Play interactive tour

Edit tour

Analysis Report DHL_Shipment_Notification#5436637389_22_FEB.exe

Overview

General Information

Sample Name:	DHL_Shipment_Notification#5436637389_22_FEB.exe
Analysis ID:	355962
MD5:	6660a5670795be34d107d51a5323a6f3
SHA1:	ccfcbc36c22530b58bb6f35707667f658923c9bf
SHA256:	6d44a1e98afe47c5a977fd9977f45d173a28a4cbe76f27e2adc5aa702b7ffc75
Tags:	GuLoader
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

DHL_Shipment_Notification#5436637389_22_FEB.exe (PID: 7136 cmdline: 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe' MD5: 6660A5670795BE34D107D51A5323A6F3)

DHL_Shipment_Notification#5436637389_22_FEB.exe (PID: 2092 cmdline: 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe' MD5: 6660A5670795BE34D107D51A5323A6F3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

ReversingLabs: Detection: 14%

Compliance:

Uses 32bit PE files

Show sources

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

Source: global traffic

TCP traffic: 192.168.2.4:49766 -> 165.22.240.4:443

Source: unknown

DNS traffic detected: queries for: waeorat-71.tk

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/805672355845111821/813267825312661544/nWLXPcDe252.bin
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp	String found in binary or memory: https://waeorat-71.tk/admin/nWLXPcDe252.bin
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp	String found in binary or memory: https://waeorat-71.tk/admin/nWLXPcDe252.binhttps://cdn.discordapp.com/attachments/805672355845111821

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

System Summary:

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056719A NtProtectVirtualMemory,	17_2_0056719A
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00564453 NtSetInformationThread,InternetOpenA,InternetOpenUrlA,Sleep,	17_2_00564453
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056059C EnumWindows,NtSetInformationThread,	17_2_0056059C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00562016 NtSetInformationThread,	17_2_00562016
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005610CD NtProtectVirtualMemory,	17_2_005610CD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005610FD NtProtectVirtualMemory,	17_2_005610FD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005610E9 NtProtectVirtualMemory,	17_2_005610E9
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005610BD NtProtectVirtualMemory,	17_2_005610BD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005610AD NtProtectVirtualMemory,	17_2_005610AD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00560246 NtSetInformationThread,	17_2_00560246
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005655EC NtSetInformationThread,	17_2_005655EC
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00566645 NtSetInformationThread,	17_2_00566645
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056064D NtSetInformationThread,	17_2_0056064D
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00560607 NtSetInformationThread,	17_2_00560607
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056062D NtSetInformationThread,	17_2_0056062D
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005606D5 NtSetInformationThread,	17_2_005606D5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005676CD NtProtectVirtualMemory,	17_2_005676CD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005606F5 NtSetInformationThread,	17_2_005606F5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00565693 NtSetInformationThread,	17_2_00565693
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00565745 NtSetInformationThread,	17_2_00565745
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005657EE NtSetInformationThread,	17_2_005657EE
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056397D NtSetInformationThread,	17_2_0056397D
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00562FED NtSetInformationThread,	17_2_00562FED

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000000.00000000.636727770.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1162732129.000000001DD80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs DHL_Shipment_Notification#5436637389_22_FEB.exe
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000000.996681854.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe	Binary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@2/0@1/1

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

File created: C:\Users\user\AppData\Local\Temp\~DF591F2071FB6AD237.TMP

Jump to behavior

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

ReversingLabs: Detection: 14%

Source: unknown	Process created: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'
Source: unknown	Process created: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092, type: MEMORY

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056500E pushfd ; retf		17_2_00565015
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005651A6 push ss; iretd		17_2_005651A7

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 0000000000500223 second address: 0000000000500223 instructions:
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 00000000005003EA second address: 00000000005003EA instructions:
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000050646C second address: 000000000050646C instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FCFFCB33B88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007FCFFCB33B43h 0x0000002e jmp 00007FCFFCB33B92h 0x00000030 cmp ch, 0000003Bh 0x00000033 jmp 00007FCFFCB33B92h 0x00000035 cmp ah, ch 0x00000037 call 00007FCFFCB33BDBh 0x0000003c call 00007FCFFCB33B98h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000050325D second address: 000000000050325D instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 0000000000500223 second address: 0000000000500223 instructions:
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 00000000005003EA second address: 00000000005003EA instructions:
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000050646C second address: 000000000050646C instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FCFFCB33B88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007FCFFCB33B43h 0x0000002e jmp 00007FCFFCB33B92h 0x00000030 cmp ch, 0000003Bh 0x00000033 jmp 00007FCFFCB33B92h 0x00000035 cmp ah, ch 0x00000037 call 00007FCFFCB33BDBh 0x0000003c call 00007FCFFCB33B98h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000050648C second address: 000000000050648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FCFFCB366EDh 0x0000001d popad 0x0000001e call 00007FCFFCB3617Dh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000050325D second address: 000000000050325D instructions:
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	RDTSC instruction interceptor: First address: 000000000056648C second address: 000000000056648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FCFFCB366EDh 0x0000001d popad 0x0000001e call 00007FCFFCB3617Dh 0x00000023 lfence 0x00000026 rdtsc

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Code function: 17_2_00564453 rdtsc

17_2_00564453

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Last function: Thread delayed

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Code function: 17_2_00564453 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?

17_2_00564453

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Code function: 17_2_00564453 rdtsc

17_2_00564453

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Code function: 17_2_00564229 LdrInitializeThunk,

17_2_00564229

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00562016 mov eax, dword ptr fs:[00000030h]	17_2_00562016
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005626D3 mov eax, dword ptr fs:[00000030h]	17_2_005626D3
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056268A mov eax, dword ptr fs:[00000030h]	17_2_0056268A
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056583A mov eax, dword ptr fs:[00000030h]	17_2_0056583A
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056295A mov eax, dword ptr fs:[00000030h]	17_2_0056295A
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00563958 mov eax, dword ptr fs:[00000030h]	17_2_00563958
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_0056298D mov eax, dword ptr fs:[00000030h]	17_2_0056298D
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_005629AD mov eax, dword ptr fs:[00000030h]	17_2_005629AD
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00566B77 mov eax, dword ptr fs:[00000030h]	17_2_00566B77
Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe	Code function: 17_2_00565FF1 mov eax, dword ptr fs:[00000030h]	17_2_00565FF1

HIPS / PFW / Operating System Protection Evasion:

Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe

Code function: 17_2_00566055 cpuid

17_2_00566055

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection2	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery621	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection2	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery211	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DHL_Shipment_Notification#5436637389_22_FEB.exe	15%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
waeorat-71.tk	4%	Virustotal		Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
waeorat-71.tk	165.22.240.4	true	false	4%, Virustotal, Browse	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
165.22.240.4	unknown	United States		14061	DIGITALOCEAN-ASNUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	355962
Start date:	22.02.2021
Start time:	10:07:27
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DHL_Shipment_Notification#5436637389_22_FEB.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@2/0@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 92.122.145.220, 52.255.188.83, 104.43.139.144, 51.104.139.180, 52.155.217.156, 67.27.235.126, 8.248.117.254, 67.27.159.254, 8.248.119.254, 67.27.159.126, 20.54.26.129, 92.122.213.247, 92.122.213.194, 51.11.168.160 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	124992436.docx	Get hash	malicious	Browse	68.183.127.92
	124992436.docx	Get hash	malicious	Browse	68.183.127.92
	iopjvdf.dll	Get hash	malicious	Browse	206.189.10.247
	document-750895311.xls	Get hash	malicious	Browse	206.189.10.247
	Shinshin Machinery.exe	Get hash	malicious	Browse	167.99.187.230
	HEC Batangas Integrated LNG and Power Project DocumentationsType a message.exe.exe	Get hash	malicious	Browse	206.189.50.215
	processhacker-2.39-setup.exe	Get hash	malicious	Browse	162.243.25.33
	PO#652.exe	Get hash	malicious	Browse	192.241.148.82
	Linux_Reader.exe	Get hash	malicious	Browse	159.203.148.225
	IU-8549 Medical report COVID-19.doc	Get hash	malicious	Browse	134.209.144.106
	Statement_of_Account_as_of 02_17_2021.xlsm	Get hash	malicious	Browse	167.71.6.214
	Quotation.exe	Get hash	malicious	Browse	67.207.77.53
	MoqGIIogN0.dll	Get hash	malicious	Browse	192.241.174.45
	dAIyRK9gO7.exe	Get hash	malicious	Browse	138.197.53.157
	tS9P6wPz9x.exe	Get hash	malicious	Browse	142.93.110.250
	RFQ.xls	Get hash	malicious	Browse	192.81.210.146
	955037-012021-98_98795947.doc	Get hash	malicious	Browse	159.65.10.195
	ransomware.exe	Get hash	malicious	Browse	142.93.110.250
	ransomware.exe	Get hash	malicious	Browse	142.93.110.250
	DkELZjJtGY.xlsm	Get hash	malicious	Browse	178.128.83.165

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.946942752761298
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL_Shipment_Notification#5436637389_22_FEB.exe
File size:	139264
MD5:	6660a5670795be34d107d51a5323a6f3
SHA1:	ccfcbc36c22530b58bb6f35707667f658923c9bf
SHA256:	6d44a1e98afe47c5a977fd9977f45d173a28a4cbe76f27e2adc5aa702b7ffc75
SHA512:	703b8025afdafd41f78e065fb4af4ab556663a44bc36b7252a51470803a8d034c06bf5ec3ea3ffeb327fb2e3b5f4364834a776a7eaa16721d3af88c55156b8bd
SSDEEP:	1536:DWWTwV4fVhussgo2mzIggDnv+0op+CygfnMZaBmZJouxVQwV4MjW:nwVUPbbmcNDv+LHTMjZJoQqwV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L......Y.................p........................@................

File Icon


Icon Hash:	01d292796dda0080

Static PE Info

General
Entrypoint:	0x4014e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x590288EC [Fri Apr 28 00:12:28 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3f0d3842f1f621625b7b4016e6be4558

Entrypoint Preview

Instruction
push 00412C00h
call 00007FCFFC7B5705h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+ebp*4], dh
sti
mov ah, C3h
add cl, byte ptr [ebp+ecx*4+71h]
cmp dword ptr [esi+6Eh], ebx
jne 00007FCFFC7B573Ch
fiadd word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edi], dh
or eax, 726F420Ah
jbe 00007FCFFC7B5774h
xor al, 70h
jc 00007FCFFC7B5781h
push 00000065h
arpl word ptr [esi+edx*2+62h], si
add byte ptr [edx], cl
inc ebx
popad
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add edx, ecx
cmpsb
sbb dl, al
add eax, 9E460215h
jne 00007FCFFC7B5719h
mov cl, 7Ch
pop ebp
pushfd
mov bl, 3Ah
imul ebx, dword ptr [esi], 32h
mov ah, ah
inc ebx
mov dword ptr [ebx+edx*4+01h], eax
xor al, 05h
retn 3AEEh
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb eax, 9A000116h
jnle 00007FCFFC7B5712h
add byte ptr [eax], al
or eax, 70794800h
outsd
arpl word ptr [eax+6Fh], bp
outsb
jc 00007FCFFC7B577Ch
popad
aaa
add byte ptr [73000701h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x175c4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x84a2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x144	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16b44	0x17000	False	0.400539232337	data	5.59543646966	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x18000	0xa24	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x84a2	0x9000	False	0.343071831597	data	3.55708163533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x2137a	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x1fd52	0x1628	dBase IV DBT of \200.DBF, blocks size 0, block length 4608, next free block index 40, next free block 0, next used block 0
RT_ICON	0x1e0aa	0x1ca8	data
RT_ICON	0x1d402	0xca8	data
RT_ICON	0x1d09a	0x368	GLS_BINARY_LSB_FIRST
RT_ICON	0x1aaf2	0x25a8	data
RT_ICON	0x19a4a	0x10a8	data
RT_ICON	0x195e2	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1956c	0x76	data
RT_VERSION	0x19240	0x32c	data

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaStrI4, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFPFix, __vbaFpR8, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaR4Str, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaLateMemCall, __vbaVarDup, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	WAB
FileVersion	6.03.9600
CompanyName	Microsoft Corporation
ProductName	Microsoft Windows Operating System
ProductVersion	6.03.9600
FileDescription	Windows Contacts
OriginalFilename	WAB.EXE

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2021 10:11:06.829106092 CET	49766	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:09.840812922 CET	49766	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:11.843861103 CET	49767	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:14.856848955 CET	49767	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:16.877027988 CET	49768	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:19.888725042 CET	49768	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:21.924555063 CET	49769	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:24.935931921 CET	49769	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:26.940771103 CET	49770	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:29.951827049 CET	49770	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:31.970504045 CET	49771	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:34.983477116 CET	49771	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:37.021096945 CET	49772	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:40.030891895 CET	49772	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:42.082328081 CET	49773	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:45.093863010 CET	49773	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:47.113384008 CET	49774	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:50.125375032 CET	49774	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:52.179912090 CET	49775	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:55.188282967 CET	49775	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:11:57.708061934 CET	49776	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:00.720191002 CET	49776	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:02.769761086 CET	49777	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:05.783206940 CET	49777	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:07.788768053 CET	49778	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:10.799134970 CET	49778	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:12.817162991 CET	49779	443	192.168.2.4	165.22.240.4
Feb 22, 2021 10:12:15.830691099 CET	49779	443	192.168.2.4	165.22.240.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2021 10:08:05.765815973 CET	59123	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:05.814742088 CET	53	59123	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:07.022815943 CET	54531	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:07.084274054 CET	53	54531	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:07.291821003 CET	49714	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:07.340609074 CET	53	49714	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:08.301573038 CET	58028	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:08.358681917 CET	53	58028	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:09.681369066 CET	53097	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:09.736083031 CET	53	53097	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:10.670995951 CET	49257	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:10.719635963 CET	53	49257	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:11.700761080 CET	62389	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:11.752764940 CET	53	62389	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:13.040894032 CET	49910	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:13.089567900 CET	53	49910	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:13.885338068 CET	55854	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:13.945184946 CET	53	55854	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:15.066054106 CET	64549	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:15.119932890 CET	53	64549	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:16.537591934 CET	63153	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:16.586183071 CET	53	63153	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:17.488342047 CET	52991	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:17.537084103 CET	53	52991	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:18.606760979 CET	53700	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:18.660501957 CET	53	53700	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:19.873456001 CET	51726	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:19.927517891 CET	53	51726	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:21.120476961 CET	56794	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:21.169166088 CET	53	56794	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:22.855973959 CET	56534	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:22.904489994 CET	53	56534	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:23.829696894 CET	56627	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:23.881062031 CET	53	56627	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:28.803721905 CET	56621	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:28.852212906 CET	53	56621	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:29.727432013 CET	63116	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:29.775950909 CET	53	63116	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:39.449137926 CET	64078	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:39.500714064 CET	53	64078	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:56.578450918 CET	64801	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:56.655071974 CET	53	64801	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:57.298132896 CET	61721	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:57.347476006 CET	53	61721	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:58.305146933 CET	51255	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:58.371611118 CET	53	51255	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:58.812658072 CET	61522	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:58.916172028 CET	53	61522	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:59.393642902 CET	52337	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:59.445775032 CET	53	52337	8.8.8.8	192.168.2.4
Feb 22, 2021 10:08:59.532125950 CET	55046	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:08:59.580621004 CET	53	55046	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:00.036408901 CET	49612	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:00.046413898 CET	49285	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:00.087074995 CET	53	49612	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:00.111577988 CET	53	49285	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:00.687937975 CET	50601	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:00.736433029 CET	53	50601	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:01.503963947 CET	60875	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:01.554456949 CET	53	60875	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:03.094491959 CET	56448	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:03.170993090 CET	53	56448	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:03.630774975 CET	59172	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:03.690642118 CET	53	59172	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:17.501976967 CET	62420	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:17.550674915 CET	53	62420	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:18.085654020 CET	60579	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:18.142857075 CET	53	60579	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:23.330121040 CET	50183	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:23.389273882 CET	53	50183	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:52.679147959 CET	61531	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:52.727674961 CET	53	61531	8.8.8.8	192.168.2.4
Feb 22, 2021 10:09:55.533899069 CET	49228	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:09:55.604880095 CET	53	49228	8.8.8.8	192.168.2.4
Feb 22, 2021 10:11:06.704314947 CET	59794	53	192.168.2.4	8.8.8.8
Feb 22, 2021 10:11:06.812711000 CET	53	59794	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 22, 2021 10:11:06.704314947 CET	192.168.2.4	8.8.8.8	0xfcef	Standard query (0)	waeorat-71.tk	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 22, 2021 10:11:06.812711000 CET	8.8.8.8	192.168.2.4	0xfcef	No error (0)	waeorat-71.tk		165.22.240.4	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 7136 Parent PID: 5968

General

Start time:	10:08:10
Start date:	22/02/2021
Path:	C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'
Imagebase:	0x400000
File size:	139264 bytes
MD5 hash:	6660A5670795BE34D107D51A5323A6F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092 Parent PID: 7136

General

Start time:	10:10:58
Start date:	22/02/2021
Path:	C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'
Imagebase:	0x400000
File size:	139264 bytes
MD5 hash:	6660A5670795BE34D107D51A5323A6F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092 Parent PID: 7136 DHL_Shipment_Notification#5436637389_22_FEB.exeCOMMON

Executed Functions

Function 00564453, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244networksleepnativeCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B
InternetOpenA.WININET(00564BF6,00000000,00000000,00000000,00000000,00561E0E,?,00000000,?,00000089,0000034F,?,?,?,?,00000000), ref: 0056449D
InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InternetOpen$InformationSleepThread
String ID: 1.!T
API String ID: 1585804506-3147410236
Opcode ID: 1e84425cc2d85b020d3153c39415813bc65e37a1b24b1acd58e4664db02a689f
Instruction ID: 097ff19ed531364958925c9bcde9a6ee18596bc894c8dbd2539c93cf61478a41
Opcode Fuzzy Hash: 1e84425cc2d85b020d3153c39415813bc65e37a1b24b1acd58e4664db02a689f
Instruction Fuzzy Hash: 5971DE70648386AAEF309E20CD45BFA3F61BF55344F648926AD476B1C1DB70A841EE51

Uniqueness

Uniqueness Score: -1.00%

Function 0056059C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(005605F6,?,00000000,?,00000000,?,?,?,?,?,00000000,00000000,?,?,?,00000000), ref: 005605B6
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: a2705c1b4467b4aacb5dad15e77dfd55591a527b33d3ad26035d4f1b190e8433
Instruction ID: de6d8400d84bf42309b3396e54583876c8a16656c648aa2997c1092ae2f9b362
Opcode Fuzzy Hash: a2705c1b4467b4aacb5dad15e77dfd55591a527b33d3ad26035d4f1b190e8433
Instruction Fuzzy Hash: 23310470689306EAEB10AE608C45BBB3F61FBD5354F705A16FC535B1C1CBA0A852DF52

Uniqueness

Uniqueness Score: -1.00%

Function 00562016, Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 831nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: a2ac7cb13357386f1b09c4fd1b6478932d061c0d850fa80a383d3d61618c8c6f
Instruction ID: 27832fc79e6b670da06c3e8ba03269655e7f4f5f4340705ea53b717c39c8f1c7
Opcode Fuzzy Hash: a2ac7cb13357386f1b09c4fd1b6478932d061c0d850fa80a383d3d61618c8c6f
Instruction Fuzzy Hash: 454265B0644706EFEB208E24CC95BE67FA1FF55350F304A29FC4657281DB78A985EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00566645, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: a21f13ec0da495e261092261dcf29ec12e2159807ab3eeec69747be2e17455c5
Instruction ID: 40ef8328b7070112fc4c98a273e7434408957cde101dd8c55b1e85222cfd5b2b
Opcode Fuzzy Hash: a21f13ec0da495e261092261dcf29ec12e2159807ab3eeec69747be2e17455c5
Instruction Fuzzy Hash: AC0268B0648306EAEF200E14CD09BFA3E61FF85354F744A26FD42671C1D7B89A85EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00560246, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 4810687b15e437d43c291a806c6f7671d6563ec6c979d0985b530c708ee655d5
Instruction ID: 1cc32e09b656ee7eac2b1699be8cddc7ce9b8bdc0fb2e4fe562fe4ff40a7817d
Opcode Fuzzy Hash: 4810687b15e437d43c291a806c6f7671d6563ec6c979d0985b530c708ee655d5
Instruction Fuzzy Hash: A3411374A88306EAEF206E60C945BF73F61BF85354F745916B8432B1C1D6A0AC52EA46

Uniqueness

Uniqueness Score: -1.00%

Function 005610CD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561148

Strings

W.E, xrefs: 00564E17

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: fd71d1d3aeb579c10dddb5864c734d21c1fb4e6ce92eb04f312e552d4bf3f404
Instruction ID: f736b7291362ad51180472bf8349475177febb9e6e90624e8c4acb981bdb4b53
Opcode Fuzzy Hash: fd71d1d3aeb579c10dddb5864c734d21c1fb4e6ce92eb04f312e552d4bf3f404
Instruction Fuzzy Hash: 5C414835644B84DBDB205A158C657F93F69BF42384F7D0926F98297292C77588C0E70E

Uniqueness

Uniqueness Score: -1.00%

Function 005610BD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561148

Strings

W.E, xrefs: 00564E17

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 662658a9b4da29361cbc0144bbdc9ef3c601891d650987734781d816d93dbb73
Instruction ID: c29dd0514186366803815f62470f3a15cb725d2f62a52f893d46364b701232ca
Opcode Fuzzy Hash: 662658a9b4da29361cbc0144bbdc9ef3c601891d650987734781d816d93dbb73
Instruction Fuzzy Hash: 20414674648B84DBDF209A158C697F93F69BF42384F7D0926F98297282C27588C0E30E

Uniqueness

Uniqueness Score: -1.00%

Function 005610AD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561148

Strings

W.E, xrefs: 00564E17

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 80e86ba1cdb364f4cccc2f705ef4456ee0e382a20d1d0e0409ac2fccc09544c3
Instruction ID: 7a0dc3a45a3a6179cb204875d5645225074aa249d5d9fe795450cfc3d77e7283
Opcode Fuzzy Hash: 80e86ba1cdb364f4cccc2f705ef4456ee0e382a20d1d0e0409ac2fccc09544c3
Instruction Fuzzy Hash: 59413534648B84DBDF209A158D697F92E69BF42384F7C0926F98297282C23588C0E30E

Uniqueness

Uniqueness Score: -1.00%

Function 005610E9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561148

Strings

W.E, xrefs: 00564E17

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 26e23905c73df1d10814d90356f55c4909ebab1bdde29a2a6d0ae9f44aea004d
Instruction ID: 46dd60dcc94abb17cb29576b4811a8049f2f00dd7371661d1fa9bfb147ea7386
Opcode Fuzzy Hash: 26e23905c73df1d10814d90356f55c4909ebab1bdde29a2a6d0ae9f44aea004d
Instruction Fuzzy Hash: 66414734644B84DBDB209A158C697F93F69BF42384F7C0926F98297292C77588C0E70E

Uniqueness

Uniqueness Score: -1.00%

Function 005610FD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561148

Strings

W.E, xrefs: 00564E17

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: a76f634566e929e43610dd5405474f3ea17fcad8917a93e99f370200380d2e05
Instruction ID: f6ab5456e2a87698150831a82f110e9b137e0bf51653905e931417c223ffb19f
Opcode Fuzzy Hash: a76f634566e929e43610dd5405474f3ea17fcad8917a93e99f370200380d2e05
Instruction Fuzzy Hash: 33415934644B84DADB209A258C657F93F69BF42384F7C0926F94297291C3758880E70E

Uniqueness

Uniqueness Score: -1.00%

Function 005655EC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 121nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 4898b24335f7bf8566ceb67d1cbd645f456289a3375d3ae94a9b9a1dcd4ebac7
Instruction ID: ea48cfd6b397013d4205eaf400e57dab040f4f2e85c34f71c2d923b74d2496b9
Opcode Fuzzy Hash: 4898b24335f7bf8566ceb67d1cbd645f456289a3375d3ae94a9b9a1dcd4ebac7
Instruction Fuzzy Hash: 5D311270A89306EAEF206E60CD45BF72F51FB88344FB04A16BC431B1C1D6A0A842EE52

Uniqueness

Uniqueness Score: -1.00%

Function 00565693, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: d582f71de1e37605b481eb70967afb35b3663284cd8b361d7b71f485a94255e1
Instruction ID: a835d145b7a0b3714cc707656b22b572a66bb8189ab7c600b27694a65900fea2
Opcode Fuzzy Hash: d582f71de1e37605b481eb70967afb35b3663284cd8b361d7b71f485a94255e1
Instruction Fuzzy Hash: EE314470A893069AEB146E60CC05BB73F60FB95354FB0492AFC431B1C1D760AC52EF42

Uniqueness

Uniqueness Score: -1.00%

Function 005657EE, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: aff853e8dfe977deaabbee6c0937d05e72c298a9da9c04635844421d01355cc2
Instruction ID: 4625d695c3fc0bf25def01ee13523336273a7d8853e5e085e165619ee773f1b4
Opcode Fuzzy Hash: aff853e8dfe977deaabbee6c0937d05e72c298a9da9c04635844421d01355cc2
Instruction Fuzzy Hash: D0312470A89306DAEF206E608C45BF73F50FB95344FB44A16BC432B1C1D7A0AC52EE52

Uniqueness

Uniqueness Score: -1.00%

Function 00562FED, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 45ac6c2cb7b703f19b0bc1615616d794ba9107ca0ca9ce9f729d6c5375e7f3c9
Instruction ID: c1e6c9a2b938873eeb57f076515affa06558aa51b086c6ce00c7945d501f104f
Opcode Fuzzy Hash: 45ac6c2cb7b703f19b0bc1615616d794ba9107ca0ca9ce9f729d6c5375e7f3c9
Instruction Fuzzy Hash: AD310370A89306DAEF206E608D45BF73F61FB95344F745A56BD422B2C1C6A0AC52EF42

Uniqueness

Uniqueness Score: -1.00%

Function 00565745, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: fc918ca0c9abcb092e3a76f17a90f77e1c02ed5ce0b8d3cc18df4288ac8b4899
Instruction ID: 467fb6320be6c158e518a85b11610ed5dfb6dca5930bb701c9ffd8dedea8af2a
Opcode Fuzzy Hash: fc918ca0c9abcb092e3a76f17a90f77e1c02ed5ce0b8d3cc18df4288ac8b4899
Instruction Fuzzy Hash: 0B313370A89306EAEF206E608C55BF73F50FB99344F705A16BC532B1C1C6A0AC52EF46

Uniqueness

Uniqueness Score: -1.00%

Function 0056397D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: b9bbb883f568054d532471058be3aca1e577f23847e4f4d121d356975454df19
Instruction ID: 7bdb10aa237f933a0e34948c642fa84a92e3fef7cf8193573d1f5d09b0e3b67c
Opcode Fuzzy Hash: b9bbb883f568054d532471058be3aca1e577f23847e4f4d121d356975454df19
Instruction Fuzzy Hash: 20312470A853069AEF206E608C45BB73F51FBC5344F705A26BC421B1C1C7A0EC52EF46

Uniqueness

Uniqueness Score: -1.00%

Function 00560607, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 4aac5174e303ccdd0f92393beacdeb4d98636b73687228ad428d0f79026519f1
Instruction ID: 110ef1d0821791f302be8fdee137a6b31aec540f5cec5bacdcd8177d741b9ba1
Opcode Fuzzy Hash: 4aac5174e303ccdd0f92393beacdeb4d98636b73687228ad428d0f79026519f1
Instruction Fuzzy Hash: 24313430A85306DAEF106E608C45BF73F60FB95344F705A56BC422B1C1C7A0AC52EF52

Uniqueness

Uniqueness Score: -1.00%

Function 0056062D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 39ce8a4fd1342615b1e699bb012707238d8846cf80eafd19d820624595b8ec18
Instruction ID: 79614437f8a293f7b611f51796aa0b3ed60db093c4b7a237b048acc6a592082c
Opcode Fuzzy Hash: 39ce8a4fd1342615b1e699bb012707238d8846cf80eafd19d820624595b8ec18
Instruction Fuzzy Hash: FE213574AC5316EAEB106E608C45BE73F60FB95744F704A16BD522B1C1C7A0EC42EF52

Uniqueness

Uniqueness Score: -1.00%

Function 0056064D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 8ed5c65ba72693e4bb83d33a4c19a8dfa8264900e2c4c064bf64ca1435bc89d1
Instruction ID: 8057093457f42e9c56ef6d0fbe664e10b086a45aefbded4092fba603f714a10d
Opcode Fuzzy Hash: 8ed5c65ba72693e4bb83d33a4c19a8dfa8264900e2c4c064bf64ca1435bc89d1
Instruction Fuzzy Hash: 6D21F170A85316EAEB106E608C45BE73F60FB99748F744A16BD526B1C1C7A0AC42EF52

Uniqueness

Uniqueness Score: -1.00%

Function 005606D5, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Strings

1.!T, xrefs: 005606DB

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: ff2cfda5270e614fc74b0b35e188eefa712696fa9e98589743f952654bfabeb0
Instruction ID: 6c0c7b011271567073781db0d9c434ce5a468a90c14520a62f186871d2fd0d5b
Opcode Fuzzy Hash: ff2cfda5270e614fc74b0b35e188eefa712696fa9e98589743f952654bfabeb0
Instruction Fuzzy Hash: 47110475A85316AAEB105E608C457A73F20FB45398F644616BC522B2C1D760BC42EE91

Uniqueness

Uniqueness Score: -1.00%

Function 005606F5, Relevance: 1.6, APIs: 1, Instructions: 67nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 2e6ab3ce3a72e7c834e702feb9aeb46ab253c8df25a99d28b8a5a2ec303f6731
Instruction ID: 303ff5604e11a95fe4f1c0aea1dd2752e15f1210474538efa42552a8201a4871
Opcode Fuzzy Hash: 2e6ab3ce3a72e7c834e702feb9aeb46ab253c8df25a99d28b8a5a2ec303f6731
Instruction Fuzzy Hash: 91112574985316EAEF105E608C84BE73F14FB49398F644A15BC622B2C1D760BC43EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00564229, Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(?,005602AE,?,00561E0E,?,00000000,?,00000089,0000034F,?,?,?,?,00000000,?,00003000), ref: 00564C5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 47f3664090f97ac378295ffddbc576d55af36abb1b3634bb0117d7e1e12c5021
Instruction ID: 564398154c058a137788681aafb905f039ee26f4c3ff27375b7cb19c75d612cd
Opcode Fuzzy Hash: 47f3664090f97ac378295ffddbc576d55af36abb1b3634bb0117d7e1e12c5021
Instruction Fuzzy Hash: C7C0123E641A0916E1107620810761A7B10FBC1351FA5D449D1411B7759E249E167B98

Uniqueness

Uniqueness Score: -1.00%

Function 0056719A, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00560246,?,00566C61,00000040,00563086,00000000,00000000,00000000,00000000,?,00000000,00000000,005658DD), ref: 005671B3

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 00564479, Relevance: 3.1, APIs: 2, Instructions: 97networksleepnativeCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B
InternetOpenA.WININET(00564BF6,00000000,00000000,00000000,00000000,00561E0E,?,00000000,?,00000089,0000034F,?,?,?,?,00000000), ref: 0056449D
InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InternetOpen$InformationSleepThread
String ID:
API String ID: 1585804506-0
Opcode ID: 13b6cb75f72dd82d9ccea67f0f3174ffe64cc0dd5cc052445997e2f05c4941b4
Instruction ID: f9983277fba90f473053c0fc0606dbe25983a915c08bba748fe511f10bd4d964
Opcode Fuzzy Hash: 13b6cb75f72dd82d9ccea67f0f3174ffe64cc0dd5cc052445997e2f05c4941b4
Instruction Fuzzy Hash: 78318270244387AFEF344E14CD95BFE2E65FF15340F608826ED0B9B590DB719984AE51

Uniqueness

Uniqueness Score: -1.00%

Function 0056777D, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: fbec1a4d379a72d3b0aba9818d264a77e8472e4063a5b6cb27cb245c155419e6
Instruction ID: 9d106cd08a8a4ef20dfcf61787495e7df4df9e96d531ae55e7dd4925f2245fcb
Opcode Fuzzy Hash: fbec1a4d379a72d3b0aba9818d264a77e8472e4063a5b6cb27cb245c155419e6
Instruction Fuzzy Hash: 8B41133160C60DCEEB2949A4C5983BD2E93FF6D32CFB54A6ACC9287190C3288DC4D642

Uniqueness

Uniqueness Score: -1.00%

Function 00560308, Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca081d60dcb4f71f8e4afabb847c49b9a02201aa51179cb4321523c3899f7ca
Instruction ID: de88d8cc7684ad541a01d4f737ddd54f66860eff7eaa3506ef12ec40550fd93c
Opcode Fuzzy Hash: aca081d60dcb4f71f8e4afabb847c49b9a02201aa51179cb4321523c3899f7ca
Instruction Fuzzy Hash: DF318964688602EBEF30296448457BB2E16FF91372FB05E17FD5357681F6604881FA53

Uniqueness

Uniqueness Score: -1.00%

Function 0056779D, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfb24e247444d3c2d51386af9aa6fbb3884b671b9eb6a383844df0d524a43a1
Instruction ID: eda979e9968b4ba8c0f5d5753378a892171949029ca210b6b9e23a405133b596
Opcode Fuzzy Hash: 1dfb24e247444d3c2d51386af9aa6fbb3884b671b9eb6a383844df0d524a43a1
Instruction Fuzzy Hash: 8A31D22050D60DCDEB295AA4C4583AD2E93FF6D32CFB5595ACC5287191C3298EC4D742

Uniqueness

Uniqueness Score: -1.00%

Function 005677E5, Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a408fe6b1cbea64aa3bda32251b89b60cfe04128c2526ed8a44f391a45d8a4e9
Instruction ID: 42544a14cf1020325ec31e4c71e2f0b91ebea49c8745593d81049495cf37db52
Opcode Fuzzy Hash: a408fe6b1cbea64aa3bda32251b89b60cfe04128c2526ed8a44f391a45d8a4e9
Instruction Fuzzy Hash: B131C63050D60DCEEB255AA4C4493AD2FA3FF5D32CF655956CC5247191C3358DC8D782

Uniqueness

Uniqueness Score: -1.00%

Function 00567819, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 19ad732b261f4616f2074d8bfa39186946016ba590f04d025b3c3148b7517906
Instruction ID: 5653f467e481b6232c7a86f91cab19f6c7e1211ebf2b8c83a5e24e818e738f89
Opcode Fuzzy Hash: 19ad732b261f4616f2074d8bfa39186946016ba590f04d025b3c3148b7517906
Instruction Fuzzy Hash: 3031A43060D60DCEEF295AA4C4487AD2FA3FF5D32CF65595AC89247191C3758EC4D782

Uniqueness

Uniqueness Score: -1.00%

Function 0056782D, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: deda4beade9acc46cea846a2cabc27e4b53bc88489ae5b0b2647b93bf930c407
Instruction ID: cfe0a4b0db798cc3d5be241513b021752e35b088c17b7f40eb3add13a2242c2e
Opcode Fuzzy Hash: deda4beade9acc46cea846a2cabc27e4b53bc88489ae5b0b2647b93bf930c407
Instruction Fuzzy Hash: D731B42060D60DCEEB255AA4C4483AC3FA3FF5E32CF69595AC85247191C3758EC5D782

Uniqueness

Uniqueness Score: -1.00%

Function 005644D1, Relevance: 1.6, APIs: 1, Instructions: 86sleepnativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B
InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationInternetOpenSleepThread
String ID:
API String ID: 436795352-0
Opcode ID: 46cedda011675b5f7c4bda9a17b2a7509986e9a60d1e0f8f7d2116c3d48f55c6
Instruction ID: 61af04dfbb75910c2e799da1b17277cd3d758faef0ebef7a57977fdb98031642
Opcode Fuzzy Hash: 46cedda011675b5f7c4bda9a17b2a7509986e9a60d1e0f8f7d2116c3d48f55c6
Instruction Fuzzy Hash: E2217C7020428BABEF358E14CD95BFE3E65BF15340F608826AD0B9B990E7719984AE51

Uniqueness

Uniqueness Score: -1.00%

Function 0056787D, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9219fde4591cd1a092bd280db320c2b0e0b123635bc2e22097b05be19148de32
Instruction ID: 6eadeac706d7dfef890d66cccfe383c951a7e6d2e27ba9bcfc78aec033f72f58
Opcode Fuzzy Hash: 9219fde4591cd1a092bd280db320c2b0e0b123635bc2e22097b05be19148de32
Instruction Fuzzy Hash: 4D21D83060C60DCEEB254AA4C4483BD3F93FF5D32CF65569AC852471A1C3758AC4DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00567895, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 63ddc848b383cb4a1c57ed49534ceb6281e3d2c550a6dc7fe752d02b24e04504
Instruction ID: d201f495eba9f6bff0f6cade6fff8688b38967ab215b3248dea848718305f78a
Opcode Fuzzy Hash: 63ddc848b383cb4a1c57ed49534ceb6281e3d2c550a6dc7fe752d02b24e04504
Instruction Fuzzy Hash: CA21B32050D60DCEEB254AA4C4487AD3F93FF6E32CFA5569AC8924B1A1C3758AC4DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0056026D, Relevance: 1.6, APIs: 1, Instructions: 80nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: d417debb5f025a0f9661eabe36b017f0adce5c3bb6285e38bd39d5d7a8bb15b6
Instruction ID: c5f8544e84de9b2c352edd466f12015a54bf96703f5ae942d6da3069ca3da4fd
Opcode Fuzzy Hash: d417debb5f025a0f9661eabe36b017f0adce5c3bb6285e38bd39d5d7a8bb15b6
Instruction Fuzzy Hash: C91127A40C8A47E6DF213A60C5197BF2D11BF913B0FB44C16F98343986F6554C89F513

Uniqueness

Uniqueness Score: -1.00%

Function 005644F9, Relevance: 1.6, APIs: 1, Instructions: 75sleepnativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0056071B
InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InformationInternetOpenSleepThread
String ID:
API String ID: 436795352-0
Opcode ID: 0bc92da4f7313d40c6075dda0782a3f3a953179d0190d7adefc76f926b02e92c
Instruction ID: 300aacbdd11d1e3035f97521921a0e0adb2890ace55025c9945409f2bab3da46
Opcode Fuzzy Hash: 0bc92da4f7313d40c6075dda0782a3f3a953179d0190d7adefc76f926b02e92c
Instruction Fuzzy Hash: 25215E7010428B9FEF358E14CD94BFE3E65BF15350F608825ED0B9B891E7719984AF51

Uniqueness

Uniqueness Score: -1.00%

Function 005678C5, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7afff337782b74047bc5a92b0da3c12f69a863cee23a50ccdc204e080c2edbd6
Instruction ID: 43ddc3f9df0025f4e80c5720a64a4bc36014ebf98eddd9181ac390a04c0afc3c
Opcode Fuzzy Hash: 7afff337782b74047bc5a92b0da3c12f69a863cee23a50ccdc204e080c2edbd6
Instruction Fuzzy Hash: BD21E42060C20DCEEF254AF4C0483BC3EA3FF2D32CFA55686C852470A1C3758AC8DA82

Uniqueness

Uniqueness Score: -1.00%

Function 005678DD, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 092ccaf147679677de7cf8c3af5a69c0c14c76f08c80184dae9eadc855a523a7
Instruction ID: a358350a5c562ea654b26544c7532db82686954f6bf623a1005a2913f432d360
Opcode Fuzzy Hash: 092ccaf147679677de7cf8c3af5a69c0c14c76f08c80184dae9eadc855a523a7
Instruction Fuzzy Hash: 0611932160D20DCEEF655AF4C1483AD2F93FF2E32CFA55686C892470A1C3758AC9D642

Uniqueness

Uniqueness Score: -1.00%

Function 005678F9, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 98c781c50781006a494bbeb6cba6ea233a4d0e4ad23d62c8c5052b6340a30b1a
Instruction ID: 3bfc9e11f3a6a669aae4f5fa68988b91c0e1de97a9a366c90b0c011e290fc052
Opcode Fuzzy Hash: 98c781c50781006a494bbeb6cba6ea233a4d0e4ad23d62c8c5052b6340a30b1a
Instruction Fuzzy Hash: C111C421A0D20DCDEB655AF4C1493AC3FA3FF1E32CFA55596CC92470A0C3758AC9DA42

Uniqueness

Uniqueness Score: -1.00%

Function 00564549, Relevance: 1.6, APIs: 1, Instructions: 64sleepnetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InternetOpenSleep
String ID:
API String ID: 3820164841-0
Opcode ID: 3de53891a3f4ac9cfb980a6f0c9c887b562c717698c4e33a0d74fec8ecf1189e
Instruction ID: a01f859f62622889a11125a2159fa29cb9de73f446dd4166e5874fa4f7ccd50f
Opcode Fuzzy Hash: 3de53891a3f4ac9cfb980a6f0c9c887b562c717698c4e33a0d74fec8ecf1189e
Instruction Fuzzy Hash: 6D118B7014428BEBDF358E14CD90BFE3A65BB12340F208425AD4B9B490E7719985EE11

Uniqueness

Uniqueness Score: -1.00%

Function 00567931, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: b84b6a121cf0f51d6e3cf92bab568966932768a3cb60c8c4627a679860d705a8
Instruction ID: 1c1298cd39946d1936da0c20564a7615b57e9c414e36a7a1d2bded6ceb26e318
Opcode Fuzzy Hash: b84b6a121cf0f51d6e3cf92bab568966932768a3cb60c8c4627a679860d705a8
Instruction Fuzzy Hash: 6E11A52160D20DCDEB655AF4C1443AC3F97FF5D32CFA95596C89247160C3758AC9D642

Uniqueness

Uniqueness Score: -1.00%

Function 00564571, Relevance: 1.6, APIs: 1, Instructions: 53sleepnetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,37F4C3AA,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000000,?,00003000,00000004), ref: 0056457E
Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: InternetOpenSleep
String ID:
API String ID: 3820164841-0
Opcode ID: d59026787d5ad53b919a65066b099154c9d9e7a9cbe8b5e27fd8633be28c7a78
Instruction ID: 7f73e6b1f082ec187120e62316e86eb356278ae481c5a8c2a0639fe1f1b878c5
Opcode Fuzzy Hash: d59026787d5ad53b919a65066b099154c9d9e7a9cbe8b5e27fd8633be28c7a78
Instruction Fuzzy Hash: 02118E70104387DFDF348E14CD54BFE3A64BF16380F208525ED0B9B491E7314945AE11

Uniqueness

Uniqueness Score: -1.00%

Function 00567965, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: c93983357c6fad08353cac6ac325b1fec2df3d946188ad328365e690c639ea23
Instruction ID: 4cadaa956fed7cfe2a49c2500c10dca9ea1788aa5504a6a6264b348fade03e43
Opcode Fuzzy Hash: c93983357c6fad08353cac6ac325b1fec2df3d946188ad328365e690c639ea23
Instruction Fuzzy Hash: 9901B135A0D20CCDEB655AF4C0093AC3EA3FF5D32CF6A558AC8914B064C3758AC9CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00567999, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a6b5bcf16903f73f588c799ed76d3f68a1d4c9745637b877421d892582f008d6
Instruction ID: bc6f5f96bd60e2d3c5144a918e2ebf447c16a75ecaaf17bf137d5a09ed60fb33
Opcode Fuzzy Hash: a6b5bcf16903f73f588c799ed76d3f68a1d4c9745637b877421d892582f008d6
Instruction Fuzzy Hash: C5F0C22560D21DCDEB695AF4C0053BC2EA3FF1E31CFA9058AC8924B064C3318BC9C782

Uniqueness

Uniqueness Score: -1.00%

Function 005658AD, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8fa1393a94b17e49a9a0f5a21007ca895511238613f7b20d37fad03c684d3638
Instruction ID: 3ae91c11072ad0ab0bb47bb6954d71befae460a2213cc20125bd9668a549bf9d
Opcode Fuzzy Hash: 8fa1393a94b17e49a9a0f5a21007ca895511238613f7b20d37fad03c684d3638
Instruction Fuzzy Hash: 8EF0E9A00C8E67E6DF213660D5157BD3C10BF903B0FB00D16FD8387946F2104884E653

Uniqueness

Uniqueness Score: -1.00%

Function 005679DD, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 83e15d8b0c0e887d9c45de978cf4a94caaea658f487865a6e28e3cf7960ea34d
Instruction ID: 203bc0d4d3b6af3f3e2543b52cc2a71de2126b832dfbd5ab668431215abda502
Opcode Fuzzy Hash: 83e15d8b0c0e887d9c45de978cf4a94caaea658f487865a6e28e3cf7960ea34d
Instruction Fuzzy Hash: D7F0E52974D21D8CA61A5AF8C1053AC2E23FD0E31C39D06898C928B568D3214EC5C742

Uniqueness

Uniqueness Score: -1.00%

Function 005658ED, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 710e48802b149e9a3862f02aa31e58570e1651154740ddc2ab7b1ef822dea3e6
Instruction ID: 389671df65398d6d4f51792752fc8489407841d425afda3808d3ea2c1b5b5dc6
Opcode Fuzzy Hash: 710e48802b149e9a3862f02aa31e58570e1651154740ddc2ab7b1ef822dea3e6
Instruction Fuzzy Hash: EDE06DA01C8E6AE6DF2236A09529BBD3D11BF807B0FA05E1AFD9387502B2154884DA53

Uniqueness

Uniqueness Score: -1.00%

Function 005679CD, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 01b69e81f4acd4c94ca05c148c48bd438827b719164c8fb0c6f060ce1144de67
Instruction ID: c8cf6722ed7e529f7c78235b07e578bb525a3f674c36d2edda2d9bb51349f55f
Opcode Fuzzy Hash: 01b69e81f4acd4c94ca05c148c48bd438827b719164c8fb0c6f060ce1144de67
Instruction Fuzzy Hash: 68F0ED2570E21D8CAB1A5AF8C1153BD2E53FC0E31C3ED0A8ACCA28B128D3224AC5D342

Uniqueness

Uniqueness Score: -1.00%

Function 00567A0D, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: b2833be805436306a038c850618f7df1de967e23a01dcd03b0d1d59d8104bf80
Instruction ID: 2a04e1a0ac115c82b775ca51f3e0616387b82972a1e21b806904b6c1cdadd268
Opcode Fuzzy Hash: b2833be805436306a038c850618f7df1de967e23a01dcd03b0d1d59d8104bf80
Instruction Fuzzy Hash: FAE0862570D65D8CAB6A9AF8C4543BC2E23FD5A71C3DD02C9CD928B528D3214BC5C741

Uniqueness

Uniqueness Score: -1.00%

Function 0056589B, Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 052f57311e0aae8fe9215ff7477eb6f334dcffe2379f88a03734f03c39b61ce7
Instruction ID: f9bd9db630f7f1cde258cf738dd6c4c614ccf79fcf358373505b2e82e7b7aa53
Opcode Fuzzy Hash: 052f57311e0aae8fe9215ff7477eb6f334dcffe2379f88a03734f03c39b61ce7
Instruction Fuzzy Hash: 6BD01290089D52E6EB10365469457BB1D157F907F1FB44905B94747506B2124845E562

Uniqueness

Uniqueness Score: -1.00%

Function 00567A31, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7ffac4ee1208adb0560e43b426cb4340cbf6aa1b5388566ce097cef79712b432
Instruction ID: a3552a7f1b75b5ba7566c28d56a10224db94d1aa4252a450ea80d3ffbf5762e8
Opcode Fuzzy Hash: 7ffac4ee1208adb0560e43b426cb4340cbf6aa1b5388566ce097cef79712b432
Instruction Fuzzy Hash: 9AD05E297181199CAA0B9AF8C5062AC3D23FE9C30C396419888110791CD3214AC5CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00565935, Relevance: 1.5, APIs: 1, Instructions: 21libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f7c3954c733f5ccb8ddc2cc2de0bdc3625b117f3cdbaee9dff035afe1802dfdf
Instruction ID: 8183da147a18f061d728ba994ad33659d7e7e06b35f40e2127b84fb1f956daeb
Opcode Fuzzy Hash: f7c3954c733f5ccb8ddc2cc2de0bdc3625b117f3cdbaee9dff035afe1802dfdf
Instruction Fuzzy Hash: 33D05B70184E15D79F122AA455153FE2E11BF847B0F644E16BD5347406F2210485DA52

Uniqueness

Uniqueness Score: -1.00%

Function 00565949, Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 47c0140281197cd36b6a20bee54d19406c0ea0f14315466bd6db44fb6ab3e250
Instruction ID: 418a650693677f5838a7f21f705a3f283d2a45de68cf211a6780e7b34f3708ac
Opcode Fuzzy Hash: 47c0140281197cd36b6a20bee54d19406c0ea0f14315466bd6db44fb6ab3e250
Instruction Fuzzy Hash: 79D0A770184F26D7DB022AB4A5063FE3E00BF807F0F248D11BD934B406F2210485DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00565969, Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000), ref: 00565999

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d22f0f3e34e23aa91cda10490097f2dacbb3020294e8d84bc6a1777f2a104c3
Instruction ID: 54e480136988827211d45334bd00c22622c76c39b8d6cbbd5389178e93aafea4
Opcode Fuzzy Hash: 8d22f0f3e34e23aa91cda10490097f2dacbb3020294e8d84bc6a1777f2a104c3
Instruction Fuzzy Hash: 34C01220185A26D7D71225A4A5063E92E116F807F1F504901BD528B146F31244469592

Uniqueness

Uniqueness Score: -1.00%

Function 00567A51, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00567A5B

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 04ee4f1e1eb9107f7696499e5678c889bfe5fe12e98cc66f28f54dcb02bbbd38
Instruction ID: 9b6a91a7c7d8a269a1d4bd9051455eb6c2a5c1b1b4d2260f69f00e823100523b
Opcode Fuzzy Hash: 04ee4f1e1eb9107f7696499e5678c889bfe5fe12e98cc66f28f54dcb02bbbd38
Instruction Fuzzy Hash: 24C0803D5546384DDE4FDEF4D55631C3D32ED8410C31142DCC4215754CC3319A854E85

Uniqueness

Uniqueness Score: -1.00%

Function 00563E4E, Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00560246,80000000,00000001,00000000,00000003,00000000,00000000,00563DE7,00563EAC,00560736,?,00000000,?,?,?,?), ref: 00563E8A

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e9b2e3f63c7e7be0d3e0fcb64c1e600f8cc2c744fda65946740161a7d7b6a876
Instruction ID: ab56df36449588c8179effab9b13bffbbb7216da8ea5fd9dd42dd218810c5c8d
Opcode Fuzzy Hash: e9b2e3f63c7e7be0d3e0fcb64c1e600f8cc2c744fda65946740161a7d7b6a876
Instruction Fuzzy Hash: 16D08C32BE4301FAFF3086808C56F9526196B81F00F30490A3B463E0C042F22B90D63A

Uniqueness

Uniqueness Score: -1.00%

Function 00564751, Relevance: 1.3, APIs: 1, Instructions: 4sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,00000000,?,00003000,00000004,?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 00564758

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9986f8f41621d605700c358e62eedd8af760933c4d0149040f6ad5543e2b08dc
Instruction ID: 734fb494e62367aa783316c28ff5bd6ae9f58b22e7f4266514138227a77d5743
Opcode Fuzzy Hash: 9986f8f41621d605700c358e62eedd8af760933c4d0149040f6ad5543e2b08dc
Instruction Fuzzy Hash: FAA00220685384DBFF6E1F57889AFBD3926AFC0B06F548518A90B590C08F608A005922

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005676CD, Relevance: 1.3, Strings: 1, Instructions: 3COMMON

Download Yara Rule

Strings

J_Z, xrefs: 005676CE

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID: J_Z
API String ID: 0-2350762095
Opcode ID: 4c6e23532ee893dbaab8f7343a1da5d71fc257e321668ca8955d8ad2964582cc
Instruction ID: 5fd1908e5c7d57dac52b80f2df20902650227d8d95f72cebd43cda1acc5214d5
Opcode Fuzzy Hash: 4c6e23532ee893dbaab8f7343a1da5d71fc257e321668ca8955d8ad2964582cc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00566B77, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 57ef6a48cd29d71a050663b30c1702c1f92fe0da11c3d3fa6d59f41dd013ef2a
Instruction ID: b1d633ccb35ca2c9c9d9d2a51d963d5bb84ffd0cc6290ae348ef56abfbf62ce9
Opcode Fuzzy Hash: 57ef6a48cd29d71a050663b30c1702c1f92fe0da11c3d3fa6d59f41dd013ef2a
Instruction Fuzzy Hash: 70910A74A0C346CEDB24CF28C5D8725BFA1BF56324F24879AD9964B2DAD3318842D723

Uniqueness

Uniqueness Score: -1.00%

Function 0056295A, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5489cf28449f19200d7cf32ec78eb7b7bf66160567aaebd4190a59798016a498
Instruction ID: 9e4d8157ab9a9202d409498381e99b1a34c2666490000b834cacb01e1c193b1b
Opcode Fuzzy Hash: 5489cf28449f19200d7cf32ec78eb7b7bf66160567aaebd4190a59798016a498
Instruction Fuzzy Hash: BC412930648741DEEB206F94CD49BE57FA0BF44354F354A49FD965B1E2D7B08AC0EA12

Uniqueness

Uniqueness Score: -1.00%

Function 005626D3, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f86e37c587352aea1bc3267144e36b607c2d15134174f57ada69a2a1dd11286
Instruction ID: fcc61a8f4b37c47df417c9c5ae0a91c928535491882782f619c7afac82976d45
Opcode Fuzzy Hash: 4f86e37c587352aea1bc3267144e36b607c2d15134174f57ada69a2a1dd11286
Instruction Fuzzy Hash: 29310731648A06DFCB58AE18CC86FE57BA8FF51350F314629EC9993642CB259C89DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0056268A, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897cce2059d62a4b2fa170eb34ad20ed6bb24571146337b0e33b5d98efbf2b9a
Instruction ID: 0cdff455dd45e07668d729bb0eea30ccdfe851e078a98be153ed2bdb7f2d5b30
Opcode Fuzzy Hash: 897cce2059d62a4b2fa170eb34ad20ed6bb24571146337b0e33b5d98efbf2b9a
Instruction Fuzzy Hash: 73313A31248E02DFCB585A14CC56FF57B98FF51354F304A29FC9A93641CB159C89EB81

Uniqueness

Uniqueness Score: -1.00%

Function 0056298D, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5514375abdb068bd7bcf4bb33b9fb73b408c3179feb98fe7ba4597b02748db
Instruction ID: b78891a2798971828895e7a0b65dcb6b7e5c58d4dccde46b39f22b9498370c23
Opcode Fuzzy Hash: bb5514375abdb068bd7bcf4bb33b9fb73b408c3179feb98fe7ba4597b02748db
Instruction Fuzzy Hash: 2A213730248B01DEEB316F90CD9ABB53FA1BF44750F25495AFD865B0D2D7F18A84E512

Uniqueness

Uniqueness Score: -1.00%

Function 005629AD, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bdd77ea1e97c3830dd10288c015bb8c08c3541eee653bf24ffb5f6b42a2f71
Instruction ID: 17baa9154fbd922087b3731a6e1c4b8810cf59fe53ff28e8901a523b181f22e3
Opcode Fuzzy Hash: d6bdd77ea1e97c3830dd10288c015bb8c08c3541eee653bf24ffb5f6b42a2f71
Instruction Fuzzy Hash: A0210530688701EEEB306F90CD9AFA53FA1BF48754F25495AFD825B0D2D7F18A84E512

Uniqueness

Uniqueness Score: -1.00%

Function 00565FF1, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ee49069a18257741e8556ee1b7d674b6ff408b013d536ab192eb7f6b7aac83
Instruction ID: d751b142b001637b4c4568fcd2eb236afac5b4bb4f11ccce38d4a7713892b278
Opcode Fuzzy Hash: 56ee49069a18257741e8556ee1b7d674b6ff408b013d536ab192eb7f6b7aac83
Instruction Fuzzy Hash: 53F06274304212CFDB29D614C6ECB297E66BB55330F709BB9F9078B2A6D724DC80E611

Uniqueness

Uniqueness Score: -1.00%

Function 00566055, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e812243be4b739e95602873e03f1bf814ee1478a99a20580046eefd14edcf850
Instruction ID: cf705565eb8bddb073e73dc60792e9a72402fc89350ba159ddff13f2c2bdafd5
Opcode Fuzzy Hash: e812243be4b739e95602873e03f1bf814ee1478a99a20580046eefd14edcf850
Instruction Fuzzy Hash: B9E0C2B03042119FCA25DB18C6ECB2DBE60BB55330FA09FB9F442871A6CA70DCC0D616

Uniqueness

Uniqueness Score: -1.00%

Function 00563958, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb624ad7af90be466ced9aabaf9078419862f287f600131c6405b6c043e35fa2
Instruction ID: 5181d76aa38fdf93f27b2a823e28e34261243794430515677cf57cd4be8f232d
Opcode Fuzzy Hash: eb624ad7af90be466ced9aabaf9078419862f287f600131c6405b6c043e35fa2
Instruction Fuzzy Hash: 6BC048F62015818BFB01DA08C481B0077B0FB00648B040890E0028B612C264EA008A00

Uniqueness

Uniqueness Score: -1.00%

Function 0056583A, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a74a5d9c6f3315fa27d45ce55ac2211b521c0d7b083bfedbefbd46ed844b0c
Instruction ID: eac3d359cf8e0116945a49bf967d71f0558b84192faa2cdff901b79efbe8b6d6
Opcode Fuzzy Hash: 42a74a5d9c6f3315fa27d45ce55ac2211b521c0d7b083bfedbefbd46ed844b0c
Instruction Fuzzy Hash: 8EB09230254A40CFCA86CA09C6A0F4073B0BF44740F120890E8028BA51C328EC00CA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report DHL_Shipment_Notification#5436637389_22_FEB.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 7136 Parent PID: 5968

General