fa8be36cccf349c581
Instruction ID: aaaf4323e3861204b8fee71d5a02e6761262e4971630aff3cdaa226c300d13ab
Opcode Fuzzy Hash: af1fe190b601436c76aa34fd3111e6a11d1ca54bfc48c8fa8be36cccf349c581
Instruction Fuzzy Hash: 18414172E083658FDB04DFB9D8006DABBB5EF89220F15856BD504E7391DB789891CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 05375090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053751A2

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a1c51c033aad4a163197afe1ff0061a198fcbbbc5d9a76bb3e63365459b3b3c3
Instruction ID: cc4879baf648dd5b9b684586d4ba6e31eeff9099307baa8bf1f8e3193361b8ea
Opcode Fuzzy Hash: a1c51c033aad4a163197afe1ff0061a198fcbbbc5d9a76bb3e63365459b3b3c3
Instruction Fuzzy Hash: A941B0B1D1034D9FDF14CF9AC884ADEBBB5BF88314F64812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05376C2A, Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05376BEF

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7fd499870b8ce4903dd4dd39fd5964d9b472e92fdea3d2318a4ee405e323220e
Instruction ID: 4202a3b55637dbfdc835a869c44e46bd144dd1f3fd534b6bc4bbc69a1c7436cb
Opcode Fuzzy Hash: 7fd499870b8ce4903dd4dd39fd5964d9b472e92fdea3d2318a4ee405e323220e
Instruction Fuzzy Hash: 9E417C74A103499FE714AFA1EA9EBA93FF5E788314F504529FA099B7C4CB745801CF21

Uniqueness

Uniqueness Score: -1.00%

Function 0537779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05377F01

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9d4358d81024c77456f8f6b8862209ddc7975cf3dff65d25bf1b9621de30766e
Instruction ID: 5112530245236ced6cc9b287e1cacdafa72bc68839fc313fbd7aabb2f088d7ff
Opcode Fuzzy Hash: 9d4358d81024c77456f8f6b8862209ddc7975cf3dff65d25bf1b9621de30766e
Instruction Fuzzy Hash: CF412CB4900309DFDB14CF55C448BAABBF5FF88314F158459E519AB361D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0537C109, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0537C192

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 66fd2037d8f52d7825620b6981a4489e39db1082f386172222fe4d34e9e82f47
Instruction ID: eda5cbba7588a0ff505d9bbd2137cf4063c76a89ab819228bad6422ad826f499
Opcode Fuzzy Hash: 66fd2037d8f52d7825620b6981a4489e39db1082f386172222fe4d34e9e82f47
Instruction Fuzzy Hash: D731E0708043898FDB20DFA9DA593DEBFF4FB46318F14906AD448A7642C7796904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05376B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05376BEF

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fae17680dbd24b76e0a08b5c6a4436dcc5b045ffaf08f6bd12a3f029d59dfbbe
Instruction ID: fc87edb2ac8b10a728fa85a1e912ffb00e0b1e45cb607864446ab56e5c86554c
Opcode Fuzzy Hash: fae17680dbd24b76e0a08b5c6a4436dcc5b045ffaf08f6bd12a3f029d59dfbbe
Instruction Fuzzy Hash: E521E5B5D002499FDB10CF9AD985BDEBFF8EB48320F14842AE914A3350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05376B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05376BEF

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 07047c0f2859eed538ecb9ab4813d5b1eaf761862a3de6d83026ace97dc313fe
Instruction ID: f29084d9d6eda8b63b39f7f084edef561a6e69a1c77fae6c06cacd1adbd3643f
Opcode Fuzzy Hash: 07047c0f2859eed538ecb9ab4813d5b1eaf761862a3de6d83026ace97dc313fe
Instruction Fuzzy Hash: 1D21E4B5D002499FDB10CF9AD984BDEBBF8FB48320F14842AE914A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0640E108, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0640E08A), ref: 0640E177

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2784fc85957cf17c4de5dcb35fa302e201d349b28707c1f6749b99d33ca17c67
Instruction ID: b7d8ddd8d53f031c4373ca4540c58adbda4f5ae63d381c3600bc1c4d1869ac77
Opcode Fuzzy Hash: 2784fc85957cf17c4de5dcb35fa302e201d349b28707c1f6749b99d33ca17c67
Instruction Fuzzy Hash: 242133B1C006699FDB10CFAAD844BDEFBB8AF48320F15852AE414B7240D378A955CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 013365F4, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,01337819,00000800), ref: 013378AA

Memory Dump Source

Source File: 00000001.00000002.1009225416.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2a2384639d715dc24668691e437db2d89e49b060e01666753e9020cebfd76b76
Instruction ID: 3af3d139bde8e8988f0b0e03aed2cc6381532bc0a085e2ad3a0c13cdd1c1c1e0
Opcode Fuzzy Hash: 2a2384639d715dc24668691e437db2d89e49b060e01666753e9020cebfd76b76
Instruction Fuzzy Hash: 8E11E4B6D002499FDB14CF9AD844BDEFFF4EB88324F14842AE515A7600C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01337839, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,01337819,00000800), ref: 013378AA

Memory Dump Source

Source File: 00000001.00000002.1009225416.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89caaa4953613f60cc33fc6f4f064448e78fe9d6ebcd00f2310c51c7a533da6c
Instruction ID: 41808bd31fbd6937516ba4c8ccdafff6c4d251c64d8e95fc07b4c1ae1e457c08
Opcode Fuzzy Hash: 89caaa4953613f60cc33fc6f4f064448e78fe9d6ebcd00f2310c51c7a533da6c
Instruction Fuzzy Hash: 241114B6C002499FDB14CFAAD844BDEFFF4EB88324F14842AE555A7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0640CAE4, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0640E08A), ref: 0640E177

Memory Dump Source

Source File: 00000001.00000002.1013008218.0000000006400000.00000040.00000001.sdmp, Offset: 06400000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3cf61e460bd5a32a180b358cbd5d06b64de958fa0e5e81947b6b9e638a9601b7
Instruction ID: d38230ff79c3957d43cc49a4d89b9d1890f5854580be1fbb14f2a0e561f35b4e
Opcode Fuzzy Hash: 3cf61e460bd5a32a180b358cbd5d06b64de958fa0e5e81947b6b9e638a9601b7
Instruction Fuzzy Hash: 001142B1C006699BDB00CF9AC444BDEFBF4AF48224F15856AE918B7340D378A955CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 053740A8, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05374116

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b0e6974296343f9aaf99c39480830366b48e9d340c53f3c1efe751716ee7fe47
Instruction ID: 03988c86a68c7118346d077cd11d59d7dc9005c14ff5e2623beca99ea691926e
Opcode Fuzzy Hash: b0e6974296343f9aaf99c39480830366b48e9d340c53f3c1efe751716ee7fe47
Instruction Fuzzy Hash: AE1133B6D002498BDB20DF9AC4447DEFBF4EB89324F15842AD459B7200D3B8A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0537C118, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0537C192

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 0f4522d3966c819ecbd7b9d71158640a81b963f9ecf24879ba8e6061aa90f0a3
Instruction ID: 8dd96f8671dfbf887f81772ffb5c234d97baa47609f599c0429c97d95d34b63d
Opcode Fuzzy Hash: 0f4522d3966c819ecbd7b9d71158640a81b963f9ecf24879ba8e6061aa90f0a3
Instruction Fuzzy Hash: 471159B0D007498FDB20DFA9CA497DEBBF4FB45324F24942AD405A3641CB796944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05373300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05374116

Memory Dump Source

Source File: 00000001.00000002.1010787276.0000000005370000.00000040.00000001.sdmp, Offset: 05370000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 72974324ebace642daecb9258c3bcb53fb8efe8ce6c2fde5f357ee0ae6b9b925
Instruction ID: f4737c2ec0fca359d0220ee3a9a197b96712680b19a00cc6904649f56d27b596
Opcode Fuzzy Hash: 72974324ebace642daecb9258c3bcb53fb8efe8ce6c2fde5f357ee0ae6b9b925
Instruction Fuzzy Hash: 631104B5D047498FDB20DF9AC444BDEFBF5EB88224F15842AD419B7600D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0133B2F8, Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0133B355

Memory Dump Source

Source File: 00000001.00000002.1009225416.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0a7caef2a3eb2964d1050824106daa08f37294d10ce3d76465ff69570705ca82
Instruction ID: c575481a6bae21baad21c3b6c8025448caa71fbf8b0808419f1e56c15b5630dd
Opcode Fuzzy Hash: 0a7caef2a3eb2964d1050824106daa08f37294d10ce3d76465ff69570705ca82
Instruction Fuzzy Hash: FF1122B5900649CFDB10CF9AC489BCFFBF8EB88224F14841AD518A3600C338A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0133A3E8, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0133B355

Memory Dump Source

Source File: 00000001.00000002.1009225416.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a10c64a903fe40b123937d2bfcdde38a8ca4c9db9d24d704813861fbdcbfa5c7
Instruction ID: efd1f4ec8fd8ea006c0836fbf3d1ad0e5e1de60ff9d3d4012119d915695d1a86
Opcode Fuzzy Hash: a10c64a903fe40b123937d2bfcdde38a8ca4c9db9d24d704813861fbdcbfa5c7
Instruction Fuzzy Hash: E11133B4800658CFDB10CF9AC488BDEFBF8EB88224F14841AD919A3300C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014DD274, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009347367.00000000014DD000.00000040.00000001.sdmp, Offset: 014DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebd4dff409db78762890215b345e06086f6f28f5a10d4c3c25a742b5e0fafbe
Instruction ID: df9dcee23556069ebc53e0edc519e9a697d804b12060281ec6ccc192ced31557
Opcode Fuzzy Hash: 4ebd4dff409db78762890215b345e06086f6f28f5a10d4c3c25a742b5e0fafbe
Instruction Fuzzy Hash: 0B212871904240EFDF05CF94D9D0B2BBB65FB88324F24C66AE9054B296C736D816CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DD450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009347367.00000000014DD000.00000040.00000001.sdmp, Offset: 014DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086bdc1279b5134c9babcbb08c935d0bdc0d8509922a4663facfb84756eecf06
Instruction ID: 6dc3321904b634477135c379a4c04ca41d61ce689cf6c955864915c8d963c463
Opcode Fuzzy Hash: 086bdc1279b5134c9babcbb08c935d0bdc0d8509922a4663facfb84756eecf06
Instruction Fuzzy Hash: 372124B1904240EFDF01DF54D9D0B67BF65FB84324F24866AD9054B296C336E816CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014ED01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009373366.00000000014ED000.00000040.00000001.sdmp, Offset: 014ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e721f1b0b65de76af9fca292a4735224265731d5f30d334daf87ac436f51e72
Instruction ID: 690ea3224283663b6a69e53a469250e1c1ed5b0a6d3c55308eb3a4584603ddf4
Opcode Fuzzy Hash: 2e721f1b0b65de76af9fca292a4735224265731d5f30d334daf87ac436f51e72
Instruction Fuzzy Hash: CF2137B1904240DFDB15CF54D8C8B26BFA5FB84359F28CA6AD9494B356C336D807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014ED006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009373366.00000000014ED000.00000040.00000001.sdmp, Offset: 014ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4972763c50c2834ceaf555ef98b3e7f85efb463561261a23e69c7d26f58a6d7
Instruction ID: e5bebcd984f8af472b0070d324d3ce3ca07dd6a81b5407a0173a505d9c753b90
Opcode Fuzzy Hash: e4972763c50c2834ceaf555ef98b3e7f85efb463561261a23e69c7d26f58a6d7
Instruction Fuzzy Hash: 532192755093808FDB03CF24D994716BFB1EF46214F28C5DBD8498B667C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 014DD26F, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009347367.00000000014DD000.00000040.00000001.sdmp, Offset: 014DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036465fe5e54c15c5947acaccae627ac078cd2d7162af116298a92938776bd5d
Instruction ID: 036778f3bcffc31e76b540f37bacd8eee1e8a02fb795013c04858aec56c4889a
Opcode Fuzzy Hash: 036465fe5e54c15c5947acaccae627ac078cd2d7162af116298a92938776bd5d
Instruction Fuzzy Hash: 2921AF76804280DFDF16CF54D9D4B1ABF71FB88314F28C2AAD8444B666C33AD466CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DD44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1009347367.00000000014DD000.00000040.00000001.sdmp, Offset: 014DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987ae082b2f359035be596b84dcad585c5d9c7b80c54fd1badd6de72d9b1f1a2
Instruction ID: cbce0aa40823bbfa95a74c93e484feae6d68b90954ccd802c2d92fa51b10079a
Opcode Fuzzy Hash: 987ae082b2f359035be596b84dcad585c5d9c7b80c54fd1badd6de72d9b1f1a2
Instruction Fuzzy Hash: D911B176904280DFDF16CF54D9D4B16BF71FB84324F2486AAD8050B667C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report BL FOR SHIPMENT_doc.gz.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage