Play interactive tour

Edit tour

Analysis Report ST_PLC URGENT ORDER 0223308737,pdf.exe

Overview

General Information

Sample Name:	ST_PLC URGENT ORDER 0223308737,pdf.exe
Analysis ID:	356838
MD5:	49b05de1926be1ea5993874ad14c8d3a
SHA1:	92caf8d81c1cddab1e799d730b6f31b8820bdef5
SHA256:	f5a3420b7aa30f99c877d5a661625e37b79841f4bc99bd17a75d46eb86e4791d
Tags:	exeSnakeKeylogger
Infos:
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

PE file contains section with special chars

PE file has nameless sections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Startup

System is w10x64

ST_PLC URGENT ORDER 0223308737,pdf.exe (PID: 6256 cmdline: 'C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe' MD5: 49B05DE1926BE1EA5993874AD14C8D3A)

ST_PLC URGENT ORDER 0223308737,pdf.exe (PID: 5656 cmdline: {path} MD5: 49B05DE1926BE1EA5993874AD14C8D3A)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "info@endovision.xyzr)($czxJs0smtp.endovision.xyz"}}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.502527744.0000000000402000.00000040.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000009.00000002.502527744.0000000000402000.00000040.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.326366120.0000000003651000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000000.00000002.326366120.0000000003651000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 6256	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 6256	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 5656	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 5656	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 5656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.400000.0.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
9.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.326366120.0000000003651000.00000004.00000001.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "info@endovision.xyzr)($czxJs0smtp.endovision.xyz"}}

Multi AV Scanner detection for submitted file

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

ReversingLabs: Detection: 31%

Machine Learning detection for sample

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Joe Sandbox ML: detected

Source: 9.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.190000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3

Compliance:

Uses 32bit PE files

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.7:49726 version: TLS 1.0

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities:

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h		0_2_00BA1798
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h		0_2_00BA16F1

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View

IP Address: 216.146.43.70 216.146.43.70

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.7:49726 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509435893.00000000031FD000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/HB:l0A
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.orgD8ok
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240592808.0000000007CA5000.00000004.00000001.sdmp	String found in binary or memory: http://en.wU
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://freegeoip.app
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.323215970.0000000007CA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.t
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.241379781.0000000007CAA000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comits)
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.241183518.0000000007CDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comva
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.324374669.0000000000BD7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.324374669.0000000000BD7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comue
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240625033.0000000007CBB000.00000004.00000001.sdmp, ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240840157.0000000007CDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240789901.0000000007CDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240451930.0000000007CDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnC
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240625033.0000000007CBB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnn-u
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240625033.0000000007CBB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnold
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.240657129.0000000007CDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnv-s
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.333635479.0000000007D90000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000003.241159879.0000000007CDF000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnva
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.38
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.38x
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509245572.00000000031B1000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/LoadCountryNameClipboard
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app4okl
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509675871.000000000322C000.00000004.00000001.sdmp, ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509435893.00000000031FD000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.509508033.0000000003206000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: ST_PLC URGENT ORDER 0223308737,pdf.exe

PE file contains section with special chars

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: section name: qd?b#D

PE file has nameless sections

Show sources

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA24F0	0_2_00BA24F0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA2C61	0_2_00BA2C61
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA19B7	0_2_00BA19B7
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA4518	0_2_00BA4518
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA0509	0_2_00BA0509
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BAA6F0	0_2_00BAA6F0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA3639	0_2_00BA3639
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA68B8	0_2_00BA68B8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA54A0	0_2_00BA54A0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA5491	0_2_00BA5491
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA68C8	0_2_00BA68C8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA4431	0_2_00BA4431
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA244F	0_2_00BA244F
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA6D40	0_2_00BA6D40
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA66B0	0_2_00BA66B0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA66C0	0_2_00BA66C0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA43F9	0_2_00BA43F9
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA43D5	0_2_00BA43D5
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA6B30	0_2_00BA6B30
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_00BA6B40	0_2_00BA6B40
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A3258	0_2_023A3258
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023AA298	0_2_023AA298
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A0E50	0_2_023A0E50
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023AA5B0	0_2_023AA5B0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A63D8	0_2_023A63D8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A28D8	0_2_023A28D8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023AB958	0_2_023AB958
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023AB949	0_2_023AB949
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A0E40	0_2_023A0E40
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A1680	0_2_023A1680
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023AA5A0	0_2_023AA5A0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023B6130	0_2_023B6130
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023B611F	0_2_023B611F
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_016281B0	9_2_016281B0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_01620582	9_2_01620582
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0162B2B0	9_2_0162B2B0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_01627B89	9_2_01627B89
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_01624630	9_2_01624630
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_01621039	9_2_01621039
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_01621552	9_2_01621552
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_016259E0	9_2_016259E0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06838E88	9_2_06838E88
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_068386A0	9_2_068386A0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06837EB8	9_2_06837EB8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_068376D0	9_2_068376D0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06836EE8	9_2_06836EE8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683B610	9_2_0683B610
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683CE20	9_2_0683CE20
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683AE28	9_2_0683AE28
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683C638	9_2_0683C638
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683A640	9_2_0683A640
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06839E58	9_2_06839E58
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06839670	9_2_06839670
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06835780	9_2_06835780
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06834F98	9_2_06834F98
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_068347B0	9_2_068347B0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06833FC8	9_2_06833FC8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_068337E0	9_2_068337E0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683D7E0	9_2_0683D7E0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06832FF8	9_2_06832FF8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06836700	9_2_06836700
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06835F68	9_2_06835F68
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683BDF8	9_2_0683BDF8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683F0F8	9_2_0683F0F8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06830040	9_2_06830040
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683E980	9_2_0683E980
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683E1D0	9_2_0683E1D0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06836ED7	9_2_06836ED7
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06839612	9_2_06839612
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06838E29	9_2_06838E29
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06838640	9_2_06838640
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06837E5A	9_2_06837E5A
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06837670	9_2_06837670
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06833781	9_2_06833781
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683D7D0	9_2_0683D7D0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06832FE8	9_2_06832FE8
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06835F08	9_2_06835F08
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06835721	9_2_06835721
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06834F38	9_2_06834F38
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06836750	9_2_06836750
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06834750	9_2_06834750
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06833F68	9_2_06833F68
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683C589	9_2_0683C589
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683BD99	9_2_0683BD99
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683B5B2	9_2_0683B5B2
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683CDC0	9_2_0683CDC0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683ADC9	9_2_0683ADC9
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683A5E0	9_2_0683A5E0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06839DF9	9_2_06839DF9
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683F098	9_2_0683F098
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683E8D0	9_2_0683E8D0
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_06830007	9_2_06830007
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 9_2_0683E180	9_2_0683E180

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.325052772.00000000026AB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameGALJS2L7.exe4 vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000000.233357926.00000000001FE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameY vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000000.00000002.324869005.0000000002651000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.503626683.0000000000C6E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameY vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.503246705.0000000000466000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameGALJS2L7.exe4 vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.503854673.00000000010F6000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ST_PLC URGENT ORDER 0223308737,pdf.exe
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe	Binary or memory string: OriginalFilenameY vs ST_PLC URGENT ORDER 0223308737,pdf.exe

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: Section: qd?b#D ZLIB complexity 1.00040910051

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ST_PLC URGENT ORDER 0223308737,pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe 'C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe {path}
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process created: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000009.00000002.502527744.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.326366120.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 6256, type: MEMORY
Source: Yara match	File source: Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 5656, type: MEMORY
Source: Yara match	File source: 9.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.raw.unpack, type: UNPACKEDPE

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe	Static PE information: section name: qd?b#D
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023A9556 push A4E94827h; iretd	0_2_023A955D
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023BE39D push FFFFFF8Bh; iretd	0_2_023BE39F
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023B6E4E push ebp; ret	0_2_023B6E58
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Code function: 0_2_023B6F19 push FFFFFF8Bh; iretd	0_2_023B6F1E

Source: initial sample	Static PE information: section name: qd?b#D entropy: 7.99769775695
Source: initial sample	Static PE information: section name: .text entropy: 7.94788728273

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000009.00000002.502527744.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.326366120.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 6256, type: MEMORY
Source: Yara match	File source: Process Memory Space: ST_PLC URGENT ORDER 0223308737,pdf.exe PID: 5656, type: MEMORY
Source: Yara match	File source: 9.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ST_PLC URGENT ORDER 0223308737,pdf.exe.36fb770.3.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe TID: 6292	Thread sleep time: -45000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe TID: 6280	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Code function: 0_2_00BA1798 CheckRemoteDebuggerPresent,

0_2_00BA1798

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Code function: 9_2_06832D50 LdrInitializeThunk,

9_2_06832D50

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Memory written: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe

Process created: C:\Users\user\Desktop\ST_PLC URGENT ORDER 0223308737,pdf.exe {path}

Jump to behavior

Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.507743136.0000000001A00000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000009.00000002.507743136.0000000001A00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ST_PLC URGENT ORDER 0223308737,pdf.exe, 00000

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report ST_PLC URGENT ORDER 0223308737,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Snake Keylogger

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion: