Play interactive tour

Edit tour

Analysis Report TNTNumber1062324.PDF.exe

Overview

General Information

Sample Name:	TNTNumber1062324.PDF.exe
Analysis ID:	358491
MD5:	90524c4f4816eb22693e92212b8cab6c
SHA1:	b10d499c6aedcc0c0a3cf728a609466824a73d19
SHA256:	adea37317bf08b2dbb86164c609b0ee2eec3ccd6ef0e82c1c46d8447623e5899
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

TNTNumber1062324.PDF.exe (PID: 7092 cmdline: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' MD5: 90524C4F4816EB22693E92212B8CAB6C)

TNTNumber1062324.PDF.exe (PID: 6072 cmdline: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' MD5: 90524C4F4816EB22693E92212B8CAB6C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

System Summary:

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , CommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, NewProcessName: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, OriginalFileName: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , ParentImage: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe, ParentProcessId: 7092, ProcessCommandLine: 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe' , ProcessId: 6072

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: TNTNumber1062324.PDF.exe	Virustotal: Detection: 42%			Perma Link
Source: TNTNumber1062324.PDF.exe	ReversingLabs: Detection: 31%

Compliance:

Uses 32bit PE files

Show sources

Source: TNTNumber1062324.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: TNTNumber1062324.PDF.exe

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process Stats: CPU usage > 98%

Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TNTNumber1062324.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TNTNumber1062324.PDF.exe, 00000000.00000000.635376844.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe
Source: TNTNumber1062324.PDF.exe, 00000010.00000000.974522307.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe
Source: TNTNumber1062324.PDF.exe	Binary or memory string: OriginalFilenameSEMICHORIC.exe vs TNTNumber1062324.PDF.exe

Source: TNTNumber1062324.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@0/0

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\~DF66CD68291135151C.TMP

Jump to behavior

Source: TNTNumber1062324.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: TNTNumber1062324.PDF.exe	Virustotal: Detection: 42%
Source: TNTNumber1062324.PDF.exe	ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Source: unknown	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: TNTNumber1062324.PDF.exe PID: 6072, type: MEMORY

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_005639B6 push esp; retf

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: TNTNumber1062324.PDF.exe

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566967
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056693A
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005669DA
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005669FA
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056699E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A55
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A2E
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566AD5
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566AEB
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A97
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566A82
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566ABD
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B57
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B12
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566B2A
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_005613D6

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050671A second address: 000000000050671A instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0CB43B82D8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007F0CB43B82A7h 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 test bh, FFFFFFFDh 0x00000033 call 00007F0CB43B8304h 0x00000038 call 00007F0CB43B82E8h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000504040 second address: 0000000000504040 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: TNTNumber1062324.PDF.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000506B17 second address: 0000000000506A69 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp dword ptr [edi+14h], 10h 0x0000000f je 00007F0CB4C91679h 0x00000011 jmp 00007F0CB4C91642h 0x00000013 cmp cx, ax 0x00000016 cmp dword ptr [edi+14h], 20h 0x0000001a je 00007F0CB4C9165Eh 0x0000001c cmp dword ptr [edi+14h], 40h 0x00000020 je 00007F0CB4C91658h 0x00000022 cmp dword ptr [edi+14h], 02h 0x00000026 je 00007F0CB4C91652h 0x00000028 cmp dword ptr [edi+14h], 04h 0x0000002c je 00007F0CB4C9164Ch 0x0000002e jmp 00007F0CB4C91642h 0x00000030 cmp dx, dx 0x00000033 jmp 00007F0CB4C914D1h 0x00000038 jmp 00007F0CB4C91642h 0x0000003a nop 0x0000003b jmp 00007F0CB4C91642h 0x0000003d test ah, dh 0x0000003f jmp 00007F0CB4C91642h 0x00000041 pushad 0x00000042 mov eax, 00000055h 0x00000047 cpuid 0x00000049 popad 0x0000004a add esi, 00001000h 0x00000050 jmp 00007F0CB4C91642h 0x00000052 pushad 0x00000053 lfence 0x00000056 rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050671A second address: 000000000050671A instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0CB43B82D8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007F0CB43B82A7h 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 test bh, FFFFFFFDh 0x00000033 call 00007F0CB43B8304h 0x00000038 call 00007F0CB43B82E8h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 000000000050673A second address: 000000000050673A instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0CB4C91C4Ah 0x0000001d popad 0x0000001e call 00007F0CB4C9170Bh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000503FCF second address: 0000000000504040 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007F0CB43B90DAh 0x00000010 call 00007F0CB43B74E3h 0x00000015 pop dword ptr [ebp+000000B8h] 0x0000001b jmp 00007F0CB43B82E2h 0x0000001d test cx, bx 0x00000020 jmp 00007F0CB43B82E2h 0x00000022 test bh, bh 0x00000024 push dword ptr fs:[000000C0h] 0x0000002b jmp 00007F0CB43B82E2h 0x0000002d pushad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000504040 second address: 0000000000504040 instructions:
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	RDTSC instruction interceptor: First address: 0000000000566B17 second address: 0000000000566A69 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp dword ptr [edi+14h], 10h 0x0000000f je 00007F0CB43B8319h 0x00000011 jmp 00007F0CB43B82E2h 0x00000013 cmp cx, ax 0x00000016 cmp dword ptr [edi+14h], 20h 0x0000001a je 00007F0CB43B82FEh 0x0000001c cmp dword ptr [edi+14h], 40h 0x00000020 je 00007F0CB43B82F8h 0x00000022 cmp dword ptr [edi+14h], 02h 0x00000026 je 00007F0CB43B82F2h 0x00000028 cmp dword ptr [edi+14h], 04h 0x0000002c je 00007F0CB43B82ECh 0x0000002e jmp 00007F0CB43B82E2h 0x00000030 cmp dx, dx 0x00000033 jmp 00007F0CB43B8171h 0x00000038 jmp 00007F0CB43B82E2h 0x0000003a nop 0x0000003b jmp 00007F0CB43B82E2h 0x0000003d test ah, dh 0x0000003f jmp 00007F0CB43B82E2h 0x00000041 pushad 0x00000042 mov eax, 00000055h 0x00000047 cpuid 0x00000049 popad 0x0000004a add esi, 00001000h 0x00000050 jmp 00007F0CB43B82E2h 0x00000052 pushad 0x00000053 lfence 0x00000056 rdtsc

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_00560C52 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: TNTNumber1062324.PDF.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Code function: 16_2_00560C52 rdtsc

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00563447 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00563445 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00562555 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00561D16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056250E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00562522 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F5D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F79 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_0056631E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F1F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F0E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00565B34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566F39 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566321 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566FCA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe	Code function: 16_2_00566FAF mov eax, dword ptr fs:[00000030h]

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe

Process created: C:\Users\user\Desktop\TNTNumber1062324.PDF.exe 'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'

Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: TNTNumber1062324.PDF.exe, 00000010.00000002.1161753697.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	Security Software Discovery721	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion311	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information11	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TNTNumber1062324.PDF.exe	42%	Virustotal		Browse
TNTNumber1062324.PDF.exe	32%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358491
Start date:	25.02.2021
Start time:	17:45:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	TNTNumber1062324.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Execution Graph export aborted for target TNTNumber1062324.PDF.exe, PID 6072 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.84338309214011
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TNTNumber1062324.PDF.exe
File size:	135168
MD5:	90524c4f4816eb22693e92212b8cab6c
SHA1:	b10d499c6aedcc0c0a3cf728a609466824a73d19
SHA256:	adea37317bf08b2dbb86164c609b0ee2eec3ccd6ef0e82c1c46d8447623e5899
SHA512:	676d45524b435f4736ea7f42945c196f27226f0428214c0616626a6c8fe74cb6e803549dd31b2125b2eda7d95643b9e5ab8c896cdae04646a3bab7e974510e41
SSDEEP:	3072:i4wVUPBu0Mxbf+rr3AfKDeQVXrbGQqwV:i4wVUPgxbf+rr3AfKSQVXrqQqwV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....."Q.................`...................p....@................

File Icon


Icon Hash:	01d292796dda0080

Static PE Info

General
Entrypoint:	0x4013dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x512282FE [Mon Feb 18 19:37:34 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cc882d101998a701353b40b0cd8c341a

Entrypoint Preview

Instruction
push 00412ED0h
call 00007F0CB4E2DD63h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+198A3DB9h], ah
sub byte ptr [eax], ah
inc esp
mov al, byte ptr [F9C22134h]
xor eax, 0000BFC7h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
jc 00007F0CB4E2DD7Fh
or al, byte ptr [edx+6Fh]
jc 00007F0CB4E2DDC6h
push edx
inc ecx
push eax
inc ecx
inc ebx
inc ebp
dec edi
push ebp
push ebx
add byte ptr [edx], dh
or eax, 0061430Ah
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add al, B6h
fisub word ptr [edi-44h]
and dl, byte ptr [C59A4D6Ch]
pop esi
mov esp, dword ptr [ebp+23h]
or al, D3h
test eax, 3FC1CD10h
jc 00007F0CB4E2DDB9h
sub byte ptr [esi-7D7ED3EBh], 00000009h
sar dword ptr [edx], 4Fh
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb dword ptr [ecx], eax
add byte ptr [edi+edi*2+0D000000h], ah
add byte ptr [ebx+65h], dl
imul esi, dword ptr [esi+65h], 6Eh
jnc 00007F0CB4E2DDE0h
jne 00007F0CB4E2DDDFh
insd
jc 00007F0CB4E2DD73h
or eax, 49000C01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x160c4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x83de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x154f4	0x16000	False	0.397283380682	data	5.49793705448	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0xa18	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x83de	0x9000	False	0.340304904514	data	3.5303201949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x202b6	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x1ec8e	0x1628	dBase IV DBT of \200.DBF, blocks size 0, block length 4608, next free block index 40, next free block 0, next used block 0
RT_ICON	0x1cfe6	0x1ca8	data
RT_ICON	0x1c33e	0xca8	data
RT_ICON	0x1bfd6	0x368	GLS_BINARY_LSB_FIRST
RT_ICON	0x19a2e	0x25a8	data
RT_ICON	0x18986	0x10a8	data
RT_ICON	0x1851e	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x184a8	0x76	data
RT_VERSION	0x18240	0x268	MS Windows COFF Motorola 68000 object file

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0000 0x04b0
InternalName	SEMICHORIC
FileVersion	1.00
CompanyName	Sinth Radio
ProductName	Sinth Radio
ProductVersion	1.00
FileDescription	Sinth Radio
OriginalFilename	SEMICHORIC.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: TNTNumber1062324.PDF.exe PID: 7092 Parent PID: 5876

General

Start time:	17:46:30
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\TNTNumber1062324.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	90524C4F4816EB22693E92212B8CAB6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092

General

Start time:	17:49:09
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\TNTNumber1062324.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNTNumber1062324.PDF.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	90524C4F4816EB22693E92212B8CAB6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TNTNumber1062324.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: TNTNumber1062324.PDF.exe PID: 7092 Parent PID: 5876

General

Analysis Process: TNTNumber1062324.PDF.exe PID: 6072 Parent PID: 7092

General

Disassembly

Code Analysis