Play interactive tour

Edit tour

Analysis Report Delivery 9073782912,pdf.exe

Overview

General Information

Sample Name:	Delivery 9073782912,pdf.exe
Analysis ID:	356845
MD5:	8b22f061055264b77361c6fe7941e25f
SHA1:	8251185b5bc6cb83e99139a7e480541a0363bc43
SHA256:	7fbc2450a78cb9a8b033dd654c2b2378a7e9f3ea7f89bd0db57f907685a2c4cf
Tags:	DHLexeSnakeKeylogger
Infos:
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

PE file contains section with special chars

PE file has nameless sections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Startup

System is w10x64

Delivery 9073782912,pdf.exe (PID: 6980 cmdline: 'C:\Users\user\Desktop\Delivery 9073782912,pdf.exe' MD5: 8B22F061055264B77361C6FE7941E25F)

Delivery 9073782912,pdf.exe (PID: 6880 cmdline: {path} MD5: 8B22F061055264B77361C6FE7941E25F)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "info@3ptechnik.xyzgF*BS#rb4smtp.3ptechnik.xyz"}}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.Delivery 9073782912,pdf.exe.400000.0.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
8.2.Delivery 9073782912,pdf.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "info@3ptechnik.xyzgF*BS#rb4smtp.3ptechnik.xyz"}}

Multi AV Scanner detection for submitted file

Show sources

Source: Delivery 9073782912,pdf.exe

ReversingLabs: Detection: 27%

Machine Learning detection for sample

Show sources

Source: Delivery 9073782912,pdf.exe

Joe Sandbox ML: detected

Source: 8.2.Delivery 9073782912,pdf.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 0.2.Delivery 9073782912,pdf.exe.e10000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3

Compliance:

Uses 32bit PE files

Show sources

Source: Delivery 9073782912,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.4:49746 version: TLS 1.0

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Delivery 9073782912,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities:

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_031A1750
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0331AB94
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0331CB88
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0843D9E4
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_0843E5D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0843E5D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_0843E13C
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_0843E2AC
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0843E2AC
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_0843E2B8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0843E2B8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then xor edx, edx	0_2_0843E504
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then xor edx, edx	0_2_0843E510
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_0843E5CF
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_0843E5CF

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View

IP Address: 162.88.193.70 162.88.193.70

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.19.200:443 -> 192.168.2.4:49746 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/HB&lTN
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org4Sk
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.orgD8Sk
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.651697965.000000000896B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comM
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.651697965.000000000896B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comh
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://freegeoip.app
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.654071949.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.654071949.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comscr
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655756100.000000000898E000.00000004.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655604692.000000000898E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655879593.0000000008958000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655913964.000000000898E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.660621776.000000000898B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersS
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.656437070.000000000898E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersX
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.653160870.000000000898D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cndd
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krN.TTF
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krs-e
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Delivery 9073782912,pdf.exe, 00000000.00000003.652165341.0000000008952000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comnm
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.38
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.38x
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/LoadCountryNameClipboard
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app4Sk
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000008.00000002.912571847.0000000002CD2000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

System Summary:

PE file contains section with special chars

Show sources

Source: Delivery 9073782912,pdf.exe

Static PE information: section name: **!@q|@

PE file has nameless sections

Show sources

Source: Delivery 9073782912,pdf.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A0500	0_2_031A0500
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A4500	0_2_031A4500
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A2C28	0_2_031A2C28
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A3628	0_2_031A3628
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A24D8	0_2_031A24D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A30C0	0_2_031A30C0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A5408	0_2_031A5408
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_031A1980	0_2_031A1980
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_03312240	0_2_03312240
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0331AB4C	0_2_0331AB4C
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_03312230	0_2_03312230
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0331A0B0	0_2_0331A0B0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0331A0A0	0_2_0331A0A0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_033180E4	0_2_033180E4
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0331C0D8	0_2_0331C0D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_08434944	0_2_08434944
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_08434864	0_2_08434864
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0843EC28	0_2_0843EC28
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_0843EC38	0_2_0843EC38
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_010381B0	8_2_010381B0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_01030580	8_2_01030580
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_0103B2B0	8_2_0103B2B0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_01037B89	8_2_01037B89
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_01034630	8_2_01034630
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_01030BE0	8_2_01030BE0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_010310F8	8_2_010310F8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_01031612	8_2_01031612
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_010359E0	8_2_010359E0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D0EF8	8_2_061D0EF8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D37F0	8_2_061D37F0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D3FF0	8_2_061D3FF0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D47F0	8_2_061D47F0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D4FF0	8_2_061D4FF0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D1C50	8_2_061D1C50
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DF4D8	8_2_061DF4D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D0040	8_2_061D0040
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D08A8	8_2_061D08A8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DE960	8_2_061DE960
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D0E99	8_2_061D0E99
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D4790	8_2_061D4790
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D4F90	8_2_061D4F90
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D3F92	8_2_061D3F92
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D37E0	8_2_061D37E0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DF478	8_2_061DF478
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D3465	8_2_061D3465
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D0006	8_2_061D0006
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061D7932	8_2_061D7932
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F0040	8_2_061F0040
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F40D8	8_2_061F40D8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F0828	8_2_061F0828
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F48C0	8_2_061F48C0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F2970	8_2_061F2970
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F17F8	8_2_061F17F8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F1010	8_2_061F1010
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F3158	8_2_061F3158
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F1FE0	8_2_061F1FE0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F3940	8_2_061F3940
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F07C8	8_2_061F07C8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F0006	8_2_061F0006
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F4128	8_2_061F4128
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F0FB0	8_2_061F0FB0
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F48B1	8_2_061F48B1
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F290F	8_2_061F290F
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F1798	8_2_061F1798
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F30F8	8_2_061F30F8
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061F1F81	8_2_061F1F81

Source: Delivery 9073782912,pdf.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Delivery 9073782912,pdf.exe, 00000000.00000000.645678736.0000000000E97000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.737404793.00000000033B1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe, 00000000.00000002.737404793.00000000033B1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename45ZFWF8N.exe4 vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.910914612.0000000000B56000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.910706029.0000000000466000.00000040.00000001.sdmp	Binary or memory string: OriginalFilename45ZFWF8N.exe4 vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.910852766.00000000007A7000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs Delivery 9073782912,pdf.exe
Source: Delivery 9073782912,pdf.exe	Binary or memory string: OriginalFilename vs Delivery 9073782912,pdf.exe

Source: Delivery 9073782912,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Delivery 9073782912,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Delivery 9073782912,pdf.exe

Static PE information: Section: **!@q|@ ZLIB complexity 1.00040635487

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Delivery 9073782912,pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Delivery 9073782912,pdf.exe

ReversingLabs: Detection: 27%

Source: Delivery 9073782912,pdf.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: Delivery 9073782912,pdf.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: Delivery 9073782912,pdf.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: Delivery 9073782912,pdf.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail

Source: unknown	Process created: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe 'C:\Users\user\Desktop\Delivery 9073782912,pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe {path}
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process created: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Delivery 9073782912,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Delivery 9073782912,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 8.2.Delivery 9073782912,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack, type: UNPACKEDPE

Source: Delivery 9073782912,pdf.exe	Static PE information: section name: **!@q\|@
Source: Delivery 9073782912,pdf.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_03317C98 push esp; ret	0_2_03317C99
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 0_2_084325E0 pushad ; ret	0_2_084325E1
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DBC05 push 8B000003h; iretd	8_2_061DBC0C
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DB507 push es; iretd	8_2_061DB604
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Code function: 8_2_061DB0D0 pushfd ; iretd	8_2_061DB0D1

Source: initial sample	Static PE information: section name: **!@q\|@ entropy: 7.99766880008
Source: initial sample	Static PE information: section name: .text entropy: 7.94676615922

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 8.2.Delivery 9073782912,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Code function: 8_2_061D3465 rdtsc

8_2_061D3465

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe TID: 7028	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe TID: 7016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe TID: 7028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Code function: 0_2_031A1750 CheckRemoteDebuggerPresent,

0_2_031A1750

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Code function: 8_2_061D3465 rdtsc

8_2_061D3465

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Code function: 8_2_061D1C50 LdrInitializeThunk,KiUserExceptionDispatcher,

8_2_061D1C50

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Memory written: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Process created: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe {path}

Jump to behavior

Source: Delivery 9073782912,pdf.exe, 00000008.00000002.911703112.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.911703112.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.911703112.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Delivery 9073782912,pdf.exe, 00000008.00000002.911703112.00000000014E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 8.2.Delivery 9073782912,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880, type: MEMORY

Remote Access Functionality:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6880, type: MEMORY
Source: Yara match	File source: Process Memory Space: Delivery 9073782912,pdf.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 8.2.Delivery 9073782912,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.4f22e08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Delivery 9073782912,pdf.exe.50dbcb8.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping1	Security Software Discovery12	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion3	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	System Network Configuration Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing4	Cached Domain Credentials	System Information Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Delivery 9073782912,pdf.exe	28%	ReversingLabs	Win32.Trojan.AgentTesla
Delivery 9073782912,pdf.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
8.2.Delivery 9073782912,pdf.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen		Download File
0.2.Delivery 9073782912,pdf.exe.e10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3		Download File

Domains

Source	Detection	Scanner	Label	Link
freegeoip.app	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://freegeoip.app	0%	URL Reputation	safe
https://freegeoip.app	0%	URL Reputation	safe
https://freegeoip.app	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.tiro.comnm	0%	Avira URL Cloud	safe
http://fontfabrik.comM	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.sandoll.co.krs-e	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://www.carterandcone.comscr	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
http://fontfabrik.comh	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://freegeoip.app	0%	URL Reputation	safe
http://freegeoip.app	0%	URL Reputation	safe
http://freegeoip.app	0%	URL Reputation	safe
https://freegeoip.app/xml/	0%	URL Reputation	safe
https://freegeoip.app/xml/	0%	URL Reputation	safe
https://freegeoip.app/xml/	0%	URL Reputation	safe
http://checkip.dyndns.orgD8Sk	0%	Avira URL Cloud	safe
https://freegeoip.app4Sk	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://www.sandoll.co.krN.TTF	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/84.17.52.38x	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.38x	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.38x	0%	URL Reputation	safe
https://freegeoip.app/xml/LoadCountryNameClipboard	0%	URL Reputation	safe
https://freegeoip.app/xml/LoadCountryNameClipboard	0%	URL Reputation	safe
https://freegeoip.app/xml/LoadCountryNameClipboard	0%	URL Reputation	safe
http://www.founder.com.cn/cndd	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://checkip.dyndns.org/HB&lTN	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.38	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.38	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.38	0%	URL Reputation	safe
http://checkip.dyndns.org4Sk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
freegeoip.app	104.21.19.200	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.com	162.88.193.70	true	false		unknown
checkip.dyndns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
https://freegeoip.app	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersX	Delivery 9073782912,pdf.exe, 00000000.00000003.656437070.000000000898E000.00000004.00000001.sdmp	false		high
http://www.tiro.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655756100.000000000898E000.00000004.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655604692.000000000898E000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	Delivery 9073782912,pdf.exe, 00000000.00000003.654071949.0000000008956000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comnm	Delivery 9073782912,pdf.exe, 00000000.00000003.652165341.0000000008952000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.comM	Delivery 9073782912,pdf.exe, 00000000.00000003.651697965.000000000896B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersS	Delivery 9073782912,pdf.exe, 00000000.00000003.660621776.000000000898B000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sandoll.co.krs-e	Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comscr	Delivery 9073782912,pdf.exe, 00000000.00000003.654071949.0000000008956000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false		high
http://www.fonts.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.com	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.comh	Delivery 9073782912,pdf.exe, 00000000.00000003.651697965.000000000896B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://freegeoip.app	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://freegeoip.app/xml/	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://checkip.dyndns.orgD8Sk	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://freegeoip.app4Sk	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.krN.TTF	Delivery 9073782912,pdf.exe, 00000000.00000003.652561133.0000000008956000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://freegeoip.app/xml/84.17.52.38x	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://freegeoip.app/xml/LoadCountryNameClipboard	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cndd	Delivery 9073782912,pdf.exe, 00000000.00000003.653160870.000000000898D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655879593.0000000008958000.00000004.00000001.sdmp	false		high
http://checkip.dyndns.org/HB&lTN	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Delivery 9073782912,pdf.exe, 00000000.00000002.746308507.0000000008B10000.00000002.00000001.sdmp, Delivery 9073782912,pdf.exe, 00000000.00000003.655913964.000000000898E000.00000004.00000001.sdmp	false		high
https://freegeoip.app/xml/84.17.52.38	Delivery 9073782912,pdf.exe, 00000008.00000002.912516195.0000000002CA4000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.org4Sk	Delivery 9073782912,pdf.exe, 00000008.00000002.912423524.0000000002BF1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.88.193.70	unknown	United States		33517	DYNDNSUS	false
104.21.19.200	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356845
Start date:	23.02.2021
Start time:	17:45:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Delivery 9073782912,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.8% (good quality ratio 0.2%) Quality average: 18.8% Quality standard deviation: 31.6%
HCA Information:	Successful, ratio: 95% Number of executed functions: 49 Number of non-executed functions: 15
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 204.79.197.200, 13.107.21.200, 104.42.151.234, 23.211.6.115, 13.88.21.125, 104.43.139.144, 51.104.139.180, 2.20.142.209, 2.20.142.210, 52.155.217.156, 20.54.26.129, 92.122.213.194, 92.122.213.247, 51.11.168.160 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:46:33	API Interceptor	1x Sleep call for process: Delivery 9073782912,pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.88.193.70	P00760000.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Order.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	FOB offer_1164087223_I0133P2100363812.PDF.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	purchase order 1.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	telex transfer.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	GPP.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	#11032019 de investigaci#U00f3n de #U00f3rdenes,pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Neue Bestellung_WJO-001, pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	swift payment.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	Order.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Order.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PURCHASE ORDER.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	telex transfer.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	ORDEN DE COMPRA.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	banka bilgisi.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	purchase order.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	XXXXXXXXXXXXXX.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	170221.exe	Get hash	malicious	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
freegeoip.app	PO202100046.exe	Get hash	malicious	Browse	172.67.188.154
	SSGLPOJ6212202.exe	Get hash	malicious	Browse	104.21.19.200
	ST_PLC URGENT ORDER 0223308737,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	P00760000.exe	Get hash	malicious	Browse	104.21.19.200
	Order.doc	Get hash	malicious	Browse	104.21.19.200
	QUOTE.doc	Get hash	malicious	Browse	104.21.19.200
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	purchase order.exe	Get hash	malicious	Browse	104.21.19.200
	9073782912,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	IMG_57109_Scanned.doc	Get hash	malicious	Browse	104.21.19.200
	Purchase Order.exe	Get hash	malicious	Browse	104.21.19.200
	dot crypted.exe	Get hash	malicious	Browse	104.21.19.200
	v2.exe	Get hash	malicious	Browse	172.67.188.154
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	172.67.188.154
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	172.67.188.154
	FOB offer_1164087223_I0133P2100363812.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse	172.67.188.154
	Yao Han Industries 61007-51333893QR001U,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	(appproved)WJO-TT180,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	purchase order.exe	Get hash	malicious	Browse	172.67.188.154
checkip.dyndns.com	PO202100046.exe	Get hash	malicious	Browse	131.186.113.70
	SSGLPOJ6212202.exe	Get hash	malicious	Browse	216.146.43.70
	ST_PLC URGENT ORDER 0223308737,pdf.exe	Get hash	malicious	Browse	216.146.43.70
	P00760000.exe	Get hash	malicious	Browse	162.88.193.70
	Order.doc	Get hash	malicious	Browse	131.186.113.70
	QUOTE.doc	Get hash	malicious	Browse	216.146.43.70
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	162.88.193.70
	purchase order.exe	Get hash	malicious	Browse	131.186.113.70
	9073782912,pdf.exe	Get hash	malicious	Browse	216.146.43.70
	IMG_57109_Scanned.doc	Get hash	malicious	Browse	131.186.113.70
	Purchase Order.exe	Get hash	malicious	Browse	131.186.113.70
	dot crypted.exe	Get hash	malicious	Browse	131.186.113.70
	v2.exe	Get hash	malicious	Browse	131.186.113.70
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	216.146.43.71
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	162.88.193.70
	FOB offer_1164087223_I0133P2100363812.PDF.exe	Get hash	malicious	Browse	162.88.193.70
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse	131.186.113.70
	Yao Han Industries 61007-51333893QR001U,pdf.exe	Get hash	malicious	Browse	131.186.113.70
	(appproved)WJO-TT180,pdf.exe	Get hash	malicious	Browse	131.186.161.70
	purchase order.exe	Get hash	malicious	Browse	131.186.113.70

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.GenericKD.45695593.9197.exe	Get hash	malicious	Browse	172.67.199.58
	PO202100046.exe	Get hash	malicious	Browse	172.67.188.154
	SecuriteInfo.com.Trojan.GenericKD.45754886.17334.exe	Get hash	malicious	Browse	172.67.213.210
	SSGLPOJ6212202.exe	Get hash	malicious	Browse	172.67.188.154
	ST_PLC URGENT ORDER 0223308737,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Trojan.GenericKD.45695593.9197.exe	Get hash	malicious	Browse	172.67.199.58
	SecuriteInfo.com.Trojan.Siggen12.2497.1023.exe	Get hash	malicious	Browse	104.23.98.190
	1vuet1S3tI.exe	Get hash	malicious	Browse	172.67.199.58
	P00760000.exe	Get hash	malicious	Browse	104.21.19.200
	Order.doc	Get hash	malicious	Browse	104.21.19.200
	QUOTE.doc	Get hash	malicious	Browse	104.21.19.200
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	2070121_SN-WS.exe	Get hash	malicious	Browse	104.21.71.230
	purchase order.exe	Get hash	malicious	Browse	104.21.19.200
	9073782912,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	payment_advice.doc	Get hash	malicious	Browse	172.67.172.17
	IMG_57109_Scanned.doc	Get hash	malicious	Browse	172.67.188.154
	Purchase Order.exe	Get hash	malicious	Browse	104.21.19.200
	dot crypted.exe	Get hash	malicious	Browse	104.21.19.200
	New Order 2300030317388 InterMetro.exe	Get hash	malicious	Browse	172.67.172.17
DYNDNSUS	PO202100046.exe	Get hash	malicious	Browse	131.186.113.70
	SSGLPOJ6212202.exe	Get hash	malicious	Browse	216.146.43.71
	ST_PLC URGENT ORDER 0223308737,pdf.exe	Get hash	malicious	Browse	216.146.43.70
	P00760000.exe	Get hash	malicious	Browse	162.88.193.70
	Order.doc	Get hash	malicious	Browse	162.88.193.70
	QUOTE.doc	Get hash	malicious	Browse	216.146.43.70
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	162.88.193.70
	purchase order.exe	Get hash	malicious	Browse	131.186.113.70
	9073782912,pdf.exe	Get hash	malicious	Browse	216.146.43.70
	IMG_57109_Scanned.doc	Get hash	malicious	Browse	131.186.113.70
	Purchase Order.exe	Get hash	malicious	Browse	131.186.113.70
	dot crypted.exe	Get hash	malicious	Browse	131.186.113.70
	v2.exe	Get hash	malicious	Browse	131.186.113.70
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	216.146.43.71
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	162.88.193.70
	FOB offer_1164087223_I0133P2100363812.PDF.exe	Get hash	malicious	Browse	162.88.193.70
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse	131.186.113.70
	Yao Han Industries 61007-51333893QR001U,pdf.exe	Get hash	malicious	Browse	131.186.113.70
	(appproved)WJO-TT180,pdf.exe	Get hash	malicious	Browse	131.186.161.70
	purchase order.exe	Get hash	malicious	Browse	131.186.113.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PO202100046.exe	Get hash	malicious	Browse	104.21.19.200
	SSGLPOJ6212202.exe	Get hash	malicious	Browse	104.21.19.200
	ST_PLC URGENT ORDER 0223308737,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Trojan.Siggen12.2497.1023.exe	Get hash	malicious	Browse	104.21.19.200
	P00760000.exe	Get hash	malicious	Browse	104.21.19.200
	Shipment Notification 6368638172.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	purchase order.exe	Get hash	malicious	Browse	104.21.19.200
	9073782912,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Purchase Order.exe	Get hash	malicious	Browse	104.21.19.200
	dot crypted.exe	Get hash	malicious	Browse	104.21.19.200
	v2.exe	Get hash	malicious	Browse	104.21.19.200
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	104.21.19.200
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	104.21.19.200
	FOB offer_1164087223_I0133P2100363812.PDF.exe	Get hash	malicious	Browse	104.21.19.200
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse	104.21.19.200
	Yao Han Industries 61007-51333893QR001U,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	(appproved)WJO-TT180,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	purchase order.exe	Get hash	malicious	Browse	104.21.19.200
	9073782912,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	SOS URGENT RFQ #2345.exe	Get hash	malicious	Browse	104.21.19.200

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Delivery 9073782912,pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Delivery 9073782912,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:ML9E4Ks29E4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MxHKX9HKx1qHiYHKhQnoPtHoxHhAHKzr
MD5:	B666A4404B132B2BF6C04FBF848EB948
SHA1:	D2EFB3D43F8B8806544D3A47F7DAEE8534981739
SHA-256:	7870616D981C8C0DE9A54E7383CD035470DB20CBF75ACDF729C32889D4B6ED96
SHA-512:	00E955EE9F14CEAE07E571A8EF2E103200CF421BAE83A66ED9F9E1AA6A9F449B653EDF1BFDB662A364D58ECF9B5FE4BB69D590DB2653F2F46A09F4D47719A862
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.542462273711499
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Delivery 9073782912,pdf.exe
File size:	635392
MD5:	8b22f061055264b77361c6fe7941e25f
SHA1:	8251185b5bc6cb83e99139a7e480541a0363bc43
SHA256:	7fbc2450a78cb9a8b033dd654c2b2378a7e9f3ea7f89bd0db57f907685a2c4cf
SHA512:	ed21a8a43265cdd8d0bcb72cb02b54e13542e26f81261996c837ca092a18ed89b5394cc674e099008d06f25357c6ac61519c135216b95b4ef24971d26220bc33
SSDEEP:	12288:pReF1EYoHSRA26BqSSF2EuYiNnZUkRobfzl6sI/jklzAKp:pUo3ZCbw/jklDp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.5`..............0..j...D....... ...`... ....@.. .......................@............@................................

File Icon


Icon Hash:	8604a4acbcace4f8

Static PE Info

General
Entrypoint:	0x4a200a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6035023B [Tue Feb 23 13:25:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004A2000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16948	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x31708	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa2000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x16000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
**!@q\|@	0x2000	0x12968	0x12a00	False	1.00040635487	data	7.99766880008	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.text	0x16000	0x56638	0x56800	False	0.934793284863	data	7.94676615922	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x31708	0x31800	False	0.430836687184	data	5.93363370804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0xa2000	0x10	0x200	False	0.044921875	data	0.142635768149	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x6e2b0	0x96b5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x77968	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x88190	0x94a8	data
RT_ICON	0x91638	0x5488	data
RT_ICON	0x96ac0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x9ace8	0x25a8	data
RT_ICON	0x9d290	0x10a8	data
RT_ICON	0x9e338	0x988	data
RT_ICON	0x9ecc0	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x9f128	0x84	data
RT_VERSION	0x9f1ac	0x36c	data
RT_MANIFEST	0x9f518	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Neudesic 2017
Assembly Version	1.0.0.0
InternalName	ihwC.exe
FileVersion	1.0.0.0
CompanyName	Neudesic
LegalTrademarks
Comments
ProductName	VectorBasedDrawing
ProductVersion	1.0.0.0
FileDescription	VectorBasedDrawing
OriginalFilename	ihwC.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:47:10.385010958 CET	49742	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:10.514962912 CET	80	49742	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:10.515105963 CET	49742	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:10.515765905 CET	49742	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:10.647022009 CET	80	49742	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:10.647624016 CET	80	49742	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:10.647641897 CET	80	49742	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:10.648061991 CET	49742	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:10.650599003 CET	49742	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:10.780585051 CET	80	49742	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:11.165839911 CET	49745	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:11.301563025 CET	80	49745	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:11.301687002 CET	49745	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:11.302320004 CET	49745	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:11.436569929 CET	80	49745	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:11.437163115 CET	80	49745	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:11.437191963 CET	80	49745	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:11.437302113 CET	49745	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:11.437710047 CET	49745	80	192.168.2.4	162.88.193.70
Feb 23, 2021 17:47:11.570492029 CET	80	49745	162.88.193.70	192.168.2.4
Feb 23, 2021 17:47:15.477514982 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:15.518438101 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.518560886 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:15.663821936 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:15.704763889 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.707940102 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.707974911 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.708055973 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:15.720120907 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:15.761037111 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.761157036 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:15.894706964 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:16.124634981 CET	49746	443	192.168.2.4	104.21.19.200
Feb 23, 2021 17:47:16.165818930 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:16.176373959 CET	443	49746	104.21.19.200	192.168.2.4
Feb 23, 2021 17:47:16.300379038 CET	49746	443	192.168.2.4	104.21.19.200

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:46:17.454483032 CET	53723	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:17.503448009 CET	53	53723	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:18.465976954 CET	64646	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:18.514651060 CET	53	64646	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:18.596849918 CET	65298	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:18.645673037 CET	53	65298	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:19.059184074 CET	59123	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:19.117706060 CET	53	59123	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:19.822237968 CET	54531	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:19.873717070 CET	53	54531	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:21.559057951 CET	49714	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:21.609155893 CET	53	49714	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:23.021130085 CET	58028	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:23.069884062 CET	53	58028	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:24.302784920 CET	53097	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:24.362678051 CET	53	53097	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:25.923446894 CET	49257	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:25.972177029 CET	53	49257	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:27.101850986 CET	62389	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:27.153682947 CET	53	62389	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:28.352952957 CET	49910	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:28.401815891 CET	53	49910	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:29.705750942 CET	55854	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:29.770699978 CET	53	55854	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:31.847505093 CET	64549	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:31.900166035 CET	53	64549	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:33.009524107 CET	63153	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:33.058171988 CET	53	63153	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:35.175245047 CET	52991	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:35.238220930 CET	53	52991	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:36.564374924 CET	53700	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:36.616409063 CET	53	53700	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:37.795241117 CET	51726	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:37.850491047 CET	53	51726	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:42.885940075 CET	56794	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:42.943049908 CET	53	56794	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:44.089695930 CET	56534	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:44.147047997 CET	53	56534	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:46.165170908 CET	56627	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:46.216825008 CET	53	56627	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:47.319994926 CET	56621	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:47.368875980 CET	53	56621	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:48.725441933 CET	63116	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:48.774477959 CET	53	63116	8.8.8.8	192.168.2.4
Feb 23, 2021 17:46:49.850008965 CET	64078	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:46:49.901560068 CET	53	64078	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:09.970807076 CET	64801	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:10.019479990 CET	53	64801	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:10.044681072 CET	61721	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:10.093497038 CET	53	61721	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:10.784713984 CET	51255	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:10.846333027 CET	53	51255	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:10.992858887 CET	61522	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:11.052777052 CET	53	61522	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:15.414294004 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:15.474364996 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:16.051832914 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:16.128154039 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:17.384895086 CET	49612	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:17.445041895 CET	53	49612	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:19.945775986 CET	49285	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:20.038868904 CET	53	49285	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:20.514960051 CET	50601	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:20.572122097 CET	53	50601	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:21.488823891 CET	60875	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:21.549582005 CET	53	60875	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:22.153453112 CET	56448	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:22.215020895 CET	53	56448	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:22.310942888 CET	59172	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:22.377717972 CET	53	59172	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:22.887278080 CET	62420	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:22.949532986 CET	53	62420	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:23.929455042 CET	60579	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:23.988411903 CET	53	60579	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:25.474884987 CET	50183	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:25.532162905 CET	53	50183	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:26.061750889 CET	61531	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:26.118860960 CET	53	61531	8.8.8.8	192.168.2.4
Feb 23, 2021 17:47:31.777206898 CET	49228	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:47:31.835905075 CET	53	49228	8.8.8.8	192.168.2.4
Feb 23, 2021 17:48:01.090235949 CET	59794	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:48:01.138968945 CET	53	59794	8.8.8.8	192.168.2.4
Feb 23, 2021 17:48:02.770982981 CET	55916	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:48:02.842902899 CET	53	55916	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 17:47:09.970807076 CET	192.168.2.4	8.8.8.8	0x54f0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.044681072 CET	192.168.2.4	8.8.8.8	0xd247	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:15.414294004 CET	192.168.2.4	8.8.8.8	0xb3b6	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.019479990 CET	8.8.8.8	192.168.2.4	0x54f0	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:10.093497038 CET	8.8.8.8	192.168.2.4	0xd247	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:15.474364996 CET	8.8.8.8	192.168.2.4	0xb3b6	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Feb 23, 2021 17:47:15.474364996 CET	8.8.8.8	192.168.2.4	0xb3b6	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49742	162.88.193.70	80	C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 17:47:10.515765905 CET	1400	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 23, 2021 17:47:10.647624016 CET	1400	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 103 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.38</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49745	162.88.193.70	80	C:\Users\user\Desktop\Delivery 9073782912,pdf.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 17:47:11.302320004 CET	1470	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 23, 2021 17:47:11.437163115 CET	1471	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 103 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.38</body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 17:47:15.707974911 CET	104.21.19.200	443	192.168.2.4	49746	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 10 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 10 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Feb 23, 2021 17:47:15.707974911 CET	104.21.19.200	443	192.168.2.4	49746	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Delivery 9073782912,pdf.exe PID: 6980 Parent PID: 5960

General

Start time:	17:46:24
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\Delivery 9073782912,pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Delivery 9073782912,pdf.exe'
Imagebase:	0x7ffabd480000
File size:	635392 bytes
MD5 hash:	8B22F061055264B77361C6FE7941E25F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.741510466.0000000004E73000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Delivery 9073782912,pdf.exe PID: 6880 Parent PID: 6980

General

Start time:	17:47:05
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\Delivery 9073782912,pdf.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x7ffabd480000
File size:	635392 bytes
MD5 hash:	8B22F061055264B77361C6FE7941E25F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.910649782.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Delivery 9073782912,pdf.exe PID: 6980 Parent PID: 5960 Delivery 9073782912,pdf.exeCOMMON

Executed Functions

Function 031A4500, Relevance: 5.3, Strings: 4, Instructions: 308COMMON

Download Yara Rule

Strings

;#2I, xrefs: 031A4704
KEkx, xrefs: 031A4674
KEkx-(}, xrefs: 031A467B
.Zl, xrefs: 031A475A

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: .Zl$;#2I$KEkx$KEkx-(}
API String ID: 0-2852947158
Opcode ID: 46969815b3f759038562ca7383efdeea3b397ae79b93cf8058c460f091decb66
Instruction ID: e6465bd6f3104301bbaeb38d7205c67d7870fc4649503505bb4fa046ef464f5a
Opcode Fuzzy Hash: 46969815b3f759038562ca7383efdeea3b397ae79b93cf8058c460f091decb66
Instruction Fuzzy Hash: B4D10A74E0460ADFCB08CFAAD5804AEFBB2FF8D341B158565C415AB364DB749982CF94

Uniqueness

Uniqueness Score: -1.00%

Function 031A30C0, Relevance: 3.9, Strings: 3, Instructions: 171COMMON

Download Yara Rule

Strings

iV8, xrefs: 031A319A
`}, xrefs: 031A328B
iV8, xrefs: 031A31A1

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: iV8$iV8$`}
API String ID: 0-3551975735
Opcode ID: ec9489cbf4ec26101ac1c80d7f0865827b6ddf1bd3cad3e081f00be9bf6358bd
Instruction ID: ee11374180d5c03f47619a609ea16d971075a8378e2fecad85dc27f11d8c6f48
Opcode Fuzzy Hash: ec9489cbf4ec26101ac1c80d7f0865827b6ddf1bd3cad3e081f00be9bf6358bd
Instruction Fuzzy Hash: 1C711878E0560ADFCB08CF99D581AEEFBB2FB89311F15842AD515A7314D7349A81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 031A2C28, Relevance: 2.6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

Strings

dNT!, xrefs: 031A2D21
9jwB, xrefs: 031A2CCB

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: 9jwB$dNT!
API String ID: 0-642800322
Opcode ID: f55c00f344198431dc126d9203de29f5e7a44a845639db44c7be6d1978dda98e
Instruction ID: 806dbcbff5edfa9e3e9d18a988531ee46626b640fc6c09f12ea3d84256f7bbae
Opcode Fuzzy Hash: f55c00f344198431dc126d9203de29f5e7a44a845639db44c7be6d1978dda98e
Instruction Fuzzy Hash: 95511774E046198FDB08CFAAC9405AEFBF2BF8C301F15D56AD419A7269D7348942CB68

Uniqueness

Uniqueness Score: -1.00%

Function 031A1750, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 031A17EC

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 34480fe167391fb401c8cdc770540500e357d4334545288ed75195848d28436d
Instruction ID: 1f17c7c6431db1b2b4c8270fead83dc83d6bb434177f7d62408f0ab5b5d4c170
Opcode Fuzzy Hash: 34480fe167391fb401c8cdc770540500e357d4334545288ed75195848d28436d
Instruction Fuzzy Hash: A841BBB9D04258DFCB00CFA9D484AEEFBF4BB09314F14906AE415B7250D738AA85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 031A0500, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

<, xrefs: 031A0611

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 4604eae86b206476c7a10cd23341e21c16de356f47797b02d0f4b94d4171a093
Instruction ID: f3e2b3053278793ce2776530f8ac1bb1df6f6a7582593eb5e8d2f7d71b897e8c
Opcode Fuzzy Hash: 4604eae86b206476c7a10cd23341e21c16de356f47797b02d0f4b94d4171a093
Instruction Fuzzy Hash: FE51B475E046189FDB58CFAAC9506DDBBF2AF8D304F14C0AAD51DAB224EB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08434944, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99f70b4c5551a55cfd096540f5ef573a47c622dee246e2687cfa4a9e9d3f6e1
Instruction ID: f9e2e4bc6c3f996d43ba7537815850b2f0d7d0fb68403e338571112f416a43d6
Opcode Fuzzy Hash: d99f70b4c5551a55cfd096540f5ef573a47c622dee246e2687cfa4a9e9d3f6e1
Instruction Fuzzy Hash: 63E12B74E00358DFCB14DFA5C844AAEBBB5FF89304F1481AAE849A7311EB71A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0331AB4C, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97d1895611345a2f9f6030f579445340a3a8239a05d732bd0dbca621f4e7eb3
Instruction ID: 702924dd6bb1c3766e8df977ad63d1edca4f986ca8b3775102a85cfb81781ef9
Opcode Fuzzy Hash: c97d1895611345a2f9f6030f579445340a3a8239a05d732bd0dbca621f4e7eb3
Instruction Fuzzy Hash: B791B274E00319CFCB04DFA1C8949EEB7BAFF89304F158619E415AB7A4EB34A995CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0331C0D8, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9238fe74bc3733f7127197f88e11a8c22dbc487d92b1083db158d3e2aa8e5c1
Instruction ID: 42c7f2d9a21aaa097e5b53ce20dda4940139529b6e5bf235bfaa1b13d546bbcb
Opcode Fuzzy Hash: f9238fe74bc3733f7127197f88e11a8c22dbc487d92b1083db158d3e2aa8e5c1
Instruction Fuzzy Hash: 9381A075E003198FCB04DBE1D8949DEB7BAFF89300F258615E415AB6A4EB30A995CB50

Uniqueness

Uniqueness Score: -1.00%

Function 031A24D8, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbb987652360e472e1b8b1a6ed2247a1d69e50a6c16991a69ce6193fcada53d
Instruction ID: 82c54c2416f752153330ffff8cf7fe109d6138e5148eb72d37036fbf891156b9
Opcode Fuzzy Hash: bdbb987652360e472e1b8b1a6ed2247a1d69e50a6c16991a69ce6193fcada53d
Instruction Fuzzy Hash: 2081B174E016188FDB08CFEAD9946DEBBB2FF88300F14852AD919AB364D7345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03312230, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2803582369d31387d629bd94d96a248140389d23f78ec36576a7c689c9ecd6a
Instruction ID: d1cb21c9792daec955ff28fae58a6d7d3c032662960f59c5552b20d61d21171d
Opcode Fuzzy Hash: f2803582369d31387d629bd94d96a248140389d23f78ec36576a7c689c9ecd6a
Instruction Fuzzy Hash: 41513F74E05209DFCB48DFA9D5819EEF7B2FF89300F1089AAC415AB364D730AA52CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03312240, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb1d88629a5fa7c2cf3d9e6e1a0a540461f6b7e50ca017372b87dbdc92acea3
Instruction ID: c10139067adc47499d71e43c3f6501c5c9e63ba8c9b46b33291ba06e81f29ae6
Opcode Fuzzy Hash: 7fb1d88629a5fa7c2cf3d9e6e1a0a540461f6b7e50ca017372b87dbdc92acea3
Instruction Fuzzy Hash: E1514374E05209DFCB48DFA9D5819AEF7B2FF89300F5089AAC415EB364D730AA51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0843E13C, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a6a7bbd94c846f4c04bd92ef101b7eb4eaf396ac93195c55ace9116b507f96
Instruction ID: ed2c77ea1638d6aee1011c638c569d760b0ea38346a14fd6223675121f941683
Opcode Fuzzy Hash: 82a6a7bbd94c846f4c04bd92ef101b7eb4eaf396ac93195c55ace9116b507f96
Instruction Fuzzy Hash: 6541C8B4D462489FDB10CFA9C984BDEFBF0AB0A314F20912AE415BB750C7759949CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0843D9E4, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2a3456ca5082aefef2d04903d582d36a6473bda6f53c6c23d2a8374c8baba1
Instruction ID: c27a69e0a701210fb58ead446ce3a9f985ffbfe782020d9f177527cebf239cd9
Opcode Fuzzy Hash: 6e2a3456ca5082aefef2d04903d582d36a6473bda6f53c6c23d2a8374c8baba1
Instruction Fuzzy Hash: 8741A7B4D05218DFDB10CFA9C984B9EBBF0AB09304F20912AE415BB750CB75A949CF94

Uniqueness

Uniqueness Score: -1.00%

Function 031A3628, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad7eeeb91f54d1b71ae56ba91b563b52826ef8a618ee6a5592a42e9a3a66bc9
Instruction ID: cda8bfe0e998ee805f0df031767e5a4261959c1cfb194d846c38c7ae8dbb8264
Opcode Fuzzy Hash: 2ad7eeeb91f54d1b71ae56ba91b563b52826ef8a618ee6a5592a42e9a3a66bc9
Instruction Fuzzy Hash: E3310475E006188BDB58CFAAD8447DEFBB3AFC8311F14C16AD409AA368DB745A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0843E5CF, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0088f68aec65a768aea1249f404c0f4ddb3fee5f65626b1314a6b00448bed314
Instruction ID: bc9ad1c35e1957f7aeb73b61d264034b90f6875c52ddf16aaf8a8479c28a2319
Opcode Fuzzy Hash: 0088f68aec65a768aea1249f404c0f4ddb3fee5f65626b1314a6b00448bed314
Instruction Fuzzy Hash: 5621A0B4D012189FCB14CFAAD4446EEBBF1AB49311F10E12AE824B7350D7349645CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0843E5D8, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04461776910d820ab2ff479be6b271a22327e343501df1878f5246d57c47f5f8
Instruction ID: 379c53c81ec62a2cfe09277479c05abdc8c1a337f841746442660b01c5808ba4
Opcode Fuzzy Hash: 04461776910d820ab2ff479be6b271a22327e343501df1878f5246d57c47f5f8
Instruction Fuzzy Hash: F0219FB4D01218DFDB14CFAAD4446EEBBF1AB49351F20E12AE824B7350D7349A45CF98

Uniqueness

Uniqueness Score: -1.00%

Function 033150D0, Relevance: 1.7, APIs: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 03315342

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2cbed9ad5f154f4c28432c1ab11404de5b19151b9f7b0fc6077acf94defc9ee8
Instruction ID: df3674290f803c668312b13c7370fa2d37539f9745cd48b2daee19e23dec75dd
Opcode Fuzzy Hash: 2cbed9ad5f154f4c28432c1ab11404de5b19151b9f7b0fc6077acf94defc9ee8
Instruction Fuzzy Hash: 58911670A007098FDB68CF6AD88479ABBF5FF89304F14892AE446E7B50D734A855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0331AAE0, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0331BE79

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2363cfd6e967ce629cd66f6ab3243d370ec5fb6adc74c13c951be696ce8724f1
Instruction ID: bfb5ae8bee77abdad67ad6a5c208a4b42e302d140650435336fc87f64f5f5c61
Opcode Fuzzy Hash: 2363cfd6e967ce629cd66f6ab3243d370ec5fb6adc74c13c951be696ce8724f1
Instruction Fuzzy Hash: 7381BDB4D042589FCB24CFA9C884BDEFBF1BB0A304F1491AAE508AB221D7349985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0331BCAC, Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0331BE79

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8cb3d654b7756a583507e36b92af1984ad30497dac49513e5b889e11fcada1ba
Instruction ID: 4d12707b9dfc0c8fcf987f7ccf5a7286457e1e7eccb4f22c22e4e7a9ba112e59
Opcode Fuzzy Hash: 8cb3d654b7756a583507e36b92af1984ad30497dac49513e5b889e11fcada1ba
Instruction Fuzzy Hash: 92719AB4D002589FDF24CFA9D984BDEFBB1BB09304F2491AAE908A7221D7349985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0331AAFC, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0331BE79

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ea3527d7aebac7cdee30a14e55015a14eac84545a02abcc961926d684803f6cf
Instruction ID: a20a9ee437304c6d224d37f031687573e467a79d83d668b3be12a2cee5ef045c
Opcode Fuzzy Hash: ea3527d7aebac7cdee30a14e55015a14eac84545a02abcc961926d684803f6cf
Instruction Fuzzy Hash: 11718AB4D002189FDF24CFA9D984BDEFBF1BB09304F1491AAE918A7221D7349A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 03310605, Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03310701

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 28e925f78309b403ea58d4b8ec94029e212fd10f6a50ccddcf0a574a7bb1e111
Instruction ID: 7d4c43106ae66981bd03416d8ee264a3234c0b4d584533da1370fb4b2aa9071b
Opcode Fuzzy Hash: 28e925f78309b403ea58d4b8ec94029e212fd10f6a50ccddcf0a574a7bb1e111
Instruction Fuzzy Hash: 81510671D0422C8FDB24DFA4C880BCEBBF5BF59304F1180A9D549AB251DB756A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03310610, Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03310701

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b546b6e39c9db460874e2f10a7c70c131d8a0ad321f9a7348cc10899f77ca86f
Instruction ID: a7a8b955a7540fdd480a04cfba8ff5fc93478ed362be1ae4006577881b220fbc
Opcode Fuzzy Hash: b546b6e39c9db460874e2f10a7c70c131d8a0ad321f9a7348cc10899f77ca86f
Instruction Fuzzy Hash: AC51F671D0422C8FDB24DFA4C880BCEBBF5BF49304F1180A9D549AB250DB756A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03317720, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 033177F3

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 071847bf6da154c4b9a90d18da3fcec6d23a40c5325822caea06d9a2f8d7f52a
Instruction ID: fe105a3f47858da2e0984de2f718d84a63aefcb49c5d235130de3acf358714ec
Opcode Fuzzy Hash: 071847bf6da154c4b9a90d18da3fcec6d23a40c5325822caea06d9a2f8d7f52a
Instruction Fuzzy Hash: A44177B9D002589FCB00CFA9D984ADEBBF5BB09310F18906AE918BB310D375A955CF94

Uniqueness

Uniqueness Score: -1.00%

Function 033168AC, Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 033177F3

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 914660bb9191494636fa8d454bb315cbdad53a511940edbf6dbcc4314085d4f5
Instruction ID: b7997f05099517c3704b2e95e903ffbc18576ab31526bae252e309aabfd6838d
Opcode Fuzzy Hash: 914660bb9191494636fa8d454bb315cbdad53a511940edbf6dbcc4314085d4f5
Instruction Fuzzy Hash: 874176B9D042589FCF00CFA9D984ADEBBF5BB09310F14906AE918BB310D375A955CF94

Uniqueness

Uniqueness Score: -1.00%

Function 033155B9, Relevance: 1.6, APIs: 1, Instructions: 98libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 0331566A

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8a10faff6a68a2fc271b1674668c719ba56b0acb99eba0fefb9e163a36e5d8da
Instruction ID: 76837ae4096d00028f3aefcf0d7f95b86cee44f982cc87f1310588bad48f706c
Opcode Fuzzy Hash: 8a10faff6a68a2fc271b1674668c719ba56b0acb99eba0fefb9e163a36e5d8da
Instruction Fuzzy Hash: 284196B8D002589FDB14CFA9D884ADEFBF5BB49310F14902AE914B7320D334A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 03314B58, Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 0331566A

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7a0bbc19731023b90c2a9c0f6d85f8f7b79791d066bc2c8e53347cacc5c53b3f
Instruction ID: bfcd2318f1fdec1417af12996425eb57141f84b02cc226a5c0a1e69f19e97186
Opcode Fuzzy Hash: 7a0bbc19731023b90c2a9c0f6d85f8f7b79791d066bc2c8e53347cacc5c53b3f
Instruction Fuzzy Hash: 724198B8D042589FDB14CFA9D884A9EFBF5BB49310F14902AE914B7320D334A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0331AC4C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0331E4E1

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cca4405db7a432ff71866389b302d173eec463828b4145ef6a13ea464c838a73
Instruction ID: 47b34ce5bfeaa8f917c8beb6b65dda86b6bdf5bf0cb026888f08d967263335e2
Opcode Fuzzy Hash: cca4405db7a432ff71866389b302d173eec463828b4145ef6a13ea464c838a73
Instruction Fuzzy Hash: 214119B4900209CFCB14CF99C888AABFBF5FB89314F25C459D919AB321D775A951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 031A1870, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 031A1917

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ab53bfbbdfb8e49f84cb83a7a57bf8cd70f72557e827b274f79f37d544c33c47
Instruction ID: 04b0e3381978ec6527a9fba3897fc76f83ac55dd97436a3cc264969dafe88e99
Opcode Fuzzy Hash: ab53bfbbdfb8e49f84cb83a7a57bf8cd70f72557e827b274f79f37d544c33c47
Instruction Fuzzy Hash: 483197B9D04258AFCB10CFA9D984ADEFBB1BB09314F14902AE815B7210D734AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 033152B0, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 03315342

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ba222d527b399eeb549664e85214ff177dd6b1a28bec21dcb08672759a517120
Instruction ID: ecf18de1ebda56ae3e027c26f366eb1eaf42226d95f5c1e8643366a1fc23a2f3
Opcode Fuzzy Hash: ba222d527b399eeb549664e85214ff177dd6b1a28bec21dcb08672759a517120
Instruction Fuzzy Hash: 7431BBB4D002599FDB14CFA9D884ADEFBF5BB49314F18906AE814B7310D374A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 033156C9, Relevance: 1.6, APIs: 1, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 0331566A

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a975ff25a38ee3c7766e22ecf0cd2917f6db3579096b4360b4f1bc109aea278b
Instruction ID: 7c518619fbc25e576b56f4498fefe8a74c2c4d5bbee4a4c326d7c0e57a12c814
Opcode Fuzzy Hash: a975ff25a38ee3c7766e22ecf0cd2917f6db3579096b4360b4f1bc109aea278b
Instruction Fuzzy Hash: 4B1197B4D152089FDB10CBA8E880ACDFBF4EF4A324F04905AE404B3210C3716815CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0843F5E0, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a568d10c86fda46b388dd299451bc991c5874e9f8cf85a26241750aa1ae991
Instruction ID: 8e28934fbd02bb3409fe90057c88fd8dcf9c27b7bd6a8974aac74d3d70c18a90
Opcode Fuzzy Hash: 84a568d10c86fda46b388dd299451bc991c5874e9f8cf85a26241750aa1ae991
Instruction Fuzzy Hash: 159108349107599ECB14DF64C840BAEBBB1FF89304F14819AE849A7311EB71AA86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0843FED0, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35452b25c11c1d11a74c7abd689d5b02db3ac062ac2aca58e3d7119126d3cf1c
Instruction ID: 2e2dbed3cd2c2f6cea94cee38a3744a71d7d81f847a478b5cd50df32725d9ebe
Opcode Fuzzy Hash: 35452b25c11c1d11a74c7abd689d5b02db3ac062ac2aca58e3d7119126d3cf1c
Instruction Fuzzy Hash: 02E02632D14274CFC300A7A8F0047957368D705222F03806BE62883203DB68EC848380

Uniqueness

Uniqueness Score: -1.00%

Function 0843F1DC, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308c172a28de3dc17fcb1d1581c55c671c6a5a3a3d1809637fd91fdabda47873
Instruction ID: f309fc2fa034860c48ef9102480b00ebbf0c315871ecd64bc4113acb7019b147
Opcode Fuzzy Hash: 308c172a28de3dc17fcb1d1581c55c671c6a5a3a3d1809637fd91fdabda47873
Instruction Fuzzy Hash: BD1129356083608FC701AB78F8544BB7BB5EB86205718849FD489CB253DB39D80AC750

Uniqueness

Uniqueness Score: -1.00%

Function 0843E6B0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e923c02dd95d90c5c45ccea837506d6577a8c21da2c2b3a5d0011e40cdb2d41
Instruction ID: 4cd8f8e471deb8bcaefb2d1a28b047ad27a776491657434297ebe86de3bfbcb5
Opcode Fuzzy Hash: 9e923c02dd95d90c5c45ccea837506d6577a8c21da2c2b3a5d0011e40cdb2d41
Instruction Fuzzy Hash: B6E03972B041246F5318DB6AE884C6BBBEEEBCD674351813AF508CB310DA309C0186A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 031A5408, Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

GM, xrefs: 031A5469

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: GM
API String ID: 0-3089447204
Opcode ID: 82b4307e39c8763e8a0f4951561758799cd0cd41dd2ac8b0c8e925beaf82d5d3
Instruction ID: 16da674b101663c799df6735cd0c6afe3e2f47ecb293f1b4e73ba3e3d2f2e861
Opcode Fuzzy Hash: 82b4307e39c8763e8a0f4951561758799cd0cd41dd2ac8b0c8e925beaf82d5d3
Instruction Fuzzy Hash: D6811434E15609DFCB48CF99D58499EFBF2FF89311F15856AE819AB220E730AA41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08434864, Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46da05cada22184500404967b266cd86778953c7cb7c006dd3e5dd1814a17985
Instruction ID: 68e8615aa79886dcddaa4f37985c44fa3b80591538380d439e3b3e47ad2b0f9f
Opcode Fuzzy Hash: 46da05cada22184500404967b266cd86778953c7cb7c006dd3e5dd1814a17985
Instruction Fuzzy Hash: 97A20735E002598FCB15EF68C8946EDB7B1FF89304F1482A9D90AA7351EB746E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0331A0B0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e69e829a51380d3d4f020cbc0aec1073f66c2e9dfb420a9ceccc98348ffba8d
Instruction ID: c936a6dcfb28a35a33181263b67a3c0e6f4e84d40688075e6ea1c352a8c3b35d
Opcode Fuzzy Hash: 5e69e829a51380d3d4f020cbc0aec1073f66c2e9dfb420a9ceccc98348ffba8d
Instruction Fuzzy Hash: 6412A9F9C017458BF710EF65E5C82893BA9F746318F908208D2616F6E9DFB4298ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0843EC28, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4973eb7f8b0a58a4079eb2495c9c9473942d2e842b0eacb1a8916b02d6ce22
Instruction ID: 71105a5f21c5d88e6d3fec32d4d7a4406060facf1f4030814450e1d1bc429c03
Opcode Fuzzy Hash: 2b4973eb7f8b0a58a4079eb2495c9c9473942d2e842b0eacb1a8916b02d6ce22
Instruction Fuzzy Hash: 72D1E531C2075A9ACB10EFA4D994ADDB3B1FF99300F518B9AD14977260EB706AC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 033180E4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a946b6e6748647f7dc0e07e451ae1758970412b68c0f1dc04622918e5ce3993c
Instruction ID: 12eabff9bffb10cdfd05685411ba2024459cc2fafb821f028b4a707f019e48d1
Opcode Fuzzy Hash: a946b6e6748647f7dc0e07e451ae1758970412b68c0f1dc04622918e5ce3993c
Instruction Fuzzy Hash: E1A18F36E0021ACFCF09DFA5C8845DEB7B6FF85300B15856AE905AF221EB75E955CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0843EC38, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d6ffc4cd779038818139ebcb610f5717e23524ca245454103f31715c4a0c59
Instruction ID: 90eccc74928ea913b987726cadb4942f23c98049b6c86f9d067bd36f4d1d7fe1
Opcode Fuzzy Hash: a5d6ffc4cd779038818139ebcb610f5717e23524ca245454103f31715c4a0c59
Instruction Fuzzy Hash: D0D1E531C2075A9ACB10EFA4D990ADDB3B1FF99300F518B9AD14977260EB706AC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0331A0A0, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1c362c08c62691d6ed928a51b3fc3c891039d7e5541028c459ba961d60d31b
Instruction ID: f32eaf0c0aaa61604f03d6149d1c1e9540771e0022ef157bc1a8aa6bb7ac4b57
Opcode Fuzzy Hash: 8e1c362c08c62691d6ed928a51b3fc3c891039d7e5541028c459ba961d60d31b
Instruction Fuzzy Hash: 67C11BB9C117458BF710EF65E8C82897B79FB86318F518209D2616B6D8DFB4388ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 031A1980, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737089680.00000000031A0000.00000040.00000001.sdmp, Offset: 03110000, based on PE: true

Associated: 00000000.00000002.736937568.0000000003110000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59ebcbf77b55c92ecc758557a6216b961552f88d8bab8a4875fc4df226faba3
Instruction ID: f0ae2e050266109ccfb14c9bd603613a66a7fea61742e9e89054d8f1257186c3
Opcode Fuzzy Hash: d59ebcbf77b55c92ecc758557a6216b961552f88d8bab8a4875fc4df226faba3
Instruction Fuzzy Hash: 3A510774E046589FEB18CF6AC940A8EF7F3BF89216F09C1A6C50CAB215D7309A81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0331CB88, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073a39434208d6e801e2b0335125647dd6726e99668ff308b37167831aec1b13
Instruction ID: 18f4c18b995058727e642fc3ff18e106d808a0a5aef34066c9d12947904b6478
Opcode Fuzzy Hash: 073a39434208d6e801e2b0335125647dd6726e99668ff308b37167831aec1b13
Instruction Fuzzy Hash: 8C319BB5D012589FCB14CFA9D984ADEFBF1BB49314F24A06AE815B7310D334A946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0331AB94, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737250805.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe6e9045b5b1e1743561cd7ca377f37bc66fdd0c863344db56fcca5d4f872a6
Instruction ID: fd6883d1412abff651939ac838fbc1e3bdd41ffa87e344f40d1edd56cde74458
Opcode Fuzzy Hash: 8fe6e9045b5b1e1743561cd7ca377f37bc66fdd0c863344db56fcca5d4f872a6
Instruction Fuzzy Hash: 423199B8D012589FCB14CFA9E984ADEFBF5BB49310F24A02AE815B7310D734A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0843E2AC, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd3ff4dfb5fcc9bacc450c638614d5872904e15ada3551e606fc932356939ce
Instruction ID: 65ff9b3b90788b272cf5dfb2d46008e0059e61ac03e97cd4ffdba64bde30815f
Opcode Fuzzy Hash: 9bd3ff4dfb5fcc9bacc450c638614d5872904e15ada3551e606fc932356939ce
Instruction Fuzzy Hash: 25318BB4D06218EFDB14CFA9D484AEEBBB2BF49310F24A12AE814B7350D3349985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0843E2B8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab49005d514628ded739ef81d29d0f894ba1e38c4d21780d4aac77ef9d8f37f7
Instruction ID: af27edd8ed4750adaf0405aa113aa0bc7f0311ed09abdb790cf837ce6e1a3dd1
Opcode Fuzzy Hash: ab49005d514628ded739ef81d29d0f894ba1e38c4d21780d4aac77ef9d8f37f7
Instruction Fuzzy Hash: 14316CB4D06218EFCB14CFA9D884AEEBBF2BB89351F24912AE814B7350D7349941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0843E504, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8a77940f2f41acda2661e50c344cc6f76b8d8f5fe12a1ac1171377957e35e9
Instruction ID: 18b796649effba841d31f006c82b31a2113443f8b02cd822fc3a8eed6c6784a5
Opcode Fuzzy Hash: fb8a77940f2f41acda2661e50c344cc6f76b8d8f5fe12a1ac1171377957e35e9
Instruction Fuzzy Hash: 5901AFB5D052089F8F04DFA9D5418EEFBF2AF9A310F14A16AE804B7310E7349911CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0843E510, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.745923648.0000000008430000.00000040.00000001.sdmp, Offset: 08430000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 4a33bcb410b17c6dfad90372bc87e98b64cba1b5cd91efa23c32ca874a64dcea
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: 1DF03FB5D052089B8F04DFA9D5418EEFBF2AB5A310F10A16AE814B3310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Delivery 9073782912,pdf.exe PID: 6880 Parent PID: 6980 Delivery 9073782912,pdf.exeCOMMON

Executed Functions

Function 061D1C50, Relevance: 3.4, APIs: 2, Instructions: 398libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 061D1C6F
KiUserExceptionDispatcher.NTDLL(00000000), ref: 061D215E

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 597ca6ea185c7be1bb4d78f33a8694b1b94473fd362675094a2b792c0de8e28f
Instruction ID: b89d918aa372de466fabb9702ffba4a044d8c8cd43528625179dfec9ed12e1bb
Opcode Fuzzy Hash: 597ca6ea185c7be1bb4d78f33a8694b1b94473fd362675094a2b792c0de8e28f
Instruction Fuzzy Hash: D2F18B70E002189FDB14DFA4C894B9EBBF2BF88304F25C529D515AB385DB75AD46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 061D4FF0, Relevance: 2.0, APIs: 1, Instructions: 547COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061D53B2

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fdd732456e7ec1e5dbadbe3ca7eb971be74b4ca9d17c1ef632c03faffc2382ca
Instruction ID: 468612b7968d7eb2f98b59efc63c4b262c80aabc5aecb1926ada0209c761d3c9
Opcode Fuzzy Hash: fdd732456e7ec1e5dbadbe3ca7eb971be74b4ca9d17c1ef632c03faffc2382ca
Instruction Fuzzy Hash: 4A228D34F042089FEB24EBB4C8597AEBAE3AF89700F14C469E51ADB790DF749845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 061D08A8, Relevance: 1.9, APIs: 1, Instructions: 429libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 061D08DD

