Play interactive tour

Edit tour

Analysis Report IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Overview

General Information

Sample Name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Analysis ID:	341752
MD5:	5525bb8a978d3ac15812c8d8ca9b8a57
SHA1:	dcb9549ff9c290e056f83639ad546b03206a0806
SHA256:	21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9
Tags:	COVID19exeGuLoaderIRS
Most interesting Screenshot:

Detection

GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Generic Dropper

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

IRS_Covid-19_Relief_Payment_Notice_pdf.exe (PID: 6124 cmdline: 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe' MD5: 5525BB8A978D3AC15812C8D8CA9B8A57)

IRS_Covid-19_Relief_Payment_Notice_pdf.exe (PID: 5348 cmdline: 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe' MD5: 5525BB8A978D3AC15812C8D8CA9B8A57)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Compliance:

Uses 32bit PE files

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.3:49725 version: TLS 1.2

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wntdll.pdbUGP source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.612139646.000000001E59F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Networking:

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: chengsolution.com

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

String found in binary or memory: https://chengsolution.com/vr/tembin_AbNFdk131.bin

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.3:49725 version: TLS 1.2

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: initial sample	Static PE information: Filename: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E8B05 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E907C LoadLibraryA,NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E08BF EnumWindows,NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E4EE3 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E0A0D NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9202 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9215 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3A2E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E923E NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E0A4D NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9271 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3A88 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E2294 NtSetInformationThread,NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E92AA NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3AF6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E932C NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E7B5F NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9369 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3B61 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9396 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3BB6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E93D4 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E53E5 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3819 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3868 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9082 NtWriteVirtualMemory,NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E90D4 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E38E0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9128 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3929 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E094D NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E0943 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3980 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E09BE NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E91D6 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E39D1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9608 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3E07 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E963E NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3E34 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3E4E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E96A5 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E96D4 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E36ED NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9711 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3745 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E37BD NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E945D NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3C56 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3CE4 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E94FA NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9531 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E9571 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3D8E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3DD9 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E95E5 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E96E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9650 NtQueryValueKey,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9A50 NtCreateFile,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9670 NtQueryInformationProcess,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9A00 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9A10 NtQuerySection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9A20 NtResumeThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E96D0 NtCreateKey,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9760 NtOpenProcess,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9770 NtSetInformationFile,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4EA770 NtOpenThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9B00 NtSetValueKey,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4EA710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9710 NtQueryInformationToken,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9FE0 NtCreateMutant,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9780 NtMapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E97A0 NtUnmapViewOfSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4EA3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9840 NtDelayExecution,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4EB040 NtSuspendThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9820 NtEnumerateKey,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E98F0 NtReadVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E98A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9540 NtReadFile,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9950 NtQueueApcThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9560 NtWriteFile,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9910 NtAdjustPrivilegesToken,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E9520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4EAD30 NtSetContextThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E99D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E95D0 NtClose,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E95F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E99A0 NtCreateSection,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056907C LoadLibraryA,NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00568B05 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056945D NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005690D4 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005694FA NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569082 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569571 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569531 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569128 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005691D6 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005695E5 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569271 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569215 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569202 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569608 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056923E NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056963E NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005696D4 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005696A5 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005692AA NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569369 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569711 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056932C NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005693D4 NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00569396 NtSetInformationThread,

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0040187B
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0040422B
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C6E30
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DEBB0
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561002
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B841F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BB090
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E571D55
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AF900
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A0D20
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000000.00000002.268828421.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000000.00000002.269061784.00000000020B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.611516666.000000001DFF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000000.267938949.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.612139646.000000001E59F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.611449120.000000001DEA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4F27D81AB326C3CA.TMP

Jump to behavior

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'

Source:	Binary string: wntdll.pdbUGP source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.612139646.000000001E59F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124, type: MEMORY

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E5B5E push edi; retf
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4FD0D1 push ecx; ret

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E4EE3 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E2294 NtSetInformationThread,NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E838A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E36DF
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056907C LoadLibraryA,NtSetInformationThread,
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056838A

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000020E7D79 second address: 00000000020E7D79 instructions:
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000005617E4 second address: 0000000000567569 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+000000B4h] 0x00000010 cmp ax, bx 0x00000013 jmp 00007FCBD4A32CA6h 0x00000015 test ecx, 108D7A16h 0x0000001b test dh, bh 0x0000001d push dword ptr [ebp+64h] 0x00000020 test ah, FFFFFFE3h 0x00000023 push 00000367h 0x00000028 push ecx 0x00000029 mov ecx, 22739622h 0x0000002e cmp ecx, 22739622h 0x00000034 jne 00007FCBD4A31D71h 0x0000003a pop ecx 0x0000003b push 00000031h 0x0000003d cmp dl, bl 0x0000003f push dword ptr [ebp+000000B4h] 0x00000045 call 00007FCBD4A38978h 0x0000004a cmp ebx, ecx 0x0000004c cmp dl, FFFFFFF3h 0x0000004f mov edx, dword ptr [esp+04h] 0x00000053 test ebx, edx 0x00000055 mov ecx, dword ptr [esp+08h] 0x00000059 test al, 1Eh 0x0000005b add edx, ecx 0x0000005d neg ecx 0x0000005f mov ebx, dword ptr [esp+0Ch] 0x00000063 cmp edx, F9C1C0D7h 0x00000069 mov eax, dword ptr [esp+10h] 0x0000006d pushad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000000567569 second address: 0000000000567569 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000020E7D79 second address: 00000000020E7D79 instructions:
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000020E870B second address: 00000000020E870B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp dword ptr [ebx], 9090C350h 0x00000013 jne 00007FCBD4A32CC3h 0x00000015 cmp edx, dword ptr [ebx] 0x00000017 jne 00007FCBD4A32C98h 0x00000019 cmp byte ptr [ebx], FFFFFFE8h 0x0000001c jne 00007FCBD4A32D3Ah 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007FCBD4A32CCEh 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007FCBD4A32AF8h 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 000000000056870B second address: 000000000056870B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp dword ptr [ebx], 9090C350h 0x00000013 jne 00007FCBD4A3A5F3h 0x00000015 cmp edx, dword ptr [ebx] 0x00000017 jne 00007FCBD4A3A5C8h 0x00000019 cmp byte ptr [ebx], FFFFFFE8h 0x0000001c jne 00007FCBD4A3A66Ah 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007FCBD4A3A5FEh 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007FCBD4A3A428h 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000005617E4 second address: 0000000000567569 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+000000B4h] 0x00000010 cmp ax, bx 0x00000013 jmp 00007FCBD4A32CA6h 0x00000015 test ecx, 108D7A16h 0x0000001b test dh, bh 0x0000001d push dword ptr [ebp+64h] 0x00000020 test ah, FFFFFFE3h 0x00000023 push 00000367h 0x00000028 push ecx 0x00000029 mov ecx, 22739622h 0x0000002e cmp ecx, 22739622h 0x00000034 jne 00007FCBD4A31D71h 0x0000003a pop ecx 0x0000003b push 00000031h 0x0000003d cmp dl, bl 0x0000003f push dword ptr [ebp+000000B4h] 0x00000045 call 00007FCBD4A38978h 0x0000004a cmp ebx, ecx 0x0000004c cmp dl, FFFFFFF3h 0x0000004f mov edx, dword ptr [esp+04h] 0x00000053 test ebx, edx 0x00000055 mov ecx, dword ptr [esp+08h] 0x00000059 test al, 1Eh 0x0000005b add edx, ecx 0x0000005d neg ecx 0x0000005f mov ebx, dword ptr [esp+0Ch] 0x00000063 cmp edx, F9C1C0D7h 0x00000069 mov eax, dword ptr [esp+10h] 0x0000006d pushad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000000567569 second address: 0000000000567569 instructions:
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_020E0BA5 rdtsc

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Window / User API: threadDelayed 9577

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Process information queried: ProcessInformation

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_020E08BF NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_020E0BA5 rdtsc

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_020E4A2D LdrInitializeThunk,

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E2294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E838A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E83B9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3017 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3020 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E3096 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E30AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E6924 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E41E9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E7632 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E8402 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E841F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E845E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_020E2D1A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E55B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E55B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C3A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E55FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D36CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E8EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E55FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D16E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E570EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E570EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E570EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E5246A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DFAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4ADB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BEF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AF358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4ADB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BFF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E56131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E57070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E57070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DE730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E55D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E56138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E575BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E571074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E562073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E574015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E574015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E527016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E561C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E57740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E57740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E57740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4BB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DBC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E53B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E526CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E5614FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E523884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E523884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E90AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DF0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4E3D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E523540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C7D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E578D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4C4120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4B3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E558DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4AB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4A2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DA185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4CC182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4DFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_1E4D35A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056845E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056841F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00568402 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00566924 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005641D5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_00567632 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_0056838A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 4_2_005683B9 mov eax, dword ptr fs:[00000030h]

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.606260056.0000000001030000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.606260056.0000000001030000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.606260056.0000000001030000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000004.00000002.606260056.0000000001030000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

Yara detected Generic Dropper

Show sources

Source: Yara match

File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Security Software Discovery721	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery31	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://chengsolution.com/vr/tembin_AbNFdk131.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chengsolution.com	162.0.209.179	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chengsolution.com/vr/tembin_AbNFdk131.bin	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.0.209.179	unknown	Canada		35893	ACPCA	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	341752
Start date:	19.01.2021
Start time:	19:04:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 27.1% (good quality ratio 21.4%) Quality average: 62.4% Quality standard deviation: 37.7%
HCA Information:	Successful, ratio: 60% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.139.144, 104.43.193.48, 52.255.188.83, 2.18.68.82, 51.11.168.160, 2.20.142.210, 2.20.142.209, 92.122.213.194, 92.122.213.247, 20.54.26.129, 52.254.96.93, 52.251.11.100 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, bn2eap.displaycatalog.md.mp.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/341752/sample/IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACPCA	LRGjZ3F0AO.exe	Get hash	malicious	Browse	162.0.219.122
	Busan Korea.exe	Get hash	malicious	Browse	162.0.213.60
	mssecsvc.exe	Get hash	malicious	Browse	162.36.93.137
	SCAN_20210115140930669.exe	Get hash	malicious	Browse	162.0.213.203
	Order (2021.01.06).exe	Get hash	malicious	Browse	162.0.213.203
	https://vodafone-bill-failed.com	Get hash	malicious	Browse	162.0.215.120
	UF14VE7MF3.htm	Get hash	malicious	Browse	162.0.209.142
	https://verify-requests.com/HSBC/	Get hash	malicious	Browse	162.0.209.141
	46M2B7IIGN.htm	Get hash	malicious	Browse	162.0.209.142
	http://recp.mkt91.net/ctt?m=804040&r=Njg0NjYxMDU1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https://ahlhealth.com/Wednesday5029kl%23mark.tryniski@cbna.com	Get hash	malicious	Browse	162.0.209.130
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fin0038847990.sn.am%2flfCk7ZE6GWq&c=E,1,XbwqZlmKwFAf_trFhDdV9wkuU6vutPEIQqN4IhE8jUbxLD3wnPPXDvKp8Jibjk9HngPAI5iRQWnG4vU_DQMKfMGkzgCqkZ-4BfRprMNSl9Nr7VoPQEtWNft5&typo=1	Get hash	malicious	Browse	162.0.209.25
	https://joom.ag/qJFC	Get hash	malicious	Browse	162.0.209.115
	https://faxdocuments.sn.am/la0TEIilIWq	Get hash	malicious	Browse	162.0.209.144
	https://securedoc.sn.am/lZnSrsZICGq	Get hash	malicious	Browse	162.0.209.144
	https://faxdocument.sn.am/lZgQs0mCCuq	Get hash	malicious	Browse	162.0.209.115
	https://rmnboxvoices.website/	Get hash	malicious	Browse	162.0.209.142
	https://bodyfexeen.ga/000/index.php	Get hash	malicious	Browse	162.0.209.25
	vnaSKDMnLG.dll	Get hash	malicious	Browse	162.0.213.230
	Yarranton.co.uk.htm	Get hash	malicious	Browse	162.0.209.27
	MIT-MULTA5600415258.msi	Get hash	malicious	Browse	162.0.209.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Qt_1186.xls	Get hash	malicious	Browse	162.0.209.179
	INV-4215.xls	Get hash	malicious	Browse	162.0.209.179
	wp-cryn.dll	Get hash	malicious	Browse	162.0.209.179
	P8ob8zaRpi.exe	Get hash	malicious	Browse	162.0.209.179
	Jcantele.HTM	Get hash	malicious	Browse	162.0.209.179
	Payment Confirmation Paper - Customer Copy_pdf.exe	Get hash	malicious	Browse	162.0.209.179
	1_cr.exe	Get hash	malicious	Browse	162.0.209.179
	Symptomaticshon5.exe	Get hash	malicious	Browse	162.0.209.179
	1_cr.exe	Get hash	malicious	Browse	162.0.209.179
	PO-00172020.html	Get hash	malicious	Browse	162.0.209.179
	atikmdag-patcher 1.4.7.exe	Get hash	malicious	Browse	162.0.209.179
	Dboom.HTM	Get hash	malicious	Browse	162.0.209.179
	vS8yVO8py0.exe	Get hash	malicious	Browse	162.0.209.179
	DOCUMENT FILE.exe	Get hash	malicious	Browse	162.0.209.179
	6VEoBuy32f.xls	Get hash	malicious	Browse	162.0.209.179
	Uh7eQhnS1m.doc	Get hash	malicious	Browse	162.0.209.179
	6fAjRmbM4P.exe	Get hash	malicious	Browse	162.0.209.179
	5IpRu2zSfu.dll	Get hash	malicious	Browse	162.0.209.179
	zuwmbstItB.dll	Get hash	malicious	Browse	162.0.209.179
	HPScanner_1889752021_Signed_jpg.exe	Get hash	malicious	Browse	162.0.209.179

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.442072374572181
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
File size:	86016
MD5:	5525bb8a978d3ac15812c8d8ca9b8a57
SHA1:	dcb9549ff9c290e056f83639ad546b03206a0806
SHA256:	21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9
SHA512:	0e5504ee2fc22ce87c1cac663e0c4cd76227025da20c2903d63ddafc0fc8a270d56a90b89c31d8ee448a61f881ace27037beb623f4409b9d1020a6b2a0a9f35b
SSDEEP:	768:bwSsRk+UMfhoeoCm0TI4Y4az55+mGMZkNS8+EMaybN1hBuKYR6mTLktPV9lIBtyd:JzTMoCnbO5+mG4ietbzhBuKYT3yVQm
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...5..`................. ...0...............0....@................

File Icon


Icon Hash:	c0c4c26270faec04

Static PE Info

General
Entrypoint:	0x401498
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x6006B035 [Tue Jan 19 10:11:01 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98834e8b1c22ed6d1484c39b625780c4

Entrypoint Preview

Instruction
push 00401AD0h
call 00007FCBD493E363h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
inc ecx
hlt
or cl, 00000019h
fimul word ptr [ecx-53h]
out dx, eax
adc dword ptr [edi-2Fh], 0Dh
mov al, byte ptr [000000DBh]
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+61h], ch
outsb
insb
imul ebp, dword ptr [esi+67h], 6E616C70h
jc 00007FCBD493E3E1h
add byte ptr [eax], ch
js 00007FCBD493E3AAh
sub dword ptr [edx+00h], ebx
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
or dword ptr [edx+3ADED508h], esp
or ecx, dword ptr [edx-6Ch]
pop ds
pop ds
xchg eax, ecx
les ebp, fword ptr [esi]
retf
xor al, 10h
inc esi
cmp dword ptr [ebx+69h], edi
mov eax, dword ptr [AD989B4Ch]
cmp cl, byte ptr [ecx]
test eax, 4F3AF830h
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
fiadd word ptr [eax+eax]
add byte ptr [eax+03h], dl
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [esi+69h], al
arpl word ptr [ebp+73h], si
jnc 00007FCBD493E373h
or eax, 00000801h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x129b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x614	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x128	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11ebc	0x12000	False	0.396335177951	data	5.91456759437	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x11c0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x614	0x1000	False	0.159423828125	data	1.53535569768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1532c	0x2e8	data
RT_GROUP_ICON	0x15318	0x14	data
RT_VERSION	0x150f0	0x228	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaLateMemSt, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaVarCopy, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	auricular
FileVersion	2.00
CompanyName	ViralCherry
ProductName	ViralCherry
ProductVersion	2.00
OriginalFilename	auricular.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2021 19:05:35.671945095 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:35.867238998 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:35.867331982 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:35.897017956 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.090732098 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.090768099 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.090789080 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.090804100 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.090816975 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.090857029 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.090892076 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.096060991 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.096149921 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.224873066 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.421293020 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.421397924 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.454593897 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653346062 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653410912 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653438091 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653461933 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653487921 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653507948 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653512001 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653536081 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653548002 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653572083 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653573990 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653599024 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.653600931 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653635979 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653666973 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.653703928 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.654711962 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.846869946 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.846916914 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.846936941 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.846961975 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.846986055 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847009897 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847035885 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847062111 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847079039 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.847088099 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847115993 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847141981 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847167015 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.847166061 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.847188950 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.847193956 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.847224951 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:36.848038912 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.848081112 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:36.848133087 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040530920 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040569067 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040591002 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040607929 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040622950 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040638924 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040637970 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040656090 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040667057 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040672064 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040673971 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040693045 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040707111 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040712118 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040729046 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040730953 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040749073 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040759087 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040766001 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040782928 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040787935 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040801048 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040817022 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040819883 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040833950 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040838957 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040868044 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.040965080 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.040982962 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.041003942 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.041033983 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234117031 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234184027 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234226942 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234272003 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234301090 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234313011 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234343052 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234357119 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234380007 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234401941 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234400988 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234445095 CET	49725	443	192.168.2.3	162.0.209.179
Jan 19, 2021 19:05:37.234452963 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234503984 CET	443	49725	162.0.209.179	192.168.2.3
Jan 19, 2021 19:05:37.234546900 CET	443	49725	162.0.209.179	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2021 19:04:57.162681103 CET	58361	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:04:57.221368074 CET	53	58361	8.8.8.8	192.168.2.3
Jan 19, 2021 19:04:58.217526913 CET	63492	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:04:58.268284082 CET	53	63492	8.8.8.8	192.168.2.3
Jan 19, 2021 19:04:59.531814098 CET	60831	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:04:59.582775116 CET	53	60831	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:00.658184052 CET	60100	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:00.709003925 CET	53	60100	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:05.854151011 CET	53195	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:05.902390957 CET	53	53195	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:06.835242987 CET	50141	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:06.886193991 CET	53	50141	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:07.624830008 CET	53023	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:07.672684908 CET	53	53023	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:08.424705982 CET	49563	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:08.472641945 CET	53	49563	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:09.410857916 CET	51352	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:09.467432022 CET	53	51352	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:10.623665094 CET	59349	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:10.671462059 CET	53	59349	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:11.406970978 CET	57084	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:11.455020905 CET	53	57084	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:12.216387033 CET	58823	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:12.264552116 CET	53	58823	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:26.185189962 CET	57568	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:26.243479013 CET	53	57568	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:35.571042061 CET	50540	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:35.634639025 CET	53	50540	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:41.281246901 CET	54366	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:41.329204082 CET	53	54366	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:46.049727917 CET	53034	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:46.112493992 CET	53	53034	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:47.226560116 CET	57762	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:47.282752991 CET	53	57762	8.8.8.8	192.168.2.3
Jan 19, 2021 19:05:47.602919102 CET	55435	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:05:47.661106110 CET	53	55435	8.8.8.8	192.168.2.3
Jan 19, 2021 19:06:02.330107927 CET	50713	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:06:02.389588118 CET	53	50713	8.8.8.8	192.168.2.3
Jan 19, 2021 19:06:15.829989910 CET	56132	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:06:15.880850077 CET	53	56132	8.8.8.8	192.168.2.3
Jan 19, 2021 19:06:19.428741932 CET	58987	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:06:19.486742020 CET	53	58987	8.8.8.8	192.168.2.3
Jan 19, 2021 19:06:51.298798084 CET	56579	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:06:51.346765995 CET	53	56579	8.8.8.8	192.168.2.3
Jan 19, 2021 19:06:53.023474932 CET	60633	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:06:53.079869986 CET	53	60633	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:45.461467981 CET	61292	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:45.517836094 CET	53	61292	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:46.513546944 CET	63619	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:46.575645924 CET	53	63619	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:47.870642900 CET	64938	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:47.929498911 CET	53	64938	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:49.383142948 CET	61946	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:49.447613001 CET	53	61946	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:50.286160946 CET	64910	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:50.342813969 CET	53	64910	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:51.322047949 CET	52123	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:51.383259058 CET	53	52123	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:53.507177114 CET	56130	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:53.566209078 CET	53	56130	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:56.467189074 CET	56338	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:56.523395061 CET	53	56338	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:58.288005114 CET	59420	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:58.349138975 CET	53	59420	8.8.8.8	192.168.2.3
Jan 19, 2021 19:07:59.514334917 CET	58784	53	192.168.2.3	8.8.8.8
Jan 19, 2021 19:07:59.562504053 CET	53	58784	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 19, 2021 19:05:35.571042061 CET	192.168.2.3	8.8.8.8	0xc302	Standard query (0)	chengsolution.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 19, 2021 19:05:35.634639025 CET	8.8.8.8	192.168.2.3	0xc302	No error (0)	chengsolution.com		162.0.209.179	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 19, 2021 19:05:36.096060991 CET	162.0.209.179	443	192.168.2.3	49725	CN=chengsolution.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sat Jan 09 01:00:00 CET 2021 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Jan 04 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124 Parent PID: 5596

General

Start time:	19:05:02
Start date:	19/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	5525BB8A978D3AC15812C8D8CA9B8A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348 Parent PID: 6124

General

Start time:	19:05:25
Start date:	19/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Imagebase:	0x7ff7ca4e0000
File size:	86016 bytes
MD5 hash:	5525BB8A978D3AC15812C8D8CA9B8A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 6124 Parent PID: 5596

General

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 5348 Parent PID: 6124

General