Analysis Report gg_1.gif.dll

ID:	382549
Product:	CloudBasic
Start time:	09:43:44
Start date:	06.04.2021
Sample:	gg_1.gif.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	990e843cf4b51a69b9319c74b23b733b
SHA1:	6d82f2c85847798b3fa412825b6d25485e6d28d3
SHA256:	7af19b7aa91cf1a3fb479f1f352e0a979df69779256653eb1c9961fc9238fb73
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{782A6823-96F7-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	66C8ADAC3B0EA26778A3392442C15D1C	0BD70A9090C0DCA590D46EE1EBBDF576252F42E7	26B3F1D04EA499FC2768636886D35E3CF7BA9F8EF1EAFF6DF7A4EA3BD3150FB9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{94DF9253-96F7-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	5F7C52271FC236107C8872C475D9A0BC	51CBE523CE5E967744E97A424CB84C3F7FC68EE4	21BCEDB173D6882108AF605E7D39F4618C870B40906942674CC73DBDD6EAD68C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{782A6825-96F7-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	5D3BE8AFFF27013E9BE2C59D55DB58DF	73379BE1491BA6CF5FCA68E6DC46048A1B38A419	A0366F827341D953C1E6635AF67271285D133C3E0F5F66B1DDD7B4513F416410
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{94DF9255-96F7-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	8D6518BE1F49BA58F3A0EA1FCFAC3AC1	212D2895FDB0C32ADF1F32558840A39D6540E224	A582E3EDBB3922ADAB1FFE94BF706605401F1D0B13B328B530660B843D6541BF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	E3CA3D1A615964CFDE72193B2055E5BF	4BE97AFEC88A65EC3E9C1B8F17684E5D5394DBBF	2B602C8DF2A30B69810833A01CCB1B962967539B0843346A3BADFD30F7C6AFD0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BJp5dDFvoQm12CHBfp4PC6aiyg4.gz[1].css	ASCII text, with very long lines, with no line terminators	C912DA2683E71660357A600EE34A7873	5DFD028307D4CD8A66492E807B848FEC177AEC3A	525D57B5D38D8212993C66A33F4CD15EDBD0F260A5AFCF539D092047A908D6EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js	ASCII text, with very long lines	F279A46B56038C41BB3FC11D67D0FE46	B48121E695FD6483CAA7F48DE73FE9F121777109	A9EA274B393E34591387AC0B4DE594BEE296386543DE34F4897281324DB0DCBB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\HdepnBaFj-yarvouFUIlfV4Q9D8.gz[1].js	ASCII text, with very long lines, with no line terminators	4AADD0F43326BAD8EFD82C85B6D9A20E	4093FC4AB9821B646D64C98051A1CF0679CB2188	968849A1E6AAED249C78B6CF1AF585AB6C8482A8C5398AB1D2DC3CB92E9EA68F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MDr1f9aJs4rBVf1F5DAtlALvweY.gz[1].js	ASCII text, with no line terminators	51A9EA95D5ED461ED98AC3D23A66AA15	62FBB857B873BD79BEE7F16D0766A452FA2798A3	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\N55Tc-oLNOuzZam9OghLsR0GD5U[1].jpg	[TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, frames 3	8BC40A6F56CB4477BFB120A472920EC1	379E5373EA0B34EBB365A9BD3A084BB11D060F95	9050D49D0786F054BC4B7DA42690B034C208A4736B7DE430383A3333A51C9835
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NGDGShwgz5vCvyjNFyZiaPlHGCE.gz[1].js	ASCII text, with no line terminators	1F62E9FDC6CA43F3FC2C4FA56856F368	75ADD74C4E04DB88023404099B9B4AAEA6437AE7	E1436445696905DF9E8A225930F37015D0EF7160EB9A723BAFC3F9B798365DF6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Xp-HPHGHOZznHBwdn7OWdva404Y.gz[1].js	ASCII text, with very long lines, with no line terminators	F5712E664873FDE8EE9044F693CD2DB7	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\XvRHqJwJt19aXQca73hQTfvNMxk[1].svg	SVG Scalable Vector Graphics image	58725E06FABDC207D4350D6F3C5B33D0	5EF447A89C09B75F5A5D071AEF78504DFBCD3319	EDD5715C42AD596AFE1CF07A400D4F33A2F5388C18ADFDD169A7E9467BC9E9DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\a282eRIAnHsW_URoyogdzsukm_o.gz[1].js	ASCII text, with very long lines, with no line terminators	3A5049DB26AF9CE03DB6A53D3541082D	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon-2x[1].ico	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	DA597791BE3B6E732F0BC8B20E38EE62	1125C45D285C360542027D7554A5C442288974DE	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\hceflue5sqxkKta9dP3R-IFtPuY.gz[1].js	ASCII text, with very long lines, with no line terminators	857A0DE0BBF14F3427A1AFA5CD985BCE	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\n8-O_KIRNSMPFWQWrGjn0BRH6SM.gz[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	F9D8B007B765D2D1D4A09779E792FE62	C2CBDA98252249E9E1114D1D48679B493CBFA52D	9400DF53D61861DF8BCD0F53134DF500D58C02B61E65691F39F82659E780F403
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\n_C4vBfAV3O9RfkGjfduaZoxjAs[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, frames 3	D7AE018EA70FA15F5E5389E4F96AD768	9FF0B8BC17C05773BD45F9068DF76E699A318C0B	A4F4A44961E03A073E3F351F296EC19C50005AA96360A9E5CEE50E0587738FBB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ozS3T0fsBUPZy4zlY0UX_e0TUwY.gz[1].js	ASCII text, with no line terminators	A5363C37B617D36DFD6D25BFB89CA56B	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	7D10F16EA455E49470853BE05415E27E	0370FE7D24274A9A5909355C042EBBF9E795FD85	1DB14FB96D4E49265DEFB60E98BD6C39A2724B1EBC21D50E0F2E60F3859EE93A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[2].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	B4253CC44B582EBE891CBCDF0EF5CA8B	2D179CB4C761077F9EFB53625FE0B34D01AE3107	9358906D6A9154E881A96AA4E9EDED3CCFDF3DC87B1B922B8FC4C09B970130F5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[3].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 150x150, frames 3	49A2DFF8082FCF50F4311C7867ECEDAD	A125B14C82BFB9A78C711C13CC479FDD1C9266EA	442192ACEE743DBF8DBEC6A3BA8212AF4FDCFA1E08E96894168F11011176F525
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[4].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	D79048C62D1919EBD68359F962DE7D0C	56CA765E294DD844FCD7D56339AC81647DEF4D8E	92B97018B5A41B256E26BDCB5764E3076A44FF3B2DD3C89FC3E1C20A024EA559
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\th[5].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	4BA560E225A43E2EF51F8649A0E8C8DE	3FE52097D629F58AD03B273E2CCDC94E6C6BEB2A	D2598D2530ACA0331C98A18F8F318F70A3109F5D1649181EC7932BA5012CCD57
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\uYzy_SF_Qx-quOm8IecsaqSoOd0[1].svg	SVG Scalable Vector Graphics image	2C4837A751CDB1A7366A56A0BD33EF59	B98CF2FD217F431FAAB8E9BC21E72C6AA4A839DD	AA593C656009A40AC1782DD6FEE1EF31F9D4CCAD9F3F657DDF9A72C1EB7E553A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\3NOUXGXU.htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	4ED2A1CEC00CC1F3BDC8BCCDD4A18E0D	20AB4EB9B7FCC6CFBF4450AA6771731D95275739	98AFC01E23798CD3281177F9F1B3926D1ADE1E0F43B16EABF89B569CB0BB49C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg	SVG Scalable Vector Graphics image	E38795B634154EC1FF41C6BCDA54EE52	16C6BF388D00A650A75685C671AF002CEA344B4B	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DFEABDE84792228093A5A270352395B6	E41258C9576721025926326F76063C2305586F76	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\P3LN8DHh0udC9Pbh8UHnw5FJ8R8.gz[1].js	ASCII text, with very long lines, with no line terminators	EF3DA257078C6DD8C4825032B4375869	35FE0961C2CAF7666A38F2D1DE2B4B5EC75310A1	D94AC1E4ADA7A269E194A8F8F275C18A5331FE39C2857DCED3830872FFAE7B15
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\PA3TC2iNXZkiG2C3IJp5VAvC_yY.gz[1].js	ASCII text, with very long lines, with no line terminators	73BFB9BB67A7271E257A4547007469A5	28F7B820679A99318E0DC596A54480D6AD5C3661	A22BB5BD48C4C578C6BC4FDC4B8FF18F9162848F14E05AE283EC848B08EC8C15
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg	SVG Scalable Vector Graphics image	88E3ED3DD7EEE133F73FFB9D36B04B6F	518B54603727D68665146F987C13F3E7DCDE8D82	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\eaMqCdNxIXjLc0ATep7tsFkfmSA.gz[1].js	ASCII text, with very long lines, with no line terminators	270D1E6437F036799637F0E1DFBDCAB5	5EDC39E2B6B1EF946F200282023DEDA21AC22DDE	783AC9FA4590EB0F713A5BCB1E402A1CB0EE32BB06B3C7558043D9459F47956E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\gDsOfTXNZVl18jxNDvhXqAdf2tM.gz[1].js	ASCII text, with very long lines, with no line terminators	EC15EB7CBFBFAA68BB1DE04A28C80270	D2570D4CFF3139EA66D15799C9E67211F5A03B20	810A85F1E705231989251F3EB52DAFF3F0ACEE09C703339C301A7CBD22CF8FE6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\k5oM71-Oyo7w7ptkcB_2S5dIr7I.gz[1].js	ASCII text, with very long lines, with CRLF line terminators	071CABC528DA3CDD5BD5C7F0EC48ED96	8B665A2DA630D6711E01E838877510F48C40E9CE	9871F6289648EEA5CB484C2307C4E7BCDF3857AEB27EB07E0ACFD4C1B77EDBB5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\lK_FmcR4naKX9hpIwfe9ify1hf4.gz[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	C24FE194A488B12CCE5B3858D12C2C3D	E55B3E549CA42D614BEE0C4538F9EDA6C89DE00D	45A1BD96D9A1BB1F03191C2F062FDC5369542864C4777A67623811BE6463D4D6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\sjm7ZxOOdUKgLq2Lulikx_Lt20I.gz[1].js	exported SGML document, ASCII text, with very long lines, with no line terminators	8FD5ED5E0730854741D73A66E1C8C124	8A4D348BA92FEBAB3A5FC7FFDED98E0841C3CE9C	63C3206CB8509C0A2DD25A0AA3555BD49E7B2E24AE95F6CB7E6521D830C986F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\svI82uPNFRD54V4bMLaeahXQXBI.gz[1].js	ASCII text, with very long lines, with no line terminators	016ECFDB34031F881FA5E34DFBD0B7A1	16D3BA1049939D00AE47AAD053993B4762D9B102	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\t4bd[1].htm	gzip compressed data, max speed, from TOPS/20	7EE7810CBF5D40F9EF682003457B64F9	DE9144D1FA81C47E02DD0AA6F5A2A12FC8470E9F	C2111EE293A0138D879C6FC93517CF346339211042157F28010D75F19A3F9CF4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	E5D2688116BA8D4ABBC53F2493A181BE	2330F5A38AB1DE6979790C84B33DC173F853D6FD	AA1EF9A296A78952F642406AA0F59930CDD23BC5D1714B7E306787CD4064229E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[2].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3	357F88390923FD2D7C54F8EF73A57475	EE6F5D3CBE310AC210CF47D8F1B748B2B0B5205E	80076FB2A8BD57B72985F5F3557F2B4742DE360994CD05CCA6604653E63404E0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[3].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	27368154F2C3CF4EDEBC0A95CED35B43	5CAE3ECA10C9A32BC77AF7AEE1E2944590B8BD37	4406423DC5F852B966777DE5272126839793C96251AB2F063A099C347BE396D9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[4].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	28EB07FE60190EFB31CB18CFD3D7A18E	4AD266DDF9B415DFEA6AB163AEEAAB8F2FEB3D25	89765095BB7B7DFA92CE3D9F7592BA8F776A68B3C603137C4AF2A4CDF73A8A91
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\th[5].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x150, frames 3	D24AE5FCFFF6F8E79776AC8C41E6B6BA	1162C24A9B13E16B032B61C30924A2FC9CFE1BB0	397DC263B80321B619D6B2A8240E092B05CEA0988D2D52CA5B229972BC675440
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\H_VmuFPRwWZ4UrVl0mPztnf3z5U[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, frames 3	B545C910F9993F7F930513DB793F4EE0	1FF566B853D1C1667852B565D263F3B677F7CF95	A797D6446620B867248B43792B9AA457B42ADBB7099D9B3129E0D7743DAF67ED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Jl2vUSlEIqWjk-99MuYp4W74zvQ[1].svg	SVG Scalable Vector Graphics image	6D8EF11CB1C03B39D9ED4E4C9A2190B9	265DAF51294422A5A393EF7D32E629E16EF8CEF4	D72BEAE30A6B2B36C3E03847CE4EA04211D7373D4066FF937A7A05DF4E0C3DB6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg	SVG Scalable Vector Graphics image	6601E4A25AB847203E1015B32514B16C	282FE75F6FED3CFC85BD5C3544ADB462ED45C839	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\MstqcgNaYngCBavkktAoSE0--po.gz[1].js	ASCII text, with very long lines, with no line terminators	55EC2297C0CF262C5FA9332F97C1B77A	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Passport[1].htm	HTML document, ASCII text	7B7D5DA1B057EB0D5A58C2585E80BACA	29714CD8C570E321C1C1C991E77ACE3945312AC6	023CD9B7315636BE1BE24DC78144554B0E76777BD476ED581378172DE9B12A05
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\RXZtj0lYpFm5XDPMpuGSsNG8i9I.gz[1].js	ASCII text, with very long lines, with no line terminators	E34F2CDADA9986F52CCFAB129645ABAC	93FF6CA74EB48A6825F9BC21BEE52159987C0A82	79C181E7D29CF735AE99FD86C42934D7FD6FB51E6481D788E1CB812C7DC63DF6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ULJCe4CXM2DCjZgELMGm2K4PcPo[1].png	PNG image data, 1642 x 116, 8-bit colormap, non-interlaced	2D786704B21ADFC7A5037DE337502280	50B2427B80973360C28D98042CC1A6D8AE0F70FA	54CC8693087FBAF873F72FE9CB4539499A0BC7016225F563DB92B9BFE7EEA564
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dnserror[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	2DC61EB461DA1436F5D22BCE51425660	E1B79BCAB0F073868079D807FAEC669596DC46C1	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\eRYlUYIMYsB_Pt8B7FTik-pl5cs.gz[1].js	ASCII text, with no line terminators	EEE26AAC05916E789B25E56157B2C712	5B35C3F44331CC91FC4BAB7D2D710C90E538BC8B	249BCDCAA655BDEE9D61EDFF9D93544FA343E0C2B4DCA4EC4264AF2CB00216C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg	SVG Scalable Vector Graphics image	D9ED1A42342F37695571419070F8E818	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\mw5FvbmnxUiS8Gbwzw9L14Ee8F8.gz[1].js	ASCII text, with very long lines, with no line terminators	32C8A14D92DE1A36A11B131D48E4C307	5498735530EE16C300CB9E1691BA7356D3163BAC	CCB7262C883581BB88476377D29E45FE415A403B5DB1143EE493166EF3E2D047
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\pXscrbCrewUD-UetJTvW5F7YMxo.gz[1].js	ASCII text, with very long lines, with no line terminators	D6741608BA48E400A406ACA7F3464765	8961CA85AD82BB701436FFC64642833CFBAFF303	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sTWC0LplwPyIP_jw8VjHps800ZQ.gz[1].js	ASCII text, with very long lines, with no line terminators	44AD44162E25A1DB1F46F78B8ECFAD42	C63A0E7B132221D572A541F700601356627A98A4	5AE500A4737BE7B187EEA99AAB81CF3D4796D23550F7C5349DE2430E6624918D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\swyt_VnIjJDWZW5KEq7a8l_1AEw.gz[1].js	ASCII text, with very long lines, with no line terminators	A8D7D1B3681590980B2D7480906078DB	C9A7A400DB1EBAD4DCA028546EE5F5B2EF4136BD	1390485DC88B6230389D9C95232A3710BF38D47271708A279B12D7E68E43F649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\test[1].htm	ASCII text, with no line terminators	E82D9BD501B46DF5CB2B650AF9E1B126	0FE6876226E88D8104ED51CB6329EB172BBA8D68	C2BA8FCCFC980BCC8FC24E7A41BFCFEE88CCA9331C8D4D62890D7DFAB4A12226
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	C27EAAD7FDCAD067348EB8426A6643DD	D5362D86359F58F1F08EBC9E9F7627F61CB70909	20EA77BAF0828E450BB7EB0895759B7C760D1F4C00B1EF5366F91B2F23B30429
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[2].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	E8349E3EA51D3A6E24284176981359EA	0E009269A3DC197C7C46B765D24AC1F531AA4810	D88B8253842FB58AADAAEA2166863ADBFF91B77F0CAD8501100A47B7B9A999F6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[3].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	A6E6FD3AB66E5A2F49A45CCB2B61B19D	9A7EC1C26991AFC76B694BECB95639DDE2AB9DA2	8FB3DE41169B7B8547E4F07836C9C9503655B613678E58DE449A0CB65DFACCE4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[4].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	AFF39E85868825504E8463C5CDD11BD7	DEF891B9A50BA0F8DA20DC93D5DFD80FFE330478	17C3E9E4228BCBF6E56795D6D8539791483D4B1A07E4A542F32282D99C94FB75
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[5].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	76A08CC374F645ADFD2D574AEA9E1F67	EF6301792289F45E1914290BD3901BE5C3C08ED7	6D4A8E2E63961DF63F503AC5A323D9FAD4F738E8720BD98C9A302794CB62847C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[6].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	CB467408920B249304F096825FAD3555	34B1FB66BB1993D6F421D03E60571B2D6B8BD82B	6244F0B65FD5FDB55035289E22AE746FDA4FB8A73FA5099AC1765FE40EBF15F3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\th[7].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	35639C3C895B57D5E4B5F764ABE5D940	269D5DE5F01924ADF9665A9F4D163EA553794BAA	EA18037D4EB9771263CCA340B2AD31DA0CA807DAE7CDF8FD437266A853DE3D00
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg	SVG Scalable Vector Graphics image	91CD11CFCCA65CFACE96153268D71F63	E0BE107728D3BF41D8136220DA897D798A2AC60F	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\5rqGloMo94v3vwNVR5OsxDNd8d0[1].svg	SVG Scalable Vector Graphics image	4E67D347D439EEB1438AA8C0BF671B6B	E6BA86968328F78BF7BF03554793ACC4335DF1DD	74DEB89D481050FD76A788660674BEA6C2A06B9272D19BC15F4732571502D94A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6sxhavkE4_SZHA_K4rwWmg67vF0.gz[1].js	ASCII text, with very long lines	07F6B49331D0BD13597934A20FAC385B	B39E1439D7FC072AF4961D4AB6DE07D0BC64B986	4752E030AC235C73E92EC8BBF124D9A32A424457CA9A6D6027A9595DA76F98D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\CMm2G4GK3T9XHTMByeN2QI1OVUs[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, frames 3	A0BFF1A68EAB91DAC459F3B2EB4B3DE3	08C9B61B818ADD3F571D3301C9E376408D4E554B	7DB453C22084AEF847E1CA04E9FC1B1CF0D468A5C11ABF3C09968C840CD96A87
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ELqKWpA6KkapLUFbOLS-IQ2zfXc[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, frames 3	968C49AC8A1A3EF85F2884F226C55742	10BA8A5A903A2A46A92D415B38B4BE210DB37D77	E441AFC03F067D1D85DF1F69EB8F482BFDA697CC217E11E1547B3CE964B15B2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\JDHEvZVDnqsG9UcxzgIdtGb6thw.gz[1].js	ASCII text, with very long lines, with no line terminators	B4D53E840DB74C55CC3E3E6B44C3DAC1	89616D8595CF2D26B581287239AFB62655426315	622B88D7D03DDACC92B81FE80A30B3D5A04072268BF9473BB29621E884AAB5F6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg	SVG Scalable Vector Graphics image	C04C8834AC91802186E6CE677AE4A89D	367147873DA32FACB30A1B4885A07920854A6399	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\RrvsBuqGHDpqG7NAz4Q0BMOqQBg.gz[1].js	ASCII text, with very long lines, with no line terminators	7651609B4BE35F5DE8024F570EF6CF87	4B72E4BB1D8F170D6B17FA1D769584A7D0F02F70	4CA5C607D14D17F8A9EEA9FB0A624BC00C49BFDFBB6A78E1292EAE1461B7D9F0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\b4Jy0kwhnsWcsDQyuzAEsN7RmhQ[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, frames 3	094FAB391B9B906B8A88922CE6827471	6F8272D24C219EC59CB03432BB3004B0DED19A14	E7DAFF9BBB32681540E010FB10BA87D51938B42B275D0C422E253CED0DD96B79
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bLULVERLX4vU6bjspboNMw9vl_0.gz[1].js	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\hqx6FcD0hjfzrON5oLgx2RMMD1s.gz[1].js	ASCII text, with very long lines, with no line terminators	56583BD882D9571EC02FBDF69D854205	8DFF13B78F4CBCC482DC5C7FC1495390200C0B94	DF0089A92B304A88F35AA0117CF8647695659AAF68B38B1B7A72A7C53465E9C7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\kBH4DSEA84cgV7IKw7_Bwvm2NpI[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, frames 3	5CCC9B225B51915169D6F4C27FA26C9A	9011F80D2100F3872057B20AC3BFC1C2F9B63692	10D8D2141A01589A82B139B01A75B74D9DFAB16D273C9B2EC7F5087D3EF16B3B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\model[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	B12C190DFA30C8EF3CACFB2304F8A6BB	4485BA9BCEC741F844120DA43AD4C67EED5EFF0F	E18575EBB4698CD7418A52E923B8815AA1B288FB160F12A9B8DFE69C816FCA67
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\msnpopularnow[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	54CD333FA1228D57F2DAEB0617134235	CBA447E953F17FB044B4455A0E36916F1E264E4E	C0EAE134519D55C8FC8C1E86772F43569FB54FFA44DF785E387F3CC48D106DCD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\n1U5gwBiwMo7s-fWOh2kSe3Kils[1].jpg	[TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, frames 3	05034EB84E5E7915CA36EB6FE59DFBA7	9F5539830062C0CA3BB3E7D63A1DA449EDCA8A5B	9BEC2E05752C0699DB84352BB6E3DD4E5DAA927D32EC8123966F4A8FDF8B181A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\sbi[1].htm	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators	8147A3C6CCDAD2147CA32BA6DB54E40A	3257CCC8CED1107ACBE3697B61F1C5ED3A86A4E6	E783F26B771F68588FF468DE04C50E6A3E7BC4A11FEBDB52A17511E9DFE91297
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1920x1080, frames 3	DDCE5ED235CCBFFDA3F3735F75F80C0F	F266C24FA6F01459F51C97ADB00523BD214C653C	78EB4A3213EBE7BB95F87D206AE29064D514628E6A430334D0E13756AA131DE5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[2].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	5ABBBE53C535080AE3BE91FE6F0B93C1	6A991409D0A6886057BBD0DC9AE71AAFB111E8C1	B692C27DDDA4FFE62BB2C57AA229EB9298EBDA7726BC227089CEEFDF5E05AD4C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[3].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 150x150, frames 3	8816AF91855EFB0BB97FAF7429A17E5A	7FFA5A24554D8CA448E6D1F98A7AC31F36CB2FC7	1C54DB3F6FA0501AB0C6ACC1BFFC8629009F76BE5AA6DE4239FEB24E3C6AEBFC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[4].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	140F382635756FE19E1CD67D8CDAB923	1B0F1B61C068E01CE6FFDC5FFCADDD5E039D0DA5	216E799943B615F3EBF0FC09391810AF53FDE0EDCBEC4300F2B01B98AF346FAE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\th[5].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 150x150, frames 3	6252E142AFB55FA1C5DD093059E5B784	FA2DEDFB97B7BF7B2D1052EA4B0DEC214E4217A1	24461B5094C1DC8AA9F6741AD78006FF35954478933E003E2CD036EA8E303EA4
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	EF7712044B485341CC54E1BA47F8EC7F	5B6D83A8A70308524C9244CAB6D0A3EB98BA673B	90D45D3A6AB9207FF4F9CF4863A36D8EC4B8B71F2231302F7AF2A765ADEBFDD8
C:\Users\user\AppData\Local\Temp\~DF0D588EF90ECA28AF.TMP	data	8AF035585D42B4627E50E097B5CEB027	9C7CD8498237BA4CFABA079AA26FE30A32E51C34	02DA6FF9E6A74BC6D426FF55632D2955D3E8BF5DE1C5F27D210DB79B75182D55
C:\Users\user\AppData\Local\Temp\~DF4798CE6240A9FE5B.TMP	data	687950E470D3E73D788B0F89EEDA5B40	CEAC36E2B741D796141B18892F9E2173EC622FC5	DD30C5B7299B7ADBDECA6E9D2A25AC4B89B2E24E5AA1B967C63C6AE795A58D93
C:\Users\user\AppData\Local\Temp\~DF9F5232E2B10FBB40.TMP	data	6E92154CD51FDEAFADE62F25A27739E1	5F75C47ADB7AC70206EDB09A19DC4D8AB0091617	4691B515E607489599A18189E428B5A45C2F69E244813F251B591C682542807E
C:\Users\user\AppData\Local\Temp\~DFD4B3623FFB495759.TMP	data	815869FDB7290C9221EB04BADD82EF97	0224C67B1C1E9D448DF0880760384C9D29BFE423	10137087ABB625EEDE1664FAB6A0869E7E2989BDB005BAEEEC05F9831C75D676

AV Detection:

Found malware configuration

Source: 0.2.loaddll32.exe.30394a0.3.raw.unpack

Malware Configuration Extractor: Ursnif [{"RSA Public Key": "Om1HeBhXBR6NHvmWFG5B2kyl5mdcRMsb8ux2uo9VgGW0O2LzHZKk3w9bxw9stgphU0ayytcOYkK6GCNJlKSeMTZJ5WPgZiX+MaXiUccStEUTXkW1ubp0gdr16sb5U4M+rzWWPvc3s7bj9o1yqSJtP7PmMVp7E+3llLULQ9/DZbAD7SXaft6wcY8wFjSkI+8D"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]

Multi AV Scanner detection for domain / URL

Source: urs-world.com	Virustotal: Detection: 5%			Perma Link
Source: under17.com	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Source: gg_1.gif.dll

ReversingLabs: Detection: 54%

Machine Learning detection for sample

Source: gg_1.gif.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.2.rundll32.exe.10a0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 0.2.loaddll32.exe.10000000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.10000000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Compliance:

Uses 32bit PE files

Source: gg_1.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00C112D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

0_2_00C112D4

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 185.243.114.196 185.243.114.196

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ACCELERATED-ITDE ACCELERATED-ITDE

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic

TCP traffic: 192.168.2.3:49744 -> 185.243.114.196:80

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: login.microsoftonline.com

Urls found in memory or binary data

Source: GiGr-rA9TBhE2c3LJn7PvDweiOo.gz[1].js.21.dr	String found in binary or memory: http://feross.org
Source: {94DF9255-96F7-11EB-90E4-ECF4BB862DED}.dat.26.dr	String found in binary or memory: http://under17.com/joomla/7EMqwcktdPA4c/aMPBQ9O_/2FX3DcgTHroSNZOCOKmShtr/x5dqa0Nz0h/_2Bn6wLNcWZjgLt0
Source: {782A6825-96F7-11EB-90E4-ECF4BB862DED}.dat.20.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/datenleck-bei-facebook-wachstum-z
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/janet-yellen-us-finanzministerin-fordert-weltweite-mi
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/finanzen/top-stories/staatliche-regulierung-allianz-gegen-big-tech-druck-a
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/admirale-begehren-auf-gegen-das-verr
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/alexej-nawalny-klagt-
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/es-h
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/so-tickt-kosovos-neue-staatspr
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/ukrainekonflikt-maas-warnt-russland-und-ukraine-
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/karl-lauterbach-der-blitzableiter-der-republik/ar-BB1fiI
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/coronakrise-laschet-fordert-harten-br
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/das-alles-h
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/fdp-nur-keine-option-von-vornherein-ausschlie
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/l
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/manfred-weber-nennt-eu-beitritt-der-t
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/die-altersheime-hat-man-vergessen/ar-BB1fkRPW?ocid
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/vermischtes/nachtleben-in-israel-eine-nacht-wie-fr
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/abdullah-sollte-von-erdogan-lernen/ar-BB1fktw7?ocid=BingHPC
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/das-grosse-impfen-beginnt-geht-es-nun-endlich-vorw
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/pentagon-usa-beobachten-russlands-aktivit
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/polizei-sucht-mit-superpuma-nach-vermissten-minderj
Source: msnpopularnow[1].json.21.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ressourcen-f

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.361907935.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361917668.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361893951.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440967759.000000000349D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361834154.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361865613.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361939136.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2588, type: MEMORY

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000002.234285102.0000000001170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.470853528.00000000009E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472098490.0000000001110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.361907935.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361917668.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361893951.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440967759.000000000349D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361834154.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361865613.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361939136.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2588, type: MEMORY

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000002.234285102.0000000001170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.470853528.00000000009E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472098490.0000000001110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

System Summary:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001D9F NtMapViewOfSection,		0_2_10001D9F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001EB5 GetProcAddress,NtCreateSection,memset,		0_2_10001EB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002375 NtQueryVirtualMemory,		0_2_10002375
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00C183B7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,		0_2_00C183B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00C1B341 NtQueryVirtualMemory,		0_2_00C1B341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002375 NtQueryVirtualMemory,		3_2_10002375

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F		0_2_0299348F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95		0_2_02991B95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02993A85		0_2_02993A85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02993FA8		0_2_02993FA8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02993BDB		0_2_02993BDB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02995AF6		0_2_02995AF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029928EB		0_2_029928EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029952EC		0_2_029952EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE		0_2_029920EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991918		0_2_02991918
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02993314		0_2_02993314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991000		0_2_02991000
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996424		0_2_02996424
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02994859		0_2_02994859
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299554B		0_2_0299554B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299237B		0_2_0299237B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299247B		0_2_0299247B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991374		0_2_02991374
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02995C76		0_2_02995C76
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299596E		0_2_0299596E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002154		0_2_10002154
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00C14094		0_2_00C14094
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00C197F2		0_2_00C197F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00C1B11C		0_2_00C1B11C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0111348F		2_2_0111348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01113314		2_2_01113314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01111918		2_2_01111918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01111000		2_2_01111000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01116424		2_2_01116424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01114859		2_2_01114859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0111554B		2_2_0111554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01111374		2_2_01111374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01115C76		2_2_01115C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0111237B		2_2_0111237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0111247B		2_2_0111247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0111596E		2_2_0111596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01111B95		2_2_01111B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01113A85		2_2_01113A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01113FA8		2_2_01113FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01113BDB		2_2_01113BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01115AF6		2_2_01115AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_011128EB		2_2_011128EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_011152EC		2_2_011152EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_011120EE		2_2_011120EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A348F		3_2_010A348F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A1000		3_2_010A1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A1918		3_2_010A1918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A3314		3_2_010A3314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A6424		3_2_010A6424
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A554B		3_2_010A554B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A4859		3_2_010A4859
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A596E		3_2_010A596E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A237B		3_2_010A237B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A247B		3_2_010A247B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A5C76		3_2_010A5C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A1374		3_2_010A1374
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A3A85		3_2_010A3A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A1B95		3_2_010A1B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A3FA8		3_2_010A3FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A3BDB		3_2_010A3BDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A28EB		3_2_010A28EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A20EE		3_2_010A20EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A52EC		3_2_010A52EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A5AF6		3_2_010A5AF6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002154		3_2_10002154

Uses 32bit PE files

Source: gg_1.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Classification label

Source: classification engine

Classification label: mal92.troj.winDLL@13/97@4/2

Contains functionality to enum processes or threads

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00C1757F CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00C1757F

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF0D588EF90ECA28AF.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,StartService

Sample is known by Antivirus

Source: gg_1.gif.dll

ReversingLabs: Detection: 54%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,StartService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:592 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5012 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,StartService			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:592 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5012 CREDAT:17410 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

PE file contains sections with non-standard names

Source: gg_1.gif.dll

Static PE information: section name: .code

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996194 push eax; mov dword ptr [esp], 00000004h		0_2_029961AF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996194 push esi; mov dword ptr [esp], 00001000h		0_2_029961B7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996194 push 00000000h; mov dword ptr [esp], ebp		0_2_02996267
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F push dword ptr [ebp-10h]; mov dword ptr [esp], ecx		0_2_029934A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F push dword ptr [ebp-0Ch]; mov dword ptr [esp], ecx		0_2_02993632
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F push 00000000h; mov dword ptr [esp], edx		0_2_029937FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F push edx; mov dword ptr [esp], 00000002h		0_2_0299384A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0299348F push 00000000h; mov dword ptr [esp], ecx		0_2_029938D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push esi; mov dword ptr [esp], FFFF0000h		0_2_029960A8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push ecx; mov dword ptr [esp], 00005267h		0_2_029960C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push 00000000h; mov dword ptr [esp], edi		0_2_029960D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push ebx; mov dword ptr [esp], 00001000h		0_2_029960F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push ebx; mov dword ptr [esp], 000FFFFFh		0_2_0299615F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02996099 push ebx; mov dword ptr [esp], 00406194h		0_2_02996175
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push dword ptr [ebp-1Ch]; mov dword ptr [esp], esp		0_2_02991BF2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push 00000000h; mov dword ptr [esp], esi		0_2_02991CD4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push 00000000h; mov dword ptr [esp], esi		0_2_02991D37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push dword ptr [ebp-20h]; mov dword ptr [esp], esi		0_2_02991DC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push 00000000h; mov dword ptr [esp], ebp		0_2_02991E4C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02991B95 push dword ptr [ebp-20h]; mov dword ptr [esp], ecx		0_2_02991F23
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02994DF5 push 00000000h; mov dword ptr [esp], edi		0_2_02994EA4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02992DF5 push dword ptr [ebp-04h]; mov dword ptr [esp], edi		0_2_02992E1C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02992DF5 push 00000000h; mov dword ptr [esp], edx		0_2_02992EAD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02992DF5 push 00000000h; mov dword ptr [esp], ebp		0_2_02992EC1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02995AF6 push esi; mov dword ptr [esp], 0000F000h		0_2_02995C11
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push 00000000h; mov dword ptr [esp], esi		0_2_0299210B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push dword ptr [ebp-10h]; mov dword ptr [esp], esi		0_2_02992177
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push dword ptr [ebp-10h]; mov dword ptr [esp], ecx		0_2_0299222E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push 00000000h; mov dword ptr [esp], eax		0_2_02992498
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push 00000000h; mov dword ptr [esp], edi		0_2_02992502
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_029920EE push 00000000h; mov dword ptr [esp], ecx		0_2_02992524

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.361907935.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361917668.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361893951.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440967759.000000000349D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361834154.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361865613.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361939136.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2588, type: MEMORY

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000002.234285102.0000000001170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.470853528.00000000009E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472098490.0000000001110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00C112D4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

0_2_00C112D4

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001745 LoadLibraryA,GetProcAddress,

0_2_10001745

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_02992DF5 or edx, dword ptr fs:[00000030h]		0_2_02992DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01112DF5 or edx, dword ptr fs:[00000030h]		2_2_01112DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010A2DF5 or edx, dword ptr fs:[00000030h]		3_2_010A2DF5

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000002.472968505.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.474202434.0000000003820000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.472968505.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.474202434.0000000003820000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.472968505.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.474202434.0000000003820000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.472968505.0000000001580000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.474202434.0000000003820000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00C1269C cpuid

0_2_00C1269C

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1000102F GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_1000102F

Contains functionality to query the account / user name

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00C1269C RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_00C1269C

Contains functionality to query windows version

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.361907935.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361917668.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361893951.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440967759.000000000349D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361834154.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361865613.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361939136.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2588, type: MEMORY

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000002.234285102.0000000001170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.470853528.00000000009E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472098490.0000000001110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.361907935.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361917668.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361893951.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440967759.000000000349D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361834154.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361865613.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.361939136.000000000359B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 2588, type: MEMORY

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000002.234285102.0000000001170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.470853528.00000000009E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472098490.0000000001110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.4.unpack, type: UNPACKEDPE