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 731740f7a2159b6e8d499ef92426208330405d45885838bc8eeb64d2aeed8401
Instruction ID: d329d56aef1c7b338f3eaffa6f40d8526399872b9a2b15cb4bf450e00925948e
Opcode Fuzzy Hash: 731740f7a2159b6e8d499ef92426208330405d45885838bc8eeb64d2aeed8401
Instruction Fuzzy Hash: ADF15B31E002198FDB54EFB9D8547AEB7F6AF89306F15856AE009EB390DF349881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 061D4F90, Relevance: 1.9, APIs: 1, Instructions: 408COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061D53B2

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 97a18eb774be277eba19f11cd9b510571893d082731a6aed04d24ea1c9e7ace3
Instruction ID: 56f2ed875bbe49d8abcf803e3a392a5ec1d0914f5a8c11282a347e60eda2a14d
Opcode Fuzzy Hash: 97a18eb774be277eba19f11cd9b510571893d082731a6aed04d24ea1c9e7ace3
Instruction Fuzzy Hash: 7DE1CE34B042089FEB14EBB4C8593AEBAE7AF89700F148429E51ADB790DF749C46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 061D0622, Relevance: 2.0, APIs: 1, Instructions: 452libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 061D08DD

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0ecc8587b938a20c09bb215dda4729bc53b483efa0431766ac76439b696f5563
Instruction ID: 3269ce8215818873ca1ba9cf93698c194be8fba3ce65045a15a47f8f095ac767
Opcode Fuzzy Hash: 0ecc8587b938a20c09bb215dda4729bc53b483efa0431766ac76439b696f5563
Instruction Fuzzy Hash: 7DF1C034F092458FD755DB7888547AE7BF2AF8A306F1584AAD049DB7A2DB38CC46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0103DD41, Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.911634062.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045d36d4dddde3e3d9d159b63b04dce20d0bbc3271186c6d04dbb09a2a0ce9
Instruction ID: abc5c314228bdc8b166a82054b49339b16e22b28ab724504b560e1d064ca709c
Opcode Fuzzy Hash: 3b045d36d4dddde3e3d9d159b63b04dce20d0bbc3271186c6d04dbb09a2a0ce9
Instruction Fuzzy Hash: 86D13534A10205CFF718AB75E91E7A97FB2AF84306F148929F166D72A1CF748C89DB50

Uniqueness

Uniqueness Score: -1.00%

Function 061D1BB0, Relevance: 1.6, APIs: 1, Instructions: 138libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 061D1C6F

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7611020ec146ba785fcf447a84e5d2fc05c74193797af70a88253a8d8ab7c9ad
Instruction ID: 2dc97ed1dfd37d83c8d2404a9b17aba44c8587d6da0f6a02302c6004f22a58bd
Opcode Fuzzy Hash: 7611020ec146ba785fcf447a84e5d2fc05c74193797af70a88253a8d8ab7c9ad
Instruction Fuzzy Hash: 3451BC70E092489FDB15DBB8C8547DEBBF2AF85304F1581AAD454AB392DB79DC06CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0103E138, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0103E14B

Memory Dump Source

Source File: 00000008.00000002.911634062.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a8f6a6025da28566afe2d24f183879539dc7c81007bdad18f21f336c8b2d3efb
Instruction ID: d873991b42ab427849d7912d1bc08e1a90b3d83de0905102757bcb81c149afeb
Opcode Fuzzy Hash: a8f6a6025da28566afe2d24f183879539dc7c81007bdad18f21f336c8b2d3efb
Instruction Fuzzy Hash: DF31D939531115CFFB047B72FA0F11C3F22BF492027108A69F026C10E59FBA58DA9B20

Uniqueness

Uniqueness Score: -1.00%

Function 0103E12F, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0103E14B

Memory Dump Source

Source File: 00000008.00000002.911634062.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 63e5703df7d5cdb48d5a93477c05affdab53ae306b67d12377715116d5b2421f
Instruction ID: 6ec7a9d3af0df0f289591edb4fa28b997ff785221c0d3509a019e1c3e6d16e13
Opcode Fuzzy Hash: 63e5703df7d5cdb48d5a93477c05affdab53ae306b67d12377715116d5b2421f
Instruction Fuzzy Hash: 5E31C839531005CFFB047B72FA0F15C3F26BF49202B248A29F026810E59FBA58DADB60

Uniqueness

Uniqueness Score: -1.00%

Function 061FC079, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061FC107

Memory Dump Source

Source File: 00000008.00000002.913936617.00000000061F0000.00000040.00000001.sdmp, Offset: 061F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 56e6bf40c4a0819c0149d244c8feed5c371d6f3af5e7e6ecaddb6e57b0fcaa57
Instruction ID: d3ee934d2fd98780422418c31982bdcfbf8c8d44f1bc71008b796a2e7bd294b6
Opcode Fuzzy Hash: 56e6bf40c4a0819c0149d244c8feed5c371d6f3af5e7e6ecaddb6e57b0fcaa57
Instruction Fuzzy Hash: DA21E0B5D01208EFDB10CFA9D985ADEBBF8EB48324F14841AE914B3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061FC080, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061FC107

Memory Dump Source

Source File: 00000008.00000002.913936617.00000000061F0000.00000040.00000001.sdmp, Offset: 061F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e9dba7e7a74c97864ad02c9e17d8bafb727d228b0de994adc4b493e4043afed4
Instruction ID: 9f32ea3a9348c970e7d24428f4bac8df893287cb858a3c258306278d9f4ac326
Opcode Fuzzy Hash: e9dba7e7a74c97864ad02c9e17d8bafb727d228b0de994adc4b493e4043afed4
Instruction Fuzzy Hash: 7921C4B5900258DFDB10CF99D984ADEBBF8FB49324F14841AE914A3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D4F0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.911380262.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fb12800264a6ea61b0155e743675e1938d65c0051080fec21e737fb9c036f1
Instruction ID: 3ad91a0ca808e9b748c751371119323cc49473d049949c757e1aaadea66b93a9
Opcode Fuzzy Hash: 29fb12800264a6ea61b0155e743675e1938d65c0051080fec21e737fb9c036f1
Instruction Fuzzy Hash: E321F1B2904244DFDB04EF14D9C0B66BF65FF98328F28856AE9054E286C336D845EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D030, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.911418501.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff0e7373e590578e0ce7b51091880612d2a789f67d64a66610862acf257702b
Instruction ID: 99be4a7ae41ce2361cefe8ac3bef33882ac76fa5c8d70fed95239921fe185edb
Opcode Fuzzy Hash: aff0e7373e590578e0ce7b51091880612d2a789f67d64a66610862acf257702b
Instruction Fuzzy Hash: 4A21F5B1508244DFEF14DF14D9C0B26BBA5FB88324F34C569D9094B25AC37AD846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D005, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.911418501.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e53663e14c9278e6442a6e04f94206f04013484818a8754a5f59522e4ff1dab
Instruction ID: 509e008d34b2697cf96d04e2570ed97be58a4105d2a856bbed57d5a25f4f86a5
Opcode Fuzzy Hash: 9e53663e14c9278e6442a6e04f94206f04013484818a8754a5f59522e4ff1dab
Instruction Fuzzy Hash: CB217E7550D3C08FDB13CB20C890711BF71AB46214F29C1DBD8848F6A7C27A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D4EB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.911380262.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d191f27037774c7175ec00988a523654d6fbb25c1dda66acccd64c723f85ba2
Instruction ID: 23733b8cabd39d6129afa8e25140352734b6b6f64a69d0ba852b5b7d1f2d7575
Opcode Fuzzy Hash: 9d191f27037774c7175ec00988a523654d6fbb25c1dda66acccd64c723f85ba2
Instruction Fuzzy Hash: 5411B176804280DFCF15DF10D9C4B56BF71FF98324F2886AAD8050B656C336D85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 061D3465, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.913892478.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e549626075f6a6e0d09021a7c91c025e15f8cdd249a6082dc3a5c9194fda0d1
Instruction ID: 4328a2013f5c1aab5f3a2a14f3d7d39120cb8a8ec82e74760e549bcc069d32bf
Opcode Fuzzy Hash: 8e549626075f6a6e0d09021a7c91c025e15f8cdd249a6082dc3a5c9194fda0d1
Instruction Fuzzy Hash: 8181E83B59B1A67ED35ACA7A0CECEEB7F38D41A4C8B8D0671F5E254812C2740445C3E6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Delivery 9073782912,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Snake Keylogger

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets