Loading... Additional Content is being loaded
Analysis Report pan0ramic0.jpg.dll
Overview
General Information
| Sample Name: | pan0ramic0.jpg.dll |
| Analysis ID: | 343034 |
| MD5: | 25507f89abd96f37d80e0596cd834e26 |
| SHA1: | 101b89112be002d90e39b62496e79146ab8fc87a |
| SHA256: | ca3408df31dc066d6ec4feea0388ca8d0cf5d35393bd5a6f1979b9af590f7615 |
| Tags: | dllenigaselucegoziisfbursnif |
|
Most interesting Screenshot:  |
|
Detection
Ursnif
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Ursnif
Machine Learning detection for sample
PE file has a writeable .text section
Writes or reads registry keys via WMI
Writes registry values via WMI
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
AV Detection: |
  |
|---|
| Machine Learning detection for sample |
| Source: |
Joe Sandbox ML: |
||
Compliance: |
|
|---|
| Uses 32bit PE files |
| Source: |
Static PE information: |
||
| Uses new MSVCR Dlls |
| Source: |
File opened: |
Jump to behavior | ||
| Uses secure TLS version for HTTPS connections |
| Source: |
HTTPS traffic detected: |
||
| Source: |
HTTPS traffic detected: |
||
| Source: |
HTTPS traffic detected: |
||
| Source: |
Code function: |
1_2_042C523C | |
Networking: |
|
|---|
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| JA3 SSL client fingerprint seen in connection with other malware |
| Source: |
JA3 fingerprint: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: | ||