Play interactive tour

Edit tour

Analysis Report TNTNumber1062324.PDF.exe

Overview

General Information

Sample Name:	TNTNumber1062324.PDF.exe
Analysis ID:	358491
MD5:	90524c4f4816eb22693e92212b8cab6c
SHA1:	b10d499c6aedcc0c0a3cf728a609466824a73d19
SHA256:	adea37317bf08b2dbb86164c609b0ee2eec3ccd6ef0e82c1c46d8447623e5899
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

TNTNumber1062324.PDF.exe (PID: 7092 cmdline: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' MD5: 90524C4F4816EB22693E92212B8CAB6C)

TNTNumber1062324.PDF.exe (PID: 6072 cmdline: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' MD5: 90524C4F4816EB22693E92212B8CAB6C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

System Summary:

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , CommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, NewProcessName: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, OriginalFileName: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , ParentImage: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, ParentProcessId: 7092, ProcessCommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , ProcessId: 6072

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: TNTNumber1062324.PDF.exe	Virustotal: Detection: 42%			Perma Link
Source: TNTNumber1062324.PDF.exe	ReversingLabs: Detection: 31%

Compliance:

Uses 32bit PE files

Show sources

Source: TNTNumber1062324.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: TNTNumber1062324.PDF.exe

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process Stats: CPU usage > 98%

Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TNTNumber1062324.PDF.exe, 00000000.00000000.635376844.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe
Source: TNTNumber1062324.PDF.exe, 00000010.00000000.974522307.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe
Source: TNTNumber1062324.PDF.exe	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe

Source: TNTNumber1062324.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@0/0

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\~DF66CD68291135151C.TMP

Jump to behavior

Source: TNTNumber1062324.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TNTNumber1062324.PDF.exe	Virustotal: Detection: 42%
Source: TNTNumber1062324.PDF.exe	ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Source: unknown	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'	Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072, type: MEMORY

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_005639B6 push esp; retf

16_2_005639BD

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: TNTNumber1062324.PDF.exe

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566967	16_2_00566967
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056693A	16_2_0056693A
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005669DA	16_2_005669DA
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005669FA	16_2_005669FA
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056699E	16_2_0056699E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A55	16_2_00566A55
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A2E	16_2_00566A2E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566AD5	16_2_00566AD5
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566AEB	16_2_00566AEB
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A97	16_2_00566A97
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A82	16_2_00566A82
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566ABD	16_2_00566ABD
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B57	16_2_00566B57
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B12	16_2_00566B12
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B2A	16_2_00566B2A
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005613D6	16_2_005613D6

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050671A second address: 000000000050671A instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0CB43B82D8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007F0CB43B82A7h 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 test bh, FFFFFFFDh 0x00000033 call 00007F0CB43B8304h 0x00000038 call 00007F0CB43B82E8h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000504040 second address: 0000000000504040 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: TNTNumber1062324.PDF.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000506B17 second address: 0000000000506A69 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp dword ptr [edi+14h], 10h 0x0000000f je 00007F0CB4C91679h 0x00000011 jmp 00007F0CB4C91642h 0x00000013 cmp cx, ax 0x00000016 cmp dword ptr [edi+14h], 20h 0x0000001a je 00007F0CB4C9165Eh 0x0000001c cmp dword ptr [edi+14h], 40h 0x00000020 je 00007F0CB4C91658h 0x00000022 cmp dword ptr [edi+14h], 02h 0x00000026 je 00007F0CB4C91652h 0x00000028 cmp dword ptr [edi+14h], 04h 0x0000002c je 00007F0CB4C9164Ch 0x0000002e jmp 00007F0CB4C91642h 0x00000030 cmp dx, dx 0x00000033 jmp 00007F0CB4C914D1h 0x00000038 jmp 00007F0CB4C91642h 0x0000003a nop 0x0000003b jmp 00007F0CB4C91642h 0x0000003d test ah, dh 0x0000003f jmp 00007F0CB4C91642h 0x00000041 pushad 0x00000042 mov eax, 00000055h 0x00000047 cpuid 0x00000049 popad 0x0000004a add esi, 00001000h 0x00000050 jmp 00007F0CB4C91642h 0x00000052 pushad 0x00000053 lfence 0x00000056 rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050671A second address: 000000000050671A instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0CB43B82D8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007F0CB43B82A7h 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 test bh, FFFFFFFDh 0x00000033 call 00007F0CB43B8304h 0x00000038 call 00007F0CB43B82E8h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050673A second address: 000000000050673A instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0CB4C91C4Ah 0x0000001d popad 0x0000001e call 00007F0CB4C9170Bh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000503FCF second address: 0000000000504040 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007F0CB43B90DAh 0x00000010 call 00007F0CB43B74E3h 0x00000015 pop dword ptr [ebp+000000B8h] 0x0000001b jmp 00007F0CB43B82E2h 0x0000001d test cx, bx 0x00000020 jmp 00007F0CB43B82E2h 0x00000022 test bh, bh 0x00000024 push dword ptr fs:[000000C0h] 0x0000002b jmp 00007F0CB43B82E2h 0x0000002d pushad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000504040 second address: 0000000000504040 instructions:
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000566B17 second address: 0000000000566A69 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp dword ptr [edi+14h], 10h 0x0000000f je 00007F0CB43B8319h 0x00000011 jmp 00007F0CB43B82E2h 0x00000013 cmp cx, ax 0x00000016 cmp dword ptr [edi+14h], 20h 0x0000001a je 00007F0CB43B82FEh 0x0000001c cmp dword ptr [edi+14h], 40h 0x00000020 je 00007F0CB43B82F8h 0x00000022 cmp dword ptr [edi+14h], 02h 0x00000026 je 00007F0CB43B82F2h 0x00000028 cmp dword ptr [edi+14h], 04h 0x0000002c je 00007F0CB43B82ECh 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 cmp dx, dx 0x00000033 jmp 00007F0CB43B8171h 0x00000038 jmp 00007F0CB43B82E2h 0x0000003a nop 0x0000003b jmp 00007F0CB43B82E2h 0x0000003d test ah, dh 0x0000003f jmp 00007F0CB43B82E2h 0x00000041 pushad 0x00000042 mov eax, 00000055h 0x00000047 cpuid 0x00000049 popad 0x0000004a add esi, 00001000h 0x00000050 jmp 00007F0CB43B82E2h 0x00000052 pushad 0x00000053 lfence 0x00000056 rdtsc

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_00560C52 rdtsc

16_2_00560C52

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: TNTNumber1062324.PDF.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_00560C52 rdtsc

16_2_00560C52

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00563447 mov eax, dword ptr fs:[00000030h]	16_2_00563447
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00563445 mov eax, dword ptr fs:[00000030h]	16_2_00563445
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00562555 mov eax, dword ptr fs:[00000030h]	16_2_00562555
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00561D16 mov eax, dword ptr fs:[00000030h]	16_2_00561D16
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056250E mov eax, dword ptr fs:[00000030h]	16_2_0056250E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00562522 mov eax, dword ptr fs:[00000030h]	16_2_00562522
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F5D mov eax, dword ptr fs:[00000030h]	16_2_00566F5D
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F79 mov eax, dword ptr fs:[00000030h]	16_2_00566F79
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056631E mov eax, dword ptr fs:[00000030h]	16_2_0056631E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F1F mov eax, dword ptr fs:[00000030h]	16_2_00566F1F
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F0E mov eax, dword ptr fs:[00000030h]	16_2_00566F0E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00565B34 mov eax, dword ptr fs:[00000030h]	16_2_00565B34
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F39 mov eax, dword ptr fs:[00000030h]	16_2_00566F39
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566321 mov eax, dword ptr fs:[00000030h]	16_2_00566321
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566FCA mov eax, dword ptr fs:[00000030h]	16_2_00566FCA
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566FAF mov eax, dword ptr fs:[00000030h]	16_2_00566FAF

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'

Jump to behavior

Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	Security Software Discovery721	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion311	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information11	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TNTNumber1062324.PDF.exe	42%	Virustotal		Browse
TNTNumber1062324.PDF.exe	32%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358491
Start date:	25.02.2021
Start time:	17:45:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TNTNumber1062324.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Execution Graph export aborted for target TNTNumber1062324.PDF.exe, PID 6072 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.84338309214011
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TNTNumber1062324.PDF.exe
File size:	135168
MD5:	90524c4f4816eb22693e92212b8cab6c
SHA1:	b10d499c6aedcc0c0a3cf728a609466824a73d19
SHA256:	adea37317bf08b2dbb86164c609b0ee2eec3ccd6ef0e82c1c46d8447623e5899
SHA512:	676d45524b435f4736ea7f42945c196f27226f0428214c0616626a6c8fe74cb6e803549dd31b2125b2eda7d95643b9e5ab8c896cdae04646a3bab7e974510e41
SSDEEP:	3072:i4wVUPBu0Mxbf+rr3AfKDeQVXrbGQqwV:i4wVUPgxbf+rr3AfKSQVXrqQqwV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....."Q.................`...................p....@................

File Icon


Icon Hash:	01d292796dda0080

Static PE Info

General
Entrypoint:	0x4013dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x512282FE [Mon Feb 18 19:37:34 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cc882d101998a701353b40b0cd8c341a

Entrypoint Preview

Instruction
push 00412ED0h
call 00007F0CB4E2DD63h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+198A3DB9h], ah
sub byte ptr [eax], ah
inc esp
mov al, byte ptr [F9C22134h]
xor eax, 0000BFC7h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
jc 00007F0CB4E2DD7Fh
or al, byte ptr [edx+6Fh]
jc 00007F0CB4E2DDC6h
push edx
inc ecx
push eax
inc ecx
inc ebx
inc ebp
dec edi
push ebp
push ebx
add byte ptr [edx], dh
or eax, 0061430Ah
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add al, B6h
fisub word ptr [edi-44h]
and dl, byte ptr [C59A4D6Ch]
pop esi
mov esp, dword ptr [ebp+23h]
or al, D3h
test eax, 3FC1CD10h
jc 00007F0CB4E2DDB9h
sub byte ptr [esi-7D7ED3EBh], 00000009h
sar dword ptr [edx], 4Fh
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb dword ptr [ecx], eax
add byte ptr [edi+edi*2+0D000000h], ah
add byte ptr [ebx+65h], dl
imul esi, dword ptr [esi+65h], 6Eh
jnc 00007F0CB4E2DDE0h
jne 00007F0CB4E2DDDFh
insd
jc 00007F0CB4E2DD73h
or eax, 49000C01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x160c4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x83de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x154f4	0x16000	False	0.397283380682	data	5.49793705448	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0xa18	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x83de	0x9000	False	0.340304904514	data	3.5303201949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x202b6	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x1ec8e	0x1628	dBase IV DBT of \200.DBF, blocks size 0, block length 4608, next free block index 40, next free block 0, next used block 0
RT_ICON	0x1cfe6	0x1ca8	data
RT_ICON	0x1c33e	0xca8	data
RT_ICON	0x1bfd6	0x368	GLS_BINARY_LSB_FIRST
RT_ICON	0x19a2e	0x25a8	data
RT_ICON	0x18986	0x10a8	data
RT_ICON	0x1851e	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x184a8	0x76	data
RT_VERSION	0x18240	0x268	MS Windows COFF Motorola 68000 object file

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0000 0x04b0
InternalName	SEMICHORIC
FileVersion	1.00
CompanyName	Sinth Radio
ProductName	Sinth Radio
ProductVersion	1.00
FileDescription	Sinth Radio
OriginalFilename	SEMICHORIC.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: TNTNumber1062324.PDF.exe PID: 7092 Parent PID: 5876

General

Start time:	17:46:30
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\TNTNumber1062324.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	90524C4F4816EB22693E92212B8CAB6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092

General

Start time:	17:49:09
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\TNTNumber1062324.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	90524C4F4816EB22693E92212B8CAB6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092 TNTNumber1062324.PDF.exeCOMMON

Executed Functions

Non-executed Functions

Function 00560C52, Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
,N, xrefs: 00560D7A

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8k$,N
API String ID: 0-741156155
Opcode ID: eeac8a5f4d8a472da50e531a3cdff44f449022623269a120a0d46a6580081eba
Instruction ID: baeeef76b12351c3fe496c35fc7cbce9aca97f11058f012f81388fa8728263ca
Opcode Fuzzy Hash: eeac8a5f4d8a472da50e531a3cdff44f449022623269a120a0d46a6580081eba
Instruction Fuzzy Hash: B1318A20548786DDEB3446A484D83BF1E65BFC1300F389F5BDC53830D2DA659D849216

Uniqueness

Uniqueness Score: -1.00%

Function 005613D6, Relevance: 1.6, Strings: 1, Instructions: 380COMMON

Download Yara Rule

Strings

i., xrefs: 005630E5

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: i.
API String ID: 0-2362984893
Opcode ID: 69a602908e0948590965b5d3ed8997e062e4fdae11d8270e42fcaa34ce7add6b
Instruction ID: b559652624d37e62c71bcd59f43633fafafb2ec2b3a1603a12f2544620ab5457
Opcode Fuzzy Hash: 69a602908e0948590965b5d3ed8997e062e4fdae11d8270e42fcaa34ce7add6b
Instruction Fuzzy Hash: F9C15470248605EBFF214E50CD5ABE93E62FF45314F304A29FE466B1D1C3B98A84AB59

Uniqueness

Uniqueness Score: -1.00%

Function 00561D16, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e373e85165234a767a08a8657bbf49b6fac8c6a1aa60a00bef7e0dc4f873f0
Instruction ID: da8be6914d55ea190e5bee87a9adb9c1da5b0265dd386a782ab8c1b0b60362ff
Opcode Fuzzy Hash: c2e373e85165234a767a08a8657bbf49b6fac8c6a1aa60a00bef7e0dc4f873f0
Instruction Fuzzy Hash: ABC1E370748F02EFD7549F28CC94BE5BBA4BF48354F284A29EC5A93341DB34A894DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00566F1F, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8740d43b1cf2779a39abdda98bd08248fb336a76f168b0feeb2d5f2ae7531a
Instruction ID: e1e1ad1f831dd719f06b4af58c5d0c074b1a0ac5a6489f51afa4f7fa4f34883c
Opcode Fuzzy Hash: 3c8740d43b1cf2779a39abdda98bd08248fb336a76f168b0feeb2d5f2ae7531a
Instruction Fuzzy Hash: CAA1D97050C34ACEDF24CF2485D8765BEA1BF6A328F648A9AD8974B2D6C7308442D726

Uniqueness

Uniqueness Score: -1.00%

Function 00566F0E, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df37509efb5c9592e2e789fe73bd15142a3df42d095781f62499246c1bbcacf4
Instruction ID: 093adf29df7ea3545164ac47be62843899c4d7041c82ae84ca62b3dfd985d1d5
Opcode Fuzzy Hash: df37509efb5c9592e2e789fe73bd15142a3df42d095781f62499246c1bbcacf4
Instruction Fuzzy Hash: 20610C7450C34ACEDB24CF28C494761BFA1BF6B328F548A9BD8A64B2D6D3358442D727

Uniqueness

Uniqueness Score: -1.00%

Function 00566F39, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233e30d228ec563cbe3199a5aa1d9f0aea20d3b96e7d48f6bfb82a48b78db5ec
Instruction ID: 64c00b9c05ea113dfccfff8ab4ecd91069fdab0cead952b10b218e7287c87147
Opcode Fuzzy Hash: 233e30d228ec563cbe3199a5aa1d9f0aea20d3b96e7d48f6bfb82a48b78db5ec
Instruction Fuzzy Hash: 8451EA7450C34ACEDB24CF28C494765BEA1BF6B328F548A9AD8964B3D6C3358442D727

Uniqueness

Uniqueness Score: -1.00%

Function 00566F5D, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fc677c8a1c6c34a1264fe05648eb5c0f42288cfe6d526750bee1ff2bc0997a
Instruction ID: d05fceb4c3f1f2ac7a8a96059b05852ab80675b35cd368424031c41ebbb2932c
Opcode Fuzzy Hash: 74fc677c8a1c6c34a1264fe05648eb5c0f42288cfe6d526750bee1ff2bc0997a
Instruction Fuzzy Hash: 4251D97450C38ACEDB24CF28C494761BFA1BF6B328F548A9ADC964B2D6C3358442D727

Uniqueness

Uniqueness Score: -1.00%

Function 00566F79, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045a1c2f27ef5b607980292a8cdae7b6398017228c95e0db7651c013ce2c0398
Instruction ID: f13bda80815ad8fe328fd5d5e257be071a331ef8427dea60bf99befb68ebc315
Opcode Fuzzy Hash: 045a1c2f27ef5b607980292a8cdae7b6398017228c95e0db7651c013ce2c0398
Instruction Fuzzy Hash: D651DB7450C38ACEDB24CF28C494761BFA1BF6B328F548A9AD9964B2D6C3358442D727

Uniqueness

Uniqueness Score: -1.00%

Function 00566FCA, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f40e723b1cfe64cfe592f91b979d185c0f33aa86cf2cb537037339e86061793
Instruction ID: c53eb3d06c582564dbad97d9a649f17d8100ea2dae737c5e9bf6749d9d91aa18
Opcode Fuzzy Hash: 2f40e723b1cfe64cfe592f91b979d185c0f33aa86cf2cb537037339e86061793
Instruction Fuzzy Hash: 8C51EA7450C38ACEDB24CF28C4947617E91BF6B328F588ADAD8A64B2D6D3358442D726

Uniqueness

Uniqueness Score: -1.00%

Function 00566FAF, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a91a6ab60e1c92a9c891cb3937b0266a91cc4c18dc93031def68a05767c1a13
Instruction ID: e6f71c84d4f825b4e7e1639067687c8650381089b0c71e8be41126a65881072e
Opcode Fuzzy Hash: 1a91a6ab60e1c92a9c891cb3937b0266a91cc4c18dc93031def68a05767c1a13
Instruction Fuzzy Hash: BB51C97450C38ACEDB24CF28C4947617EA1BF2B328F548A9AD9964B3D6C3358482D727

Uniqueness

Uniqueness Score: -1.00%

Function 0056250E, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a585e21ced95c48daf50044929449c735a46bc4dd229c93e0d0548aa5852c53
Instruction ID: 47b17d7dc11b86d83cd6ca06a6654dc31970b8a7748c7c0b3317676fa44e0eb4
Opcode Fuzzy Hash: 2a585e21ced95c48daf50044929449c735a46bc4dd229c93e0d0548aa5852c53
Instruction Fuzzy Hash: 78412570248741EFEB245B20C959BB97FA1BF64350F308959F8475F1E2DBB4CA84AA12

Uniqueness

Uniqueness Score: -1.00%

Function 0056693A, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da3c2693d623437c6e3f38163a4fe58ed2e3566ef97f82d2f7fa3507f75b189
Instruction ID: 2bd23bdc12c15c756a23acd282fc4fd4a7446ac60f53f2990dc3f1fc8510f9e4
Opcode Fuzzy Hash: 2da3c2693d623437c6e3f38163a4fe58ed2e3566ef97f82d2f7fa3507f75b189
Instruction Fuzzy Hash: 1521AC30008703EAFB3149A48A143B17D56BB46340FB48B3A8CD3A71D4DAB569C1E1D7

Uniqueness

Uniqueness Score: -1.00%

Function 00562522, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7945493b8ad04a4aa947309717af473f3f8ab5b86dc8151c87ebf3d47d018d64
Instruction ID: fdbc184039099c56e879bcd33b7aa2218136bba79b7ff75b6bb92f747780e85b
Opcode Fuzzy Hash: 7945493b8ad04a4aa947309717af473f3f8ab5b86dc8151c87ebf3d47d018d64
Instruction Fuzzy Hash: 1E312870288741DEDB345B20CD99FA83FA1BF61714F20895AED836F1D2DB708A84E616

Uniqueness

Uniqueness Score: -1.00%

Function 00566967, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949329265d8cb10af172e4b83f8af91fd744aa9c7e5f2800efa444460840ddfa
Instruction ID: 06715a8f1573ae8611f6bc3a12fb3d6a96ea4792c9e8f78731784dc3d199506d
Opcode Fuzzy Hash: 949329265d8cb10af172e4b83f8af91fd744aa9c7e5f2800efa444460840ddfa
Instruction Fuzzy Hash: F8216A30108613E6EB3159A4CA143B2BD16BB46350FB48B3A9CE3A71D4EAB069C0E5D7

Uniqueness

Uniqueness Score: -1.00%

Function 00562555, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8008cc3f74380211e62a8f6fe2a54cceb057cdf808f9b021b764cf03d316081
Instruction ID: bcf2c3ddbe73d6d58a17f1272c19853636f8541d8615953bb4710a2d2e590d3f
Opcode Fuzzy Hash: a8008cc3f74380211e62a8f6fe2a54cceb057cdf808f9b021b764cf03d316081
Instruction Fuzzy Hash: F721F570288741EADB345B20C99AFA83F91BF50714F308D5AF9431F1E2DB708A45EA11

Uniqueness

Uniqueness Score: -1.00%

Function 0056699E, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d376887531de0c0c689145157a5036f27978e13b1188caa20b3a77922b2ed21c
Instruction ID: 0c2d55289688b65b213c812b2cc17b4a63b2e44bf6981496ca420c296d9d7d62
Opcode Fuzzy Hash: d376887531de0c0c689145157a5036f27978e13b1188caa20b3a77922b2ed21c
Instruction Fuzzy Hash: 7E115730508613E6FB3159A49A143B1BD26BB46350FB48B3ACCE3B30D4D6B169C0E1DB

Uniqueness

Uniqueness Score: -1.00%

Function 005669DA, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b424009021b206593ccfe40a5e8fedc84827ee97a235030b62a8b4c3b0530ce9
Instruction ID: 3a69b240548e0a21c6a5c6f5fbdd5c4f42997a0b813dd8032a86038b96c8f7be
Opcode Fuzzy Hash: b424009021b206593ccfe40a5e8fedc84827ee97a235030b62a8b4c3b0530ce9
Instruction Fuzzy Hash: F3115930049342E9FB3145E48A183B1BD19BB47300FB48B7AC9D3B70D59AB16AC0E5E6

Uniqueness

Uniqueness Score: -1.00%

Function 005669FA, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1c3e20a884482361e13175ea6cf404cf491159a2c2bbbed8c396f855e3b1d2
Instruction ID: b90996fb744da847903faae3baeaa330aecd3bbeef064744da5ebd9e0826894b
Opcode Fuzzy Hash: ea1c3e20a884482361e13175ea6cf404cf491159a2c2bbbed8c396f855e3b1d2
Instruction Fuzzy Hash: 3B115934008602E5E73149988A143B1BC15BB87310FB4876AD5E3B70E45AB12AC0E1D6

Uniqueness

Uniqueness Score: -1.00%

Function 00566AD5, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26aeb5d1b47b20d2efc58b9aced9028a4e320d9250cc10ee8187480fda10cc1a
Instruction ID: ce71fda7b8ee54c925003769c2cfad645fd940db667d2fd7c239a75f11713f11
Opcode Fuzzy Hash: 26aeb5d1b47b20d2efc58b9aced9028a4e320d9250cc10ee8187480fda10cc1a
Instruction Fuzzy Hash: 50114934009752F5F73159D88A183B1BD15B747310FB48B3999D3B74E446B16EC0E4EA

Uniqueness

Uniqueness Score: -1.00%

Function 00566A55, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8ea9d4047ca9e9c021b2af1f353f386616a7aad2c019751e6c8bbbcc410869
Instruction ID: 8f9e02f2b8f925c60a9aa75df78fe40a0a67a9989aa655073ba699858cc9154a
Opcode Fuzzy Hash: ad8ea9d4047ca9e9c021b2af1f353f386616a7aad2c019751e6c8bbbcc410869
Instruction Fuzzy Hash: 86112634008652E5EB3159988A143B1BD15BB47350EB4872A99E3B70E486B16AC0E4EA

Uniqueness

Uniqueness Score: -1.00%

Function 00566A2E, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10110065ae53da9cbe1163d95f9d63d41215ec15de280f6986ed325da5a98637
Instruction ID: 692aee9adff6823f78db8c452e0bf3014af6784d0325c953df135aed6dc1aaef
Opcode Fuzzy Hash: 10110065ae53da9cbe1163d95f9d63d41215ec15de280f6986ed325da5a98637
Instruction Fuzzy Hash: BF116B30008612E5FB3155D48A143B1BD25BB87310FB48B2A89E3B30E446B16EC0E0EB

Uniqueness

Uniqueness Score: -1.00%

Function 00566AEB, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94110065b9ef0bf78f19821d5f17c02f13f5b533430fedaa2ccb87a959b3ad3d
Instruction ID: 9cb932cf57b239df17322cdeb6e280e0cf5b7699d8e352022ed34bb7c3bcb909
Opcode Fuzzy Hash: 94110065b9ef0bf78f19821d5f17c02f13f5b533430fedaa2ccb87a959b3ad3d
Instruction Fuzzy Hash: C5114934008712E5FB3159D88A183B1BD15BB47350FB48B3A99E3B70E496B16EC0E4EA

Uniqueness

Uniqueness Score: -1.00%

Function 00566A97, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f4dba24a538470fe570c82cf53865b7d1da5a8f3d662fd4d93c8fb5546644e
Instruction ID: 2b2556d85717df103d201dd05bf91dc22a0af4748b9f4b032eab75cecdb9f605
Opcode Fuzzy Hash: c1f4dba24a538470fe570c82cf53865b7d1da5a8f3d662fd4d93c8fb5546644e
Instruction Fuzzy Hash: BA114934008712E5FB3159D88A183B1BD15B747350FB48B3A99E3B74E486B16EC0E4EA

Uniqueness

Uniqueness Score: -1.00%

Function 00566ABD, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66e84e24382cea17a944c292dda891edb110092b2990060ea2821e63c6007ed
Instruction ID: f6223880d241fb956b5cf73013b88440e50c5d42ca6b9e77921c3f3f914773dd
Opcode Fuzzy Hash: a66e84e24382cea17a944c292dda891edb110092b2990060ea2821e63c6007ed
Instruction Fuzzy Hash: 5B014934009712E5F73159D88A183B1BD15BB47310FB48B3A95E3B70E446B16EC0E4DA

Uniqueness

Uniqueness Score: -1.00%

Function 00566B57, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d123922268fe0912555bacdf74ae04844ea056d4d528aa2be7f96dc0f75c1150
Instruction ID: 832bc28487282853176a4d69c6b5b8e5ebf91bfed9e8433520a78a5294745a13
Opcode Fuzzy Hash: d123922268fe0912555bacdf74ae04844ea056d4d528aa2be7f96dc0f75c1150
Instruction Fuzzy Hash: 2B114934008612E5FB3159D88A183B1BD15BB47350FB48B3A99E3B74E486B16EC0E4EA

Uniqueness

Uniqueness Score: -1.00%

Function 00566A82, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d015ecf828927564f33c3f053c765ed7aa66c32f00e8ccf92376c73bc5e900d0
Instruction ID: 669bcb023b2aa5e59bbc293fa986f0bbc79888712e60d1826a1caedee249eeac
Opcode Fuzzy Hash: d015ecf828927564f33c3f053c765ed7aa66c32f00e8ccf92376c73bc5e900d0
Instruction Fuzzy Hash: 48112B34104612E5E73559944A143B5BC15BB46350FB4872AC9E3B70E496B16AC0E5D7

Uniqueness

Uniqueness Score: -1.00%

Function 00566B2A, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5943bab5b2fe19f96a3673caf906502b55e675b631111713ed6b2e8ae00ae04b
Instruction ID: 7e1d21b54342018d13b5da6f22f6b32a71006b745b9ba5fe02494f952f863a7e
Opcode Fuzzy Hash: 5943bab5b2fe19f96a3673caf906502b55e675b631111713ed6b2e8ae00ae04b
Instruction Fuzzy Hash: 87112B34104612E5E73559948A183B5BD15BB46310FB48726C5E3B70E496B16AC0E5D7

Uniqueness

Uniqueness Score: -1.00%

Function 00566B12, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7aa15e4f7494fd0afb138e4aa3500db192245aa60847c22de346161e4ac3a9
Instruction ID: 44d4c44950f996699d147aeccbf8c52be9dfe395f4b96c1a6c2e2e77984e1bea
Opcode Fuzzy Hash: aa7aa15e4f7494fd0afb138e4aa3500db192245aa60847c22de346161e4ac3a9
Instruction Fuzzy Hash: AC012834108212E5FB3555C44A143B1BD25BB86340FB48B3699A3B34E486B16EC0F4E7

Uniqueness

Uniqueness Score: -1.00%

Function 0056631E, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8001646effe75fcc54532cd622536dd74cd9f737203c9204656935d959954964
Instruction ID: e284c207f259120f38fb0f56c013c658782b13faf4c03342ddee55cf1fec7928
Opcode Fuzzy Hash: 8001646effe75fcc54532cd622536dd74cd9f737203c9204656935d959954964
Instruction Fuzzy Hash: 89018730309202CFCE29CA1482E4BB42AA1BF25342FA14E2AEC0397711D721EC80E652

Uniqueness

Uniqueness Score: -1.00%

Function 00566321, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9fee786d949dc70dc7e5dfeddc9d8fb17924cfbbe31937d1d608ff84ecd783
Instruction ID: 86c8eec0b555fc3388930c709e2d20ae593e3fad1c3c307a70dc4ce373a4c191
Opcode Fuzzy Hash: ac9fee786d949dc70dc7e5dfeddc9d8fb17924cfbbe31937d1d608ff84ecd783
Instruction Fuzzy Hash: 47F05E74314702DFCA15DB24C7D4B607B50BF66351F624EAADC429B791C734DC41D652

Uniqueness

Uniqueness Score: -1.00%

Function 00563447, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f129b3d9c45b77cceff80c6663d04908eb090cb99a12a36f871580d3dca5671f
Instruction ID: 2123cd90a2fbdef8a16ef06d1ea655e0a581a64a3564f30fd73c4a5e11fc64ba
Opcode Fuzzy Hash: f129b3d9c45b77cceff80c6663d04908eb090cb99a12a36f871580d3dca5671f
Instruction Fuzzy Hash: B1D05EB6651A81CBEB16DE68C548740BB60A752598F480AD4E8829B282F718DE01CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00563445, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceef756e2113193a7de9a49a8e4d62b94c26c3923e504c9d527a3e5d5b85e2f5
Instruction ID: eeb132fbd9e8880ec5c8f5314ee7fc1cfa604ab47c8498614c9a750a4f50fdff
Opcode Fuzzy Hash: ceef756e2113193a7de9a49a8e4d62b94c26c3923e504c9d527a3e5d5b85e2f5
Instruction Fuzzy Hash: 46C012B6B05280CFEB46CA48C149BA0BBB0BB11385FA80990EC038B342F718EA009A40

Uniqueness

Uniqueness Score: -1.00%

Function 00565B34, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00560959, Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 89cfac3b88d976e594226914c756e6ad8c2db8e38fe8928ca1e28131c27eaafb
Instruction ID: 7b9bfeb32bd503a11bb121a69a27071aa6874c9350e38ecb8e8d51d8e37615ef
Opcode Fuzzy Hash: 89cfac3b88d976e594226914c756e6ad8c2db8e38fe8928ca1e28131c27eaafb
Instruction Fuzzy Hash: 6F615730588746DAEF34159488D97BF1E2ABF81344F386E17AC97831D1DA658DC5A213

Uniqueness

Uniqueness Score: -1.00%

Function 00560942, Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: ee4c9d5e102fb5a81e8d1b52912d899b13d021f6e0c41574695595631451e94b
Instruction ID: 07012462aa1c11a3484315ab82cb0ec17ab6cf0fe1338cef205d140c3cc0a3f2
Opcode Fuzzy Hash: ee4c9d5e102fb5a81e8d1b52912d899b13d021f6e0c41574695595631451e94b
Instruction Fuzzy Hash: A761673058870ADAEF34159488D97BF1E2ABFC1344F386E27AC57931D2EA758DC5A213

Uniqueness

Uniqueness Score: -1.00%

Function 00560996, Relevance: 5.2, Strings: 4, Instructions: 231COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: ff57e3c81133ef661eb50c2e5a4e842dbd0d71b7405fd146eca02ed9f57e48af
Instruction ID: b6a6c0e8841cc77532ad7c40eef00f971e8acb1deef66034dd68fffdb2945aca
Opcode Fuzzy Hash: ff57e3c81133ef661eb50c2e5a4e842dbd0d71b7405fd146eca02ed9f57e48af
Instruction Fuzzy Hash: DE617830588749DAEF3419A488D97BF1E1ABFC1344F386E17EC57831D2DA658CC59213

Uniqueness

Uniqueness Score: -1.00%

Function 0056097D, Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: ec7339e1be5270b979c4fc27bcd3c88336c6d62ad1f8c830030f19fcba5b9134
Instruction ID: 3731fc5d9080c8efac54893e1ba39779ce31f26a5abfeec6e1b6582c01a657e0
Opcode Fuzzy Hash: ec7339e1be5270b979c4fc27bcd3c88336c6d62ad1f8c830030f19fcba5b9134
Instruction Fuzzy Hash: 6A616830588745DAEF34159488D97BF1E1ABFC1344F386E17AC97831D1DA658DC59213

Uniqueness

Uniqueness Score: -1.00%

Function 005609E1, Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 414c4db5ddd6698bceac619fdb0deebbcae9f0ddeed98d28b7c41c54f8219361
Instruction ID: db40896a3cf9d7bf9bf87c4bc4b4d3bcb00842af23090269c5146cd581574de9
Opcode Fuzzy Hash: 414c4db5ddd6698bceac619fdb0deebbcae9f0ddeed98d28b7c41c54f8219361
Instruction Fuzzy Hash: 7B515730688749DAEF341AA488997BF1E2ABFC2344F346E17AC57431D1EA758DC5E213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A01, Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 16ac5e255e985176ef5e406b69b39089ab4ceae6bdf2dda6e780e226ce23de32
Instruction ID: cab564a6aad7d75d2248eb3f3aa931bdb8536fd18005063699b7c61c37b3e56c
Opcode Fuzzy Hash: 16ac5e255e985176ef5e406b69b39089ab4ceae6bdf2dda6e780e226ce23de32
Instruction Fuzzy Hash: 5A517930688749DAEF341AA488997BF1E2ABFC1344F386E1BAC57431D1EA758DC5D213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A16, Relevance: 5.2, Strings: 4, Instructions: 206COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 5317cb8fe96c668e58e9a7c65cd7b1b4e6a26408e37137770bcc0ef31fd38cad
Instruction ID: 77b9d6acf493cbc6f8a65497ae110905116cf96de1da1cc52a7e89ff2366a906
Opcode Fuzzy Hash: 5317cb8fe96c668e58e9a7c65cd7b1b4e6a26408e37137770bcc0ef31fd38cad
Instruction Fuzzy Hash: F9517730688749DAEF341AA488997BF1E6ABFC1304F38AE17AC57431D1EA758DC5D213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A3D, Relevance: 5.2, Strings: 4, Instructions: 203COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: a9e246fdbe42f5d0f9ef4dcfb706f8d8032abb1643cd78de489506327019159e
Instruction ID: 3915b0d4be1d1ce4f8e628a67465f10dd0068a8ab753ff18733134a7fb9e1628
Opcode Fuzzy Hash: a9e246fdbe42f5d0f9ef4dcfb706f8d8032abb1643cd78de489506327019159e
Instruction Fuzzy Hash: 1A518A30588749DAEF341AA488997BF1E2ABFC1344F346E17AC57431D1EA758DC5D213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A52, Relevance: 5.2, Strings: 4, Instructions: 199COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: af1b79a95b6d426de920cb52bdba3c446d6a7c4e4fe5bf7459073a7a1045001b
Instruction ID: a76f1d490eb3cb893c699ba0ab9f08df2a795b67b100826062c23e98b8a65c7d
Opcode Fuzzy Hash: af1b79a95b6d426de920cb52bdba3c446d6a7c4e4fe5bf7459073a7a1045001b
Instruction Fuzzy Hash: 05518A30688749DAEF3419A488997BF1E26BFC1304F34AE17EC57831D2EA758DC59213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A7B, Relevance: 5.2, Strings: 4, Instructions: 193COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 8e39773b93e6f2373fd3f9b41021aaabe2d34f66bf349d11eea2cdda8e281583
Instruction ID: 5260ecb6cca765b90fad3a53d0da8a8a9e2077c2018fd179d1024628e384f885
Opcode Fuzzy Hash: 8e39773b93e6f2373fd3f9b41021aaabe2d34f66bf349d11eea2cdda8e281583
Instruction Fuzzy Hash: 69519930688749DAFF3405A488997BF1E2ABFC1304F386E1BAC57431D1EA759CC59213

Uniqueness

Uniqueness Score: -1.00%

Function 00560AB2, Relevance: 5.2, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: e959de34489ba55cb32dae02108c2c0dd9be5f51032f2b918d7b2ca9c80c4316
Instruction ID: a3843b627a7b3af413ef0507376539be1bea1025c295a91711c6ffac776a28dd
Opcode Fuzzy Hash: e959de34489ba55cb32dae02108c2c0dd9be5f51032f2b918d7b2ca9c80c4316
Instruction Fuzzy Hash: AF516730548749DAEF3405A488997BF1E2ABF81314F34AE1BEC57931D1DA759CC59213

Uniqueness

Uniqueness Score: -1.00%

Function 00560A9E, Relevance: 5.2, Strings: 4, Instructions: 185COMMON

Download Yara Rule

Strings

8k, xrefs: 00560E1A
P=n, xrefs: 00560BCB
,N, xrefs: 00560D7A
8P,o, xrefs: 00560ADA

Memory Dump Source

Source File: 00000010.00000002.1161664998.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_560000_TNTNumber1062324.jbxd

Similarity

API ID:
String ID: 8P,o$8k$P=n$,N
API String ID: 0-3247417336
Opcode ID: 55d6024a7ef6244095f16a768e60b6089f12f6ff2eefa2b7cd9c62bf9919ffd0
Instruction ID: f4d32b4cf2a7148f6d89839c22efbffb5bd40a8a8beaa143cb4f3d6b13fd17b2
Opcode Fuzzy Hash: 55d6024a7ef6244095f16a768e60b6089f12f6ff2eefa2b7cd9c62bf9919ffd0
Instruction Fuzzy Hash: E0518730688749DAEF34199488997BF1E6ABFC1304F38AE17EC47831D2EA759DC59213

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TNTNumber1062324.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: TNTNumber1062324.PDF.exe PID: 7092 Parent PID: 5876

General

Chronological Activities

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092 TNTNumber1062324.PDF.exeCOMMON