Play interactive tour

Edit tour

Analysis Report Shipping Documents.exe

Overview

General Information

Sample Name:	Shipping Documents.exe
Analysis ID:	339385
MD5:	a13297a6096403fbf5a7511265e151bb
SHA1:	e02adaeb53e1362281d565fa14b23485aeb758d4
SHA256:	35eaf7cfa69be622c7fae2b72daf3ab245c0237475288ff81568a5fa597fd2f5
Tags:	DHLexeGuLoader
Most interesting Screenshot:

Detection

GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Executable has a suspicious name (potential lure to open the executable)

Found potential dummy code loops (likely to delay analysis)

Initial sample is a PE file and has a suspicious name

Potential time zone aware malware

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Shipping Documents.exe (PID: 6460 cmdline: 'C:\Users\user\Desktop\Shipping Documents.exe' MD5: A13297A6096403FBF5A7511265E151BB)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Shipping Documents.exe PID: 6460	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Shipping Documents.exe PID: 6460	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Shipping Documents.exe

Virustotal: Detection: 34%

Perma Link

Source: Shipping Documents.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Shipping Documents.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Shipping Documents.exe

Source: C:\Users\user\Desktop\Shipping Documents.exe

Process Stats: CPU usage > 98%

Source: Shipping Documents.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Shipping Documents.exe, 00000000.00000000.230396857.0000000000410000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameHanderlsaftalernes5.exe vs Shipping Documents.exe
Source: Shipping Documents.exe	Binary or memory string: OriginalFilenameHanderlsaftalernes5.exe vs Shipping Documents.exe

Source: Shipping Documents.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal88.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Shipping Documents.exe

File created: C:\Users\user\AppData\Local\Temp\~DF1BA10356BF232D3D.TMP

Jump to behavior

Source: Shipping Documents.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Shipping Documents.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shipping Documents.exe

Virustotal: Detection: 34%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: Shipping Documents.exe PID: 6460, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: Shipping Documents.exe PID: 6460, type: MEMORY

Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004072E6 push 0AF4BD9Dh; ret	0_2_00407302
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6849 push es; iretd	0_2_004F699E
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6428 push FFFFFFF7h; ret	0_2_004F6430
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F04D2 push edi; retf	0_2_004F04D3
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F7DC9 push ebx; iretd	0_2_004F7DCA
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F7BE3 push ebp; retf	0_2_004F7BE5

Source: C:\Users\user\Desktop\Shipping Documents.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6AA8		0_2_004F6AA8
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F255A		0_2_004F255A

Potential time zone aware malware

Show sources

Source: C:\Users\user\Desktop\Shipping Documents.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Shipping Documents.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Shipping Documents.exe

RDTSC instruction interceptor: First address: 00000000004F6353 second address: 00000000004F6353 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE6207C9A34h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test edx, ecx 0x0000001f cmp dl, dl 0x00000021 cmp dh, 00000029h 0x00000024 add edi, edx 0x00000026 test al, cl 0x00000028 dec dword ptr [ebp+000000F8h] 0x0000002e cmp dword ptr [ebp+000000F8h], 00000000h 0x00000035 jne 00007FE6207C99B6h 0x00000037 pushad 0x00000038 mov cl, A1h 0x0000003a cmp cl, FFFFFFA1h 0x0000003d jne 00007FE6207C6A6Fh 0x00000043 popad 0x00000044 call 00007FE6207C9A1Ah 0x00000049 call 00007FE6207C9A44h 0x0000004e lfence 0x00000051 mov edx, dword ptr [7FFE0014h] 0x00000057 lfence 0x0000005a ret 0x0000005b mov esi, edx 0x0000005d pushad 0x0000005e rdtsc

Source: C:\Users\user\Desktop\Shipping Documents.exe

Code function: 0_2_004F1A4D rdtsc

0_2_004F1A4D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Shipping Documents.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Shipping Documents.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Shipping Documents.exe

Code function: 0_2_004F1A4D rdtsc

0_2_004F1A4D

Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6008 mov eax, dword ptr fs:[00000030h]	0_2_004F6008
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F5A1D mov eax, dword ptr fs:[00000030h]	0_2_004F5A1D
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F20C5 mov eax, dword ptr fs:[00000030h]	0_2_004F20C5
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F22F6 mov eax, dword ptr fs:[00000030h]	0_2_004F22F6
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6AF5 mov eax, dword ptr fs:[00000030h]	0_2_004F6AF5
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F6AA8 mov eax, dword ptr fs:[00000030h]	0_2_004F6AA8
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F255A mov eax, dword ptr fs:[00000030h]	0_2_004F255A
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F337D mov eax, dword ptr fs:[00000030h]	0_2_004F337D
Source: C:\Users\user\Desktop\Shipping Documents.exe	Code function: 0_2_004F25A8 mov eax, dword ptr fs:[00000030h]	0_2_004F25A8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Shipping Documents.exe, 00000000.00000002.1210731304.0000000000CD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Shipping Documents.exe, 00000000.00000002.1210731304.0000000000CD0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Shipping Documents.exe, 00000000.00000002.1210731304.0000000000CD0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: Shipping Documents.exe, 00000000.00000002.1210731304.0000000000CD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: Shipping Documents.exe, 00000000.00000002.1210731304.0000000000CD0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Shipping Documents.exe

Code function: 0_2_004F3219 cpuid

0_2_004F3219

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	System Time Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery411	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery211	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Shipping Documents.exe	34%	Virustotal		Browse
Shipping Documents.exe	2%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	339385
Start date:	13.01.2021
Start time:	22:01:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Shipping Documents.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.7% (good quality ratio 5.9%) Quality average: 33.4% Quality standard deviation: 32.5%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.1712166162996285
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Shipping Documents.exe
File size:	65536
MD5:	a13297a6096403fbf5a7511265e151bb
SHA1:	e02adaeb53e1362281d565fa14b23485aeb758d4
SHA256:	35eaf7cfa69be622c7fae2b72daf3ab245c0237475288ff81568a5fa597fd2f5
SHA512:	5580458078df372c45c1b21a71e3d3329fad06d383add76510d44c0f784e06657fc0fc0d25c247cb22616c390c0524c10b0564bc29d08df1f057aae7fc5559dd
SSDEEP:	768:2xoEO3vkfhGkEe40B68NgDaPGTvK4wl3MYxroGfHsPE64FsmSnOCCmEdQxFT:eI8fhGtwt8du43P94F67bEds
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......M.....................0....................@................

File Icon


Icon Hash:	f030f0c6f030b100

Static PE Info

General
Entrypoint:	0x401200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4DC0B19B [Wed May 4 01:53:31 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e4e19abc2b8b3cdf6beb846e51c393a2

Entrypoint Preview

Instruction
push 00401E5Ch
call 00007FE620AB9995h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+19536D6Eh], ah
sub byte ptr [ebx], ch
inc esp
lea eax, dword ptr [ecx+5Bh]
outsb
or eax, 009CDF0Eh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edx+6Fh], al
jc 00007FE620AB9A06h
jc 00007FE620AB99F3h
jc 00007FE620AB9A11h
push 00000065h
arpl word ptr [ecx+esi+00h], si
or eax, 7061430Ah
je 00007FE620AB9A0Bh
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add edx, edi
arpl bp, di
test dword ptr [ecx], A14D55C6h
pop ss
stosd
cmc
shr dword ptr [esp+ecx*2+1AFF549Eh], cl
aas
jne 00007FE620AB99E6h
push esi
dec esp
xchg byte ptr [esi-0B7E5A50h], dh
stosd
dec esp
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov al, 0Bh
add byte ptr [eax], al
cmp ecx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [esi+61h], al
insd
jnc 00007FE620AB9A16h
jc 00007FE620AB99D6h
add byte ptr [53000801h], cl
push ebp
dec ecx
dec edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd254	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0x8d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xc4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5f8	0xd000	False	0.520395132212	data	5.87567926879	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0xe000	0x1158	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0x8d8	0x1000	False	0.139404296875	data	1.33983584341	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x10370	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1035c	0x14	data
RT_VERSION	0x100f0	0x26c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

__vbaCyForInit, _CIcos, _adj_fptan, __vbaFreeVar, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaCyI2, __vbaStrCmp, __vbaCyI4, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaCyForNext, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Handerlsaftalernes5
FileVersion	2.00
CompanyName	Axis Corp
Comments	Axis Corp
ProductName	Project1
ProductVersion	2.00
OriginalFilename	Handerlsaftalernes5.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: Shipping Documents.exe PID: 6460 Parent PID: 5668

General

Start time:	22:02:12
Start date:	13/01/2021
Path:	C:\Users\user\Desktop\Shipping Documents.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Shipping Documents.exe'
Imagebase:	0x400000
File size:	65536 bytes
MD5 hash:	A13297A6096403FBF5A7511265E151BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Shipping Documents.exe PID: 6460 Parent PID: 5668 Shipping Documents.exeCOMMON

Executed Functions

Function 0040CF04, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0040CF04(signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				void* _v36;
				signed int _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v92;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				intOrPtr _v116;
				signed int _v120;
				intOrPtr _v124;
				intOrPtr _v136;
				signed int _v140;
				intOrPtr* _v144;
				signed int _v148;
				signed int _v152;
				intOrPtr _t93;
				char* _t94;
				signed int _t95;
				signed int _t102;
				signed int _t105;
				char* _t106;
				signed int _t116;
				signed int _t120;
				signed int _t123;
				void* _t124;
				signed int _t139;
				void* _t142;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				 *[fs:0x0] = _t146;
				L004010E0();
				_v16 = _t146;
				_v12 = E004010C8;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				_t93 =  *((intOrPtr*)( *_a4 + 4))(_a4, _t144, _t145, _t124,  *[fs:0x0], 0x4010e6);
				_push(0x53933);
				L004011E2();
				_v124 = _t93;
				_v120 = _t139;
				_push(1);
				L004011DC();
				_v116 = _t93;
				_v112 = _t139;
				_push(_v112);
				_push(_v116);
				_push(_v120);
				_push(_v124);
				_push(0);
				L004011DC();
				_push(_t139);
				_push(_t93);
				_t94 =  &_v32;
				_push(_t94);
				L004011D6();
				_v136 = _t94;
				while(_v136 != 0) {
					_v76 = 0x772813;
					_v84 = 3;
					_t95 =  &_v84;
					_push(_t95);
					L004011C4();
					L004011CA();
					_push(_t95);
					_push(0x402a3c);
					_push(0x402a44);
					L004011BE();
					L004011CA();
					_push(_t95);
					_push(0x402a50);
					L004011BE();
					_t139 = _t95;
					L004011CA();
					_push(_t95);
					L004011D0();
					asm("sbb eax, eax");
					_v104 =  ~( ~_t95 + 1);
					_push( &_v64);
					_push( &_v60);
					_push( &_v56);
					_push(3);
					L004011B8();
					_t146 = _t146 + 0x10;
					L004011B2();
					_t102 = _v104;
					if(_t102 != 0) {
						_push(0x402a58);
						_push(0x402a60);
						L004011BE();
						L004011CA();
						_push(_t102);
						L004011A6();
						_push(_t102);
						L004011AC();
						_t139 = _t102;
						L004011CA();
						_push(_t102);
						_push(0x402a68);
						L004011D0();
						asm("sbb eax, eax");
						_v104 =  ~( ~_t102 + 1);
						_push( &_v60);
						_t36 =  &_v56; // 0x402a68
						_push(2);
						L004011B8();
						_t146 = _t146 + 0xc;
						if(_v104 != 0) {
							if( *0x40e010 != 0) {
								_v144 = 0x40e010;
							} else {
								_push(0x40e010);
								_push(0x4021d8);
								L00401194();
								_v144 = 0x40e010;
							}
							_t116 =  &_v68;
							L0040119A();
							_v104 = _t116;
							_t120 =  *((intOrPtr*)( *_v104 + 0x50))(_v104,  &_v56, _t116,  *((intOrPtr*)( *((intOrPtr*)( *_v144)) + 0x304))( *_v144));
							asm("fclex");
							_v108 = _t120;
							if(_v108 >= 0) {
								_v148 = _v148 & 0x00000000;
							} else {
								_push(0x50);
								_push(0x402a6c);
								_push(_v104);
								_push(_v108);
								L0040118E();
								_v148 = _t120;
							}
							_v140 = _v56;
							_v56 = _v56 & 0x00000000;
							_v76 = _v140;
							_v84 = 8;
							_push(0);
							_t123 =  &_v84;
							_push(_t123); // executed
							L004011A0(); // executed
							_t139 = _t123;
							L004011CA();
							L00401188();
							L004011B2();
						}
					}
					_t105 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
					asm("fclex");
					_v104 = _t105;
					if(_v104 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x2b4);
						_push(0x402924);
						_push(_a4);
						_push(_v104);
						L0040118E();
						_v152 = _t105;
					}
					_push(_v112);
					_push(_v116);
					_push(_v120);
					_push(_v124);
					_t106 =  &_v32;
					_push(_t106);
					L00401182();
					_v136 = _t106;
				}
				_v92 = 0x1513131a;
				_t142 =  >=  ? 0x403f12 : _t139;
				goto __edx;
			}

0x0040cf16
0x0040cf22
0x0040cf2a
0x0040cf2d
0x0040cf3a
0x0040cf42
0x0040cf4d
0x0040cf50
0x0040cf55
0x0040cf5a
0x0040cf5d
0x0040cf60
0x0040cf62
0x0040cf67
0x0040cf6a
0x0040cf6d
0x0040cf70
0x0040cf73
0x0040cf76
0x0040cf79
0x0040cf7b
0x0040cf80
0x0040cf81
0x0040cf82
0x0040cf85
0x0040cf86
0x0040cf8b
0x0040d1ad
0x0040cf96
0x0040cf9d
0x0040cfa4
0x0040cfa7
0x0040cfa8
0x0040cfb2
0x0040cfb7
0x0040cfb8
0x0040cfbd
0x0040cfc2
0x0040cfcc
0x0040cfd1
0x0040cfd2
0x0040cfd7
0x0040cfdc
0x0040cfe1
0x0040cfe6
0x0040cfe7
0x0040cfee
0x0040cff3
0x0040cffa
0x0040cffe
0x0040d002
0x0040d003
0x0040d005
0x0040d00a
0x0040d010
0x0040d015
0x0040d01b
0x0040d021
0x0040d026
0x0040d02b
0x0040d035
0x0040d03a
0x0040d03b
0x0040d040
0x0040d041
0x0040d046
0x0040d04b
0x0040d050
0x0040d051
0x0040d056
0x0040d05d
0x0040d062
0x0040d069
0x0040d06a
0x0040d06e
0x0040d070
0x0040d075
0x0040d07e
0x0040d08b
0x0040d0a8
0x0040d08d
0x0040d08d
0x0040d092
0x0040d097
0x0040d09c
0x0040d09c
0x0040d0cc
0x0040d0d0
0x0040d0d5
0x0040d0e4
0x0040d0e7
0x0040d0e9
0x0040d0f0
0x0040d10c
0x0040d0f2
0x0040d0f2
0x0040d0f4
0x0040d0f9
0x0040d0fc
0x0040d0ff
0x0040d104
0x0040d104
0x0040d116
0x0040d11c
0x0040d126
0x0040d129
0x0040d130
0x0040d132
0x0040d135
0x0040d136
0x0040d13b
0x0040d140
0x0040d148
0x0040d150
0x0040d150
0x0040d07e
0x0040d15d
0x0040d163
0x0040d165
0x0040d16c
0x0040d18b
0x0040d16e
0x0040d16e
0x0040d173
0x0040d178
0x0040d17b
0x0040d17e
0x0040d183
0x0040d183
0x0040d192
0x0040d195
0x0040d198
0x0040d19b
0x0040d19e
0x0040d1a1
0x0040d1a2
0x0040d1a7
0x0040d1a7
0x0040d1ba
0x0040d1c9
0x0040d1cc

APIs

__vbaChkstk.MSVBVM60(?,004010E6), ref: 0040CF22
__vbaCyI4.MSVBVM60(00053933,?,?,?,?,004010E6), ref: 0040CF55
__vbaCyI2.MSVBVM60(00000001,00053933,?,?,?,?,004010E6), ref: 0040CF62
__vbaCyI2.MSVBVM60(00000000,?,?,?,?,00000001,00053933,?,?,?,?,004010E6), ref: 0040CF7B
__vbaCyForInit.MSVBVM60(?,00000000,?,00000000,?,?,?,?,00000001,00053933,?,?,?,?,004010E6), ref: 0040CF86
#591.MSVBVM60(00000003), ref: 0040CFA8
__vbaStrMove.MSVBVM60(00000003), ref: 0040CFB2
__vbaStrCat.MSVBVM60(00402A44,00402A3C,00000000,00000003), ref: 0040CFC2
__vbaStrMove.MSVBVM60(00402A44,00402A3C,00000000,00000003), ref: 0040CFCC
__vbaStrCat.MSVBVM60(00402A50,00000000,00402A44,00402A3C,00000000,00000003), ref: 0040CFD7
__vbaStrMove.MSVBVM60(00402A50,00000000,00402A44,00402A3C,00000000,00000003), ref: 0040CFE1
__vbaStrCmp.MSVBVM60(00000000,00402A50,00000000,00402A44,00402A3C,00000000,00000003), ref: 0040CFE7
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000,00000000,00402A50,00000000,00402A44,00402A3C,00000000,00000003), ref: 0040D005
__vbaFreeVar.MSVBVM60(?,?,?,004010E6), ref: 0040D010
__vbaStrCat.MSVBVM60(00402A60,00402A58,?,?,?,004010E6), ref: 0040D02B
__vbaStrMove.MSVBVM60(00402A60,00402A58,?,?,?,004010E6), ref: 0040D035
__vbaI4Str.MSVBVM60(00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D03B
#537.MSVBVM60(00000000,00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D041
__vbaStrMove.MSVBVM60(00000000,00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D04B
__vbaStrCmp.MSVBVM60(00402A68,00000000,00000000,00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D056
__vbaFreeStrList.MSVBVM60(00000002,h*@,?,00402A68,00000000,00000000,00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D070
__vbaNew2.MSVBVM60(004021D8,0040E010,00000000,00402A60,00402A58,?,?,?,004010E6), ref: 0040D097
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D0D0

Strings

h*@, xrefs: 0040D06A, 0040D06D
X*@, xrefs: 0040D13D

Memory Dump Source

Source File: 00000000.00000002.1209098535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1209079942.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1209112524.000000000040E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1209132729.0000000000410000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$Free$List$#537#591ChkstkInitNew2
String ID: X*@$h*@
API String ID: 1504116222-61942270
Opcode ID: 5e424d72709711fa4cd1d2193e38d68189f75f2070a045f03ee7ac46049dc535
Instruction ID: 8117daf23d3d559ceb68c8f5d45a3960381afd190fab3a7ae7f19c1ff232b70c
Opcode Fuzzy Hash: 5e424d72709711fa4cd1d2193e38d68189f75f2070a045f03ee7ac46049dc535
Instruction Fuzzy Hash: B3811671E00208AFDB15EFE1CD46B9EBBB9BF08304F10457AB605BB2A1DB785A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00401200, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 655
COMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(signed int __eax, signed int __ebx, signed int __ecx, intOrPtr* __edx, void* __edi, signed int __esi) {
				intOrPtr* _t40;
				signed int _t42;
				signed char _t43;
				signed char _t46;
				signed char _t47;
				signed char _t48;
				signed int _t51;
				intOrPtr* _t53;
				void* _t54;
				signed int _t57;
				void* _t59;
				void* _t60;
				intOrPtr _t62;
				intOrPtr _t71;

				_t57 = __esi;
				_t54 = __edi;
				_t52 = __edx;
				_t51 = __ecx;
				_t49 = __ebx;
				_push("VB5!6&*"); // executed
				L004011FA(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t40 = __eax + 1;
				 *_t40 =  *_t40 + _t40;
				 *_t40 =  *_t40 + _t40;
				 *_t40 =  *_t40 + _t40;
				 *((intOrPtr*)(__esi + 0x19536d6e)) =  *((intOrPtr*)(__esi + 0x19536d6e)) + _t40;
				 *__ebx =  *__ebx - __ecx;
				_t60 = _t59 + 1;
				asm("outsb");
				_t42 = __ecx + 0x0000005b | 0x009cdf0e;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				 *__ecx =  *__ecx + _t42;
				 *_t42 =  *_t42 + _t42;
				_t4 = __edx + 0x6f;
				 *_t4 =  *((intOrPtr*)(__edx + 0x6f)) + _t42;
				_t62 =  *_t4;
				if(_t62 < 0) {
					L7:
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *((intOrPtr*)(_t42 + 0x3b00000b)) =  *((intOrPtr*)(_t42 + 0x3b00000b)) + _t52;
					goto L8;
				} else {
					if(_t62 < 0) {
						L6:
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						goto L7;
					} else {
						if(_t62 < 0) {
							L8:
							_t43 = _t42 |  *_t42;
							goto L9;
						} else {
							_push(0x65);
							asm("arpl [ecx+esi], si");
							_t43 = _t42 | 0x7061430a;
							if(_t43 != 0) {
								 *_t43 =  *_t43 + _t43;
								 *_t43 =  *_t43 + _t43;
								_t60 = _t60 - 1;
								 *_t43 =  *_t43 ^ _t43;
								_t52 = __edx + __edi;
								asm("arpl bp, di");
								_pop(ss);
								asm("stosd");
								asm("cmc");
								_t8 = _t60 + 0x1aff549e + __ecx * 2;
								 *_t8 =  *(_t60 + 0x1aff549e + __ecx * 2) >> __ecx;
								asm("aas");
								if( *_t8 == 0) {
									_push(__esi);
									_t14 = __esi - 0xb7e5a50;
									_t15 = _t52;
									_t52 =  *_t14;
									 *_t14 = _t15;
									asm("stosd");
									_t60 = _t60;
									_t48 = _t43;
									asm("stosb");
									 *((intOrPtr*)(_t48 - 0x2d)) =  *((intOrPtr*)(_t48 - 0x2d)) + _t48;
									_t42 = __ebx ^  *(__ecx - 0x48ee309a);
									_t49 = _t48;
									 *_t42 =  *_t42 + _t42;
									 *_t42 =  *_t42 + _t42;
									 *_t42 =  *_t42 + _t42;
									 *_t42 =  *_t42 + _t42;
									goto L6;
								}
								L9:
								 *_t43 =  *_t43 + _t43;
								 *_t52 =  *_t52 + _t51;
								_t23 = _t57 + 0x61;
								 *_t23 =  *((intOrPtr*)(_t57 + 0x61)) + _t43;
								_t71 =  *_t23;
							}
						}
					}
				}
				asm("popad");
				asm("a16 insd");
				if(_t71 < 0) {
					if(_t71 >= 0) {
						 *0x53000801 =  *0x53000801 + _t51;
						_t51 = _t51 - 1;
						_t54 = _t54 - 1 + 1 - 1;
						_push(_t60);
						_t46 = _t43 - 1;
						 *_t51 =  *_t51 + _t49;
						 *_t46 =  *_t46 + _t46;
						_t53 = _t52 + 1;
						 *_t53 =  *_t53 + _t46;
						 *_t49 =  *_t49 + _t60;
						asm("out dx, al");
						_t47 = _t46 |  *_t46;
						 *((intOrPtr*)(_t60 + _t57 * 2)) =  *((intOrPtr*)(_t60 + _t57 * 2)) + _t51;
						_t52 = _t53 + _t47;
						_t43 = _t47 |  *_t47;
						 *_t43 =  *_t43 + _t43;
						 *_t51 =  *_t51 + _t43;
						 *_t51 =  *_t51 + _t43;
						 *_t43 =  *_t43 + _t52;
						asm("adc [eax], al");
						 *_t51 =  *_t51 + _t43;
						 *_t43 =  *_t43 + _t51;
						 *((intOrPtr*)(_t43 + 5)) =  *((intOrPtr*)(_t43 + 5)) + _t51;
						 *_t43 =  *_t43 + _t43;
					}
					 *_t57 =  *_t57 + _t52;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t51;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t52;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t51 =  *_t51 + _t43;
					 *_t43 =  *_t43 + _t51;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					 *((intOrPtr*)(_t54 - 0x5eff6061)) =  *((intOrPtr*)(_t54 - 0x5eff6061)) + _t49;
					asm("movsd");
					 *((intOrPtr*)(_t52 - 0x4dff5556)) =  *((intOrPtr*)(_t52 - 0x4dff5556)) + _t51;
				}
				asm("stosb");
				asm("stosb");
				asm("stosb");
				 *((intOrPtr*)(_t52 - 0x4bff4d4e)) =  *((intOrPtr*)(_t52 - 0x4bff4d4e)) + _t52;
				 *((intOrPtr*)(_t57 - 0x3cff4142)) =  *((intOrPtr*)(_t57 - 0x3cff4142)) + _t49;
				return 0xb4;
			}

0x00401200
0x00401200
0x00401200
0x00401200
0x00401200
0x00401200
0x00401205
0x0040120a
0x0040120c
0x0040120e
0x00401210
0x00401212
0x00401214
0x00401215
0x00401217
0x00401219
0x0040121b
0x00401221
0x00401223
0x00401227
0x00401228
0x0040122d
0x0040122f
0x00401231
0x00401233
0x00401235
0x00401235
0x00401235
0x00401238
0x0040129e
0x0040129e
0x004012a0
0x004012a2
0x004012a4
0x004012a6
0x004012a8
0x00000000
0x0040123a
0x0040123a
0x0040128d
0x0040128d
0x0040128f
0x00401291
0x00401293
0x00401295
0x00401297
0x00401299
0x0040129b
0x0040129d
0x00000000
0x0040123d
0x0040123d
0x004012ae
0x004012ae
0x00000000
0x0040123f
0x0040123f
0x00401241
0x00401245
0x0040124a
0x0040124c
0x0040124e
0x00401250
0x00401252
0x00401254
0x00401256
0x0040125e
0x0040125f
0x00401260
0x00401261
0x00401261
0x00401268
0x00401269
0x0040126b
0x0040126d
0x0040126d
0x0040126d
0x0040126d
0x00401273
0x00401274
0x0040127e
0x00401280
0x00401281
0x00401284
0x00401284
0x00401285
0x00401287
0x00401289
0x0040128b
0x00000000
0x0040128b
0x004012af
0x004012af
0x004012b1
0x004012b3
0x004012b3
0x004012b3
0x004012b3
0x0040124a
0x0040123d
0x0040123a
0x004012b5
0x004012b6
0x004012b8
0x004012bb
0x004012be
0x004012c5
0x004012c8
0x004012c9
0x004012ca
0x004012cb
0x004012cd
0x004012cf
0x004012d0
0x004012d2
0x004012d4
0x004012d5
0x004012d7
0x004012db
0x004012dd
0x004012df
0x004012e1
0x004012e3
0x004012e5
0x004012e7
0x004012e9
0x004012eb
0x004012ed
0x004012f0
0x004012f0
0x004012f1
0x004012f3
0x004012f5
0x004012f7
0x004012f9
0x004012fb
0x004012fd
0x004012ff
0x00401301
0x00401303
0x00401305
0x00401307
0x00401309
0x0040130b
0x0040130d
0x0040130f
0x00401311
0x00401313
0x00401315
0x00401317
0x00401319
0x0040131b
0x0040131d
0x0040131f
0x00401321
0x0040132c
0x0040132d
0x0040132d
0x0040132e
0x0040132f
0x00401330
0x00401331
0x00401339
0x0040133f

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401205

Strings

VB5!6&*, xrefs: 00401200

Memory Dump Source

Source File: 00000000.00000002.1209098535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1209079942.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1209112524.000000000040E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1209132729.0000000000410000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 6c8c8d6a9811e8e14af2a29099aff2c1637c021541a524c6143b6f62bea6809c
Instruction ID: fe341c1bbb260770b72c08a418ab389b58c56b6a62df00da5caab72e0c272103
Opcode Fuzzy Hash: 6c8c8d6a9811e8e14af2a29099aff2c1637c021541a524c6143b6f62bea6809c
Instruction Fuzzy Hash: F851FA2244E3C04FD3139774886A685BFB1AD5721478E49EBC4C1DF4B3D16D884ACB63

Uniqueness

Uniqueness Score: -1.00%

Function 004041AF, Relevance: 1.4, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000), ref: 004041BE

Memory Dump Source

Source File: 00000000.00000002.1209098535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1209079942.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1209112524.000000000040E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1209132729.0000000000410000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 198be8bf140dabb4814965d85621eb8b4b8d4e6a2939b484c0cf9b56986281c3
Instruction ID: 983ec508a039aca506fc82c5c91a0477e07c7e6bba8510f9503dd3df2ca051c8
Opcode Fuzzy Hash: 198be8bf140dabb4814965d85621eb8b4b8d4e6a2939b484c0cf9b56986281c3
Instruction Fuzzy Hash: 312111A660B6A07BC7024AF484941D17FE1DE83F4031448FFE70557353E92A4286C349

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004F3219, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

TEMP=, xrefs: 004F462C

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID: TEMP=
API String ID: 0-1038760399
Opcode ID: a416b70d977549ff7f1bf4c86422b1f455e10aec064bd7a0b0e7b0534adf3599
Instruction ID: 8b1beef563deae5aa9fd8635b139d12980db8e4fbe74f25b1881ae235c7ff991
Opcode Fuzzy Hash: a416b70d977549ff7f1bf4c86422b1f455e10aec064bd7a0b0e7b0534adf3599
Instruction Fuzzy Hash: BA21A31250C7CE0FDB129A344E6A5A67F90AE9331071D81EBCAC18F7A7EB1C9801934A

Uniqueness

Uniqueness Score: -1.00%

Function 004F6AA8, Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc85da28a65d18907f5dc8ab7e715d9a4e242118ccf5728b0f4967e032d59337
Instruction ID: e61b8cac1ec196c5dbb4a57d3e59ee3598231bc2ffcbbac28daf75619bbd3caa
Opcode Fuzzy Hash: cc85da28a65d18907f5dc8ab7e715d9a4e242118ccf5728b0f4967e032d59337
Instruction Fuzzy Hash: 68C14970A043469EDF209E38C5D47BA76919F62360F55825FDED18B2DAD7388483C71A

Uniqueness

Uniqueness Score: -1.00%

Function 004F20C5, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e74fbd706e86727560a1ad84561726551e9d3de7ba499809ef2750c4ead60f
Instruction ID: 43c4d64968bb797f487ab799ba723be0833d4e7ede09b8397870927380066997
Opcode Fuzzy Hash: 81e74fbd706e86727560a1ad84561726551e9d3de7ba499809ef2750c4ead60f
Instruction Fuzzy Hash: 90616771700616EFCB149F28CE94BE6B3A0BF05310F19022AEDA597281D769AC96CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004F6AF5, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2f567dc07e2ad75cbea45c2f6e3b6473af0020bdca0d6df751e2f71c1368f8
Instruction ID: 01996cd97757f26933617a11932fbb6ad2bf1d455f07a548248cc59b9ff77646
Opcode Fuzzy Hash: dd2f567dc07e2ad75cbea45c2f6e3b6473af0020bdca0d6df751e2f71c1368f8
Instruction Fuzzy Hash: 07612B25A043478EDB218E38C9957A277D1DF62360F9A826ACED58F3D7D3298842C716

Uniqueness

Uniqueness Score: -1.00%

Function 004F22F6, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada696c636deaea62ef077945ff35e18e8cdd7bc22b538c2feea4609a34b2177
Instruction ID: 46d9f20aa22853d9dd72795eee55c0aaded9910db1e47b9ef03bfe26a8b0b232
Opcode Fuzzy Hash: ada696c636deaea62ef077945ff35e18e8cdd7bc22b538c2feea4609a34b2177
Instruction Fuzzy Hash: A0415A7270461B9BCB149A3C8D267E573D1FF09320F994236EC989B382DB25EC4A87C5

Uniqueness

Uniqueness Score: -1.00%

Function 004F255A, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe2dc1f4f59cec9936f87f4b8db0ad75ce08384328d7c65b983f2498206fcb5
Instruction ID: fa4fff9b9efff0c5225571a800cf274105ef93645de1620f277247496482e1ba
Opcode Fuzzy Hash: ffe2dc1f4f59cec9936f87f4b8db0ad75ce08384328d7c65b983f2498206fcb5
Instruction Fuzzy Hash: A7414670204309AFEB215F248D99BF933A2BF05754F64811AFE058B1D2C7A8C984CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004F25A8, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156b76b4bb2f43e4efb5dd5a2bf91161118f0fb4b2e603906d6fc46f17f10fb5
Instruction ID: b9e6f3ed99830b04cea19cd08a6fc014f2c3220dc8d58d205a63a1ba578c050c
Opcode Fuzzy Hash: 156b76b4bb2f43e4efb5dd5a2bf91161118f0fb4b2e603906d6fc46f17f10fb5
Instruction Fuzzy Hash: 2B21E570644309AFFB355F208D95BEA3792AF45714FA4815EEE058B1D2C7A9D888CA06

Uniqueness

Uniqueness Score: -1.00%

Function 004F1A4D, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a324657a146bd70220ecd965abc3a84314545363c8bbb668cd357617b7e3f85f
Instruction ID: d370d498f62813b3b949b03fac66e72528319c345baf28bd45be7e2f71c64b73
Opcode Fuzzy Hash: a324657a146bd70220ecd965abc3a84314545363c8bbb668cd357617b7e3f85f
Instruction Fuzzy Hash: 0AF0287610030ABADF3215058E12BF621265F82364F70001DBE8A2619293EE5C42611A

Uniqueness

Uniqueness Score: -1.00%

Function 004F6008, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb7c7c7e165bc70dc1783a4346ba702717a486eeec94ba321ded66ca60bb1e6
Instruction ID: 8d2e8f59ba930605fb57716a557f01585c3ee3dd4a6530ef049098e20849c2ed
Opcode Fuzzy Hash: 4bb7c7c7e165bc70dc1783a4346ba702717a486eeec94ba321ded66ca60bb1e6
Instruction Fuzzy Hash: 5501A2313122048FD714DA18C6D4F6B73A5AFE9755F21846AEA42CB361DA38DC41CB19

Uniqueness

Uniqueness Score: -1.00%

Function 004F337D, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0134ba410bb320bac1184f738bf2e2c1fd36b199ec316b995bccae40a6c574ef
Instruction ID: a7c5a67b850c41d2bef533776c28d8ffd6ba29ec62e5df9d00f0eb07243c8b86
Opcode Fuzzy Hash: 0134ba410bb320bac1184f738bf2e2c1fd36b199ec316b995bccae40a6c574ef
Instruction Fuzzy Hash: 91C048BB7925848FEB21CA28C4C1B8077A2AF22A48B8804A0E002CB696D324ED45CA04

Uniqueness

Uniqueness Score: -1.00%

Function 004F5A1D, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1209889757.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b6863cc23693e0d8a110fb9812b0a854d4ff2cb09985eb4a2135f0fc236b47
Instruction ID: 90c93bcf842074def0323cd1db6baba0c1496098558b228b413ee36ce3efb7bf
Opcode Fuzzy Hash: f4b6863cc23693e0d8a110fb9812b0a854d4ff2cb09985eb4a2135f0fc236b47
Instruction Fuzzy Hash: BAB002757556418FCA55DE19D290F4073B4FB54BA0B455494A455C7A51C264E900C910

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Shipping Documents.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Shipping Documents.exe PID: 6460 Parent PID: 5668

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Shipping Documents.exe PID: 6460 Parent PID: 5668 Shipping Documents.exeCOMMON

Executed Functions

Function 0040CF04, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 204COMMON

Function 00401200, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 655COMMON

Function 0040CF04, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 204
COMMON

Function 00401200, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 655
COMMON