Play interactive tour

Edit tour

Analysis Report PO_6620200947535257662_Arabico.PDF.exe

Overview

General Information

Sample Name:	PO_6620200947535257662_Arabico.PDF.exe
Analysis ID:	382596
MD5:	b737570f9e9a1bdd794f78e3906e61b9
SHA1:	0dd10acab603b2f1269d05534902b09d38e31ac5
SHA256:	0a3a85fd6964b0cf1b61e41cc7c117ada4c8607a0107ad4921dafa69933ef0ac
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected Nanocore RAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Startup

System is w10x64

PO_6620200947535257662_Arabico.PDF.exe (PID: 6408 cmdline: 'C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe' MD5: B737570F9E9A1BDD794F78E3906E61B9)

cmd.exe (PID: 6780 cmdline: 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6816 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,' MD5: CEE2A7E57DF2A159A065A34913A055C2)

gvvccsccefghhsnd.exe (PID: 6824 cmdline: 'C:\Users\user\gvvccsccefghhsnd.exe' MD5: B737570F9E9A1BDD794F78E3906E61B9)

InstallUtil.exe (PID: 5596 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "883c2226-d991-4f34-8646-4dd2732a", "Group": "", "Domain1": "185.157.161.86", "Domain2": "nanopc.linkpc.net", "Port": 50005, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1111f:$x1: NanoCore.ClientPluginHost 0x56f65:$x1: NanoCore.ClientPluginHost 0x1115c:$x2: IClientNetworkHost 0x56fa2:$x2: IClientNetworkHost 0x14c8f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5aad5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10e87:$a: NanoCore 0x10e97:$a: NanoCore 0x110cb:$a: NanoCore 0x110df:$a: NanoCore 0x1111f:$a: NanoCore 0x56ccd:$a: NanoCore 0x56cdd:$a: NanoCore 0x56f11:$a: NanoCore 0x56f25:$a: NanoCore 0x56f65:$a: NanoCore 0x10ee6:$b: ClientPlugin 0x110e8:$b: ClientPlugin 0x11128:$b: ClientPlugin 0x56d2c:$b: ClientPlugin 0x56f2e:$b: ClientPlugin 0x56f6e:$b: ClientPlugin 0x1100d:$c: ProjectData 0x44cfe:$c: ProjectData 0x56e53:$c: ProjectData 0x11a14:$d: DESCrypto 0x5785a:$d: DESCrypto
0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42f2d:$a: NanoCore 0x42f86:$a: NanoCore 0x42fc3:$a: NanoCore 0x4303c:$a: NanoCore 0x566e7:$a: NanoCore 0x566fc:$a: NanoCore 0x56731:$a: NanoCore 0x6f1b3:$a: NanoCore 0x6f1c8:$a: NanoCore 0x6f1fd:$a: NanoCore 0x42f8f:$b: ClientPlugin 0x42fcc:$b: ClientPlugin 0x438ca:$b: ClientPlugin 0x438d7:$b: ClientPlugin 0x564a3:$b: ClientPlugin 0x564be:$b: ClientPlugin 0x564ee:$b: ClientPlugin 0x56705:$b: ClientPlugin 0x5673a:$b: ClientPlugin 0x6ef6f:$b: ClientPlugin 0x6ef8a:$b: ClientPlugin
0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x31ebd:$x1: NanoCore.ClientPluginHost 0x31efa:$x2: IClientNetworkHost 0x35a2d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x31c25:$a: NanoCore 0x31c35:$a: NanoCore 0x31e69:$a: NanoCore 0x31e7d:$a: NanoCore 0x31ebd:$a: NanoCore 0x31c84:$b: ClientPlugin 0x31e86:$b: ClientPlugin 0x31ec6:$b: ClientPlugin 0x1c776:$c: ProjectData 0x31dab:$c: ProjectData 0x327b2:$d: DESCrypto 0x3a17e:$e: KeepAlive 0x3816c:$g: LogClientMessage 0x34367:$i: get_Connected 0x32ae8:$j: #=q 0x32b18:$j: #=q 0x32b34:$j: #=q 0x32b64:$j: #=q 0x32b80:$j: #=q 0x32b9c:$j: #=q 0x32bcc:$j: #=q
00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x56247:$x1: NanoCore.ClientPluginHost 0x9c0a7:$x1: NanoCore.ClientPluginHost 0xe1ef7:$x1: NanoCore.ClientPluginHost 0x56284:$x2: IClientNetworkHost 0x9c0e4:$x2: IClientNetworkHost 0xe1f34:$x2: IClientNetworkHost 0x59db7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x9fc17:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xe5a67:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x55faf:$a: NanoCore 0x55fbf:$a: NanoCore 0x561f3:$a: NanoCore 0x56207:$a: NanoCore 0x56247:$a: NanoCore 0x9be0f:$a: NanoCore 0x9be1f:$a: NanoCore 0x9c053:$a: NanoCore 0x9c067:$a: NanoCore 0x9c0a7:$a: NanoCore 0xe1c5f:$a: NanoCore 0xe1c6f:$a: NanoCore 0xe1ea3:$a: NanoCore 0xe1eb7:$a: NanoCore 0xe1ef7:$a: NanoCore 0x5600e:$b: ClientPlugin 0x56210:$b: ClientPlugin 0x56250:$b: ClientPlugin 0x9be6e:$b: ClientPlugin 0x9c070:$b: ClientPlugin 0x9c0b0:$b: ClientPlugin
00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10b77:$x1: NanoCore.ClientPluginHost 0x569bd:$x1: NanoCore.ClientPluginHost 0x10bb4:$x2: IClientNetworkHost 0x569fa:$x2: IClientNetworkHost 0x146e7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5a52d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x108df:$a: NanoCore 0x108ef:$a: NanoCore 0x10b23:$a: NanoCore 0x10b37:$a: NanoCore 0x10b77:$a: NanoCore 0x56725:$a: NanoCore 0x56735:$a: NanoCore 0x56969:$a: NanoCore 0x5697d:$a: NanoCore 0x569bd:$a: NanoCore 0x1093e:$b: ClientPlugin 0x10b40:$b: ClientPlugin 0x10b80:$b: ClientPlugin 0x56784:$b: ClientPlugin 0x56986:$b: ClientPlugin 0x569c6:$b: ClientPlugin 0x10a65:$c: ProjectData 0x44756:$c: ProjectData 0x568ab:$c: ProjectData 0x1146c:$d: DESCrypto 0x572b2:$d: DESCrypto
00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x567ef:$x1: NanoCore.ClientPluginHost 0x9c64f:$x1: NanoCore.ClientPluginHost 0xe249f:$x1: NanoCore.ClientPluginHost 0x5682c:$x2: IClientNetworkHost 0x9c68c:$x2: IClientNetworkHost 0xe24dc:$x2: IClientNetworkHost 0x5a35f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xa01bf:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xe600f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x56557:$a: NanoCore 0x56567:$a: NanoCore 0x5679b:$a: NanoCore 0x567af:$a: NanoCore 0x567ef:$a: NanoCore 0x9c3b7:$a: NanoCore 0x9c3c7:$a: NanoCore 0x9c5fb:$a: NanoCore 0x9c60f:$a: NanoCore 0x9c64f:$a: NanoCore 0xe2207:$a: NanoCore 0xe2217:$a: NanoCore 0xe244b:$a: NanoCore 0xe245f:$a: NanoCore 0xe249f:$a: NanoCore 0x565b6:$b: ClientPlugin 0x567b8:$b: ClientPlugin 0x567f8:$b: ClientPlugin 0x9c416:$b: ClientPlugin 0x9c618:$b: ClientPlugin 0x9c658:$b: ClientPlugin
Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x19d503:$x1: NanoCore.ClientPluginHost 0x1c0678:$x1: NanoCore.ClientPluginHost 0x1f1de7:$x1: NanoCore.ClientPluginHost 0x214f74:$x1: NanoCore.ClientPluginHost 0x238101:$x1: NanoCore.ClientPluginHost 0x19d564:$x2: IClientNetworkHost 0x1c06d9:$x2: IClientNetworkHost 0x1f1e48:$x2: IClientNetworkHost 0x214fd5:$x2: IClientNetworkHost 0x238162:$x2: IClientNetworkHost 0x1a2969:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b08db:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1c5ade:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d3a50:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1f724d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2051bf:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x21a3da:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x22834c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x23d567:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x24b4d9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19d008:$a: NanoCore 0x19d024:$a: NanoCore 0x19d17f:$a: NanoCore 0x19d18e:$a: NanoCore 0x19d467:$a: NanoCore 0x19d493:$a: NanoCore 0x19d503:$a: NanoCore 0x1acf45:$a: NanoCore 0x1acf57:$a: NanoCore 0x1acf93:$a: NanoCore 0x1c017d:$a: NanoCore 0x1c0199:$a: NanoCore 0x1c02f4:$a: NanoCore 0x1c0303:$a: NanoCore 0x1c05dc:$a: NanoCore 0x1c0608:$a: NanoCore 0x1c0678:$a: NanoCore 0x1d00ba:$a: NanoCore 0x1d00cc:$a: NanoCore 0x1d0108:$a: NanoCore 0x1f18ec:$a: NanoCore
Process Memory Space: gvvccsccefghhsnd.exe PID: 6824	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6c097:$x1: NanoCore.ClientPluginHost 0x8f20c:$x1: NanoCore.ClientPluginHost 0x1cdd83:$x1: NanoCore.ClientPluginHost 0x3c906d:$x1: NanoCore.ClientPluginHost 0x3ec1fa:$x1: NanoCore.ClientPluginHost 0x40f387:$x1: NanoCore.ClientPluginHost 0x6c0f8:$x2: IClientNetworkHost 0x8f26d:$x2: IClientNetworkHost 0x1cdde4:$x2: IClientNetworkHost 0x3c90ce:$x2: IClientNetworkHost 0x3ec25b:$x2: IClientNetworkHost 0x40f3e8:$x2: IClientNetworkHost 0x714fd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7f46f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x94672:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xa25e4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d31e9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1e115b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3ce4d3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3dc445:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3f1660:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: gvvccsccefghhsnd.exe PID: 6824	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: gvvccsccefghhsnd.exe PID: 6824	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6bb9c:$a: NanoCore 0x6bbb8:$a: NanoCore 0x6bd13:$a: NanoCore 0x6bd22:$a: NanoCore 0x6bffb:$a: NanoCore 0x6c027:$a: NanoCore 0x6c097:$a: NanoCore 0x7bad9:$a: NanoCore 0x7baeb:$a: NanoCore 0x7bb27:$a: NanoCore 0x8ed11:$a: NanoCore 0x8ed2d:$a: NanoCore 0x8ee88:$a: NanoCore 0x8ee97:$a: NanoCore 0x8f170:$a: NanoCore 0x8f19c:$a: NanoCore 0x8f20c:$a: NanoCore 0x9ec4e:$a: NanoCore 0x9ec60:$a: NanoCore 0x9ec9c:$a: NanoCore 0x1cd888:$a: NanoCore
Process Memory Space: InstallUtil.exe PID: 5596	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x27435:$x1: NanoCore.ClientPluginHost 0x50ca3:$x1: NanoCore.ClientPluginHost 0x56862:$x1: NanoCore.ClientPluginHost 0x676f1:$x1: NanoCore.ClientPluginHost 0xa0b5a:$x1: NanoCore.ClientPluginHost 0x27496:$x2: IClientNetworkHost 0x50cc9:$x2: IClientNetworkHost 0x568a7:$x2: IClientNetworkHost 0x67736:$x2: IClientNetworkHost 0xa0b80:$x2: IClientNetworkHost 0x2c89b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3a80d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: InstallUtil.exe PID: 5596	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 5596	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4742:$a: NanoCore 0x47a9:$a: NanoCore 0x484f:$a: NanoCore 0x26f3a:$a: NanoCore 0x26f56:$a: NanoCore 0x270b1:$a: NanoCore 0x270c0:$a: NanoCore 0x27399:$a: NanoCore 0x273c5:$a: NanoCore 0x27435:$a: NanoCore 0x36e77:$a: NanoCore 0x36e89:$a: NanoCore 0x36ec5:$a: NanoCore 0x50b95:$a: NanoCore 0x50c36:$a: NanoCore 0x50ca3:$a: NanoCore 0x50d64:$a: NanoCore 0x51c35:$a: NanoCore 0x51c88:$a: NanoCore 0x51cc1:$a: NanoCore 0x51d34:$a: NanoCore
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x309ad:$x1: NanoCore.ClientPluginHost 0x309ea:$x2: IClientNetworkHost 0x3451d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x30725:$x1: NanoCore Client.exe 0x309ad:$x2: NanoCore.ClientPluginHost 0x31fe6:$s1: PluginCommand 0x31fda:$s2: FileCommand 0x32e8b:$s3: PipeExists 0x38c42:$s4: PipeCreated 0x309d7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x30715:$a: NanoCore 0x30725:$a: NanoCore 0x30959:$a: NanoCore 0x3096d:$a: NanoCore 0x309ad:$a: NanoCore 0x30774:$b: ClientPlugin 0x30976:$b: ClientPlugin 0x309b6:$b: ClientPlugin 0x1b266:$c: ProjectData 0x3089b:$c: ProjectData 0x312a2:$d: DESCrypto 0x38c6e:$e: KeepAlive 0x36c5c:$g: LogClientMessage 0x32e57:$i: get_Connected 0x315d8:$j: #=q 0x31608:$j: #=q 0x31624:$j: #=q 0x31654:$j: #=q 0x31670:$j: #=q 0x3168c:$j: #=q 0x316bc:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x233f3:$x1: NanoCore.ClientPluginHost 0x23430:$x2: IClientNetworkHost 0x26f63:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2316b:$x1: NanoCore Client.exe 0x233f3:$x2: NanoCore.ClientPluginHost 0x24a2c:$s1: PluginCommand 0x24a20:$s2: FileCommand 0x258d1:$s3: PipeExists 0x2b688:$s4: PipeCreated 0x2341d:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2315b:$a: NanoCore 0x2316b:$a: NanoCore 0x2339f:$a: NanoCore 0x233b3:$a: NanoCore 0x233f3:$a: NanoCore 0x231ba:$b: ClientPlugin 0x233bc:$b: ClientPlugin 0x233fc:$b: ClientPlugin 0x1118c:$c: ProjectData 0x232e1:$c: ProjectData 0x23ce8:$d: DESCrypto 0x2b6b4:$e: KeepAlive 0x296a2:$g: LogClientMessage 0x2589d:$i: get_Connected 0x2401e:$j: #=q 0x2404e:$j: #=q 0x2406a:$j: #=q 0x2409a:$j: #=q 0x240b6:$j: #=q 0x240d2:$j: #=q 0x24102:$j: #=q
28.2.InstallUtil.exe.41bb14e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0af:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0dc:$x2: IClientNetworkHost
28.2.InstallUtil.exe.41bb14e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0af:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e18a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0c9:$s5: IClientLoggingHost
28.2.InstallUtil.exe.41bb14e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.InstallUtil.exe.41bb14e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d065:$a: NanoCore 0x2d07a:$a: NanoCore 0x2d0af:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce21:$b: ClientPlugin 0x2ce3c:$b: ClientPlugin
28.2.InstallUtil.exe.41bff84.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
28.2.InstallUtil.exe.41bff84.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
28.2.InstallUtil.exe.41bff84.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.InstallUtil.exe.5970000.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
28.2.InstallUtil.exe.5970000.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
28.2.InstallUtil.exe.5970000.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fdd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x5601a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x55d55:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x55fdd:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x57616:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x5760a:$s2: FileCommand 0x1266b:$s3: PipeExists 0x584bb:$s3: PipeExists 0x18422:$s4: PipeCreated 0x5e272:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x56007:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d45:$a: NanoCore 0x55d55:$a: NanoCore 0x55f89:$a: NanoCore 0x55f9d:$a: NanoCore 0x55fdd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55da4:$b: ClientPlugin 0x55fa6:$b: ClientPlugin 0x55fe6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x43d6c:$c: ProjectData 0x55ecb:$c: ProjectData 0x89bbc:$c: ProjectData 0x10a82:$d: DESCrypto
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2340d:$x1: NanoCore.ClientPluginHost 0x6925d:$x1: NanoCore.ClientPluginHost 0x2344a:$x2: IClientNetworkHost 0x6929a:$x2: IClientNetworkHost 0x26f7d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6cdcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23175:$a: NanoCore 0x23185:$a: NanoCore 0x233b9:$a: NanoCore 0x233cd:$a: NanoCore 0x2340d:$a: NanoCore 0x68fc5:$a: NanoCore 0x68fd5:$a: NanoCore 0x69209:$a: NanoCore 0x6921d:$a: NanoCore 0x6925d:$a: NanoCore 0x231d4:$b: ClientPlugin 0x233d6:$b: ClientPlugin 0x23416:$b: ClientPlugin 0x69024:$b: ClientPlugin 0x69226:$b: ClientPlugin 0x69266:$b: ClientPlugin 0x1118c:$c: ProjectData 0x232fb:$c: ProjectData 0x56fec:$c: ProjectData 0x6914b:$c: ProjectData 0x9ce3c:$c: ProjectData
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
28.2.InstallUtil.exe.41c45ad.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c50:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c7d:$x2: IClientNetworkHost
28.2.InstallUtil.exe.41c45ad.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c50:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d2b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c6a:$s5: IClientLoggingHost
28.2.InstallUtil.exe.41c45ad.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fed:$x1: NanoCore.ClientPluginHost 0x9be3d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x5602a:$x2: IClientNetworkHost 0x9be7a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b5d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x9f9ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d55:$a: NanoCore 0x55d65:$a: NanoCore 0x55f99:$a: NanoCore 0x55fad:$a: NanoCore 0x55fed:$a: NanoCore 0x9bba5:$a: NanoCore 0x9bbb5:$a: NanoCore 0x9bde9:$a: NanoCore 0x9bdfd:$a: NanoCore 0x9be3d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55db4:$b: ClientPlugin 0x55fb6:$b: ClientPlugin 0x55ff6:$b: ClientPlugin
28.2.InstallUtil.exe.5970000.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
28.2.InstallUtil.exe.5970000.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
28.2.InstallUtil.exe.5970000.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.InstallUtil.exe.41bff84.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28279:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282a6:$x2: IClientNetworkHost
28.2.InstallUtil.exe.41bff84.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28279:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29354:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28293:$s5: IClientLoggingHost
28.2.InstallUtil.exe.41bff84.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.389c662.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.389c662.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.389c662.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.389c662.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fdd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x5601a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x55d55:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x55fdd:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x57616:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x5760a:$s2: FileCommand 0x1266b:$s3: PipeExists 0x584bb:$s3: PipeExists 0x18422:$s4: PipeCreated 0x5e272:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x56007:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d45:$a: NanoCore 0x55d55:$a: NanoCore 0x55f89:$a: NanoCore 0x55f9d:$a: NanoCore 0x55fdd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55da4:$b: ClientPlugin 0x55fa6:$b: ClientPlugin 0x55fe6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x43d6c:$c: ProjectData 0x55ecb:$c: ProjectData 0x89bbc:$c: ProjectData 0x10a82:$d: DESCrypto
28.2.InstallUtil.exe.31d9708.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x233f3:$x1: NanoCore.ClientPluginHost 0x23430:$x2: IClientNetworkHost 0x26f63:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2316b:$x1: NanoCore Client.exe 0x233f3:$x2: NanoCore.ClientPluginHost 0x24a2c:$s1: PluginCommand 0x24a20:$s2: FileCommand 0x258d1:$s3: PipeExists 0x2b688:$s4: PipeCreated 0x2341d:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2315b:$a: NanoCore 0x2316b:$a: NanoCore 0x2339f:$a: NanoCore 0x233b3:$a: NanoCore 0x233f3:$a: NanoCore 0x231ba:$b: ClientPlugin 0x233bc:$b: ClientPlugin 0x233fc:$b: ClientPlugin 0x1118c:$c: ProjectData 0x232e1:$c: ProjectData 0x23ce8:$d: DESCrypto 0x2b6b4:$e: KeepAlive 0x296a2:$g: LogClientMessage 0x2589d:$i: get_Connected 0x2401e:$j: #=q 0x2404e:$j: #=q 0x2406a:$j: #=q 0x2409a:$j: #=q 0x240b6:$j: #=q 0x240d2:$j: #=q 0x24102:$j: #=q
28.2.InstallUtil.exe.5780000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
28.2.InstallUtil.exe.5780000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
28.2.InstallUtil.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.InstallUtil.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
28.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.InstallUtil.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fd3:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x56010:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b43:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x55d4b:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x55fd3:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x5760c:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x57600:$s2: FileCommand 0x1266b:$s3: PipeExists 0x584b1:$s3: PipeExists 0x18422:$s4: PipeCreated 0x5e268:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x55ffd:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d3b:$a: NanoCore 0x55d4b:$a: NanoCore 0x55f7f:$a: NanoCore 0x55f93:$a: NanoCore 0x55fd3:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55d9a:$b: ClientPlugin 0x55f9c:$b: ClientPlugin 0x55fdc:$b: ClientPlugin 0x1007b:$c: ProjectData 0x43d6c:$c: ProjectData 0x55ec1:$c: ProjectData 0x10a82:$d: DESCrypto 0x568c8:$d: DESCrypto
19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
28.2.InstallUtil.exe.5974629.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
28.2.InstallUtil.exe.5974629.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
28.2.InstallUtil.exe.5974629.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fd3:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x56010:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b43:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x55d4b:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x55fd3:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x5760c:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x57600:$s2: FileCommand 0x1266b:$s3: PipeExists 0x584b1:$s3: PipeExists 0x18422:$s4: PipeCreated 0x5e268:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x55ffd:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d3b:$a: NanoCore 0x55d4b:$a: NanoCore 0x55f7f:$a: NanoCore 0x55f93:$a: NanoCore 0x55fd3:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55d9a:$b: ClientPlugin 0x55f9c:$b: ClientPlugin 0x55fdc:$b: ClientPlugin 0x1007b:$c: ProjectData 0x43d6c:$c: ProjectData 0x55ec1:$c: ProjectData 0x10a82:$d: DESCrypto 0x568c8:$d: DESCrypto
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2340d:$x1: NanoCore.ClientPluginHost 0x6925d:$x1: NanoCore.ClientPluginHost 0x2344a:$x2: IClientNetworkHost 0x6929a:$x2: IClientNetworkHost 0x26f7d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6cdcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23175:$a: NanoCore 0x23185:$a: NanoCore 0x233b9:$a: NanoCore 0x233cd:$a: NanoCore 0x2340d:$a: NanoCore 0x68fc5:$a: NanoCore 0x68fd5:$a: NanoCore 0x69209:$a: NanoCore 0x6921d:$a: NanoCore 0x6925d:$a: NanoCore 0x231d4:$b: ClientPlugin 0x233d6:$b: ClientPlugin 0x23416:$b: ClientPlugin 0x69024:$b: ClientPlugin 0x69226:$b: ClientPlugin 0x69266:$b: ClientPlugin 0x1118c:$c: ProjectData 0x232fb:$c: ProjectData 0x56fec:$c: ProjectData 0x6914b:$c: ProjectData 0x9ce3c:$c: ProjectData
19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x55fed:$x1: NanoCore.ClientPluginHost 0x9be3d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x5602a:$x2: IClientNetworkHost 0x9be7a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59b5d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x9f9ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x55d55:$a: NanoCore 0x55d65:$a: NanoCore 0x55f99:$a: NanoCore 0x55fad:$a: NanoCore 0x55fed:$a: NanoCore 0x9bba5:$a: NanoCore 0x9bbb5:$a: NanoCore 0x9bde9:$a: NanoCore 0x9bdfd:$a: NanoCore 0x9be3d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x55db4:$b: ClientPlugin 0x55fb6:$b: ClientPlugin 0x55ff6:$b: ClientPlugin
Click to see the 104 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ProcessId: 5596, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "883c2226-d991-4f34-8646-4dd2732a", "Group": "", "Domain1": "185.157.161.86", "Domain2": "nanopc.linkpc.net", "Port": 50005, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe	ReversingLabs: Detection: 25%
Source: C:\Users\user\gvvccsccefghhsnd.exe	ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Show sources

Source: PO_6620200947535257662_Arabico.PDF.exe

ReversingLabs: Detection: 20%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY
Source: Yara match	File source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\gvvccsccefghhsnd.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: PO_6620200947535257662_Arabico.PDF.exe

Joe Sandbox ML: detected

Source: 28.2.InstallUtil.exe.5970000.9.unpack	Avira: Label: TR/NanoCore.fadte
Source: 28.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000001C.00000002.601725662.0000000000C82000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, InstallUtil.exe.0.dr

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04B9B700
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then jmp 04B96611h	0_2_04B95D98
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04B9BDF0
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04B9BDF0
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04B9AFF4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04B9E0A4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04B9B1EC
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then jmp 04B96611h	0_2_04B95D8A
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04B9BDE4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04B9BDE4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then xor edx, edx	0_2_04B9BD28
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then xor edx, edx	0_2_04B9BD1E
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04B9BAD0
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04B9BAD0
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04B9BAC4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04B9BAC4
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04B9DA74
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_063F4460
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_063F8090
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	19_2_04D5B700
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then push dword ptr [ebp-24h]	19_2_04D5BDF0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	19_2_04D5BDF0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 04D56611h	19_2_04D55D98
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	19_2_04D5AFF4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	19_2_04D5E0A4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	19_2_04D5B1EC
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then push dword ptr [ebp-24h]	19_2_04D5BDE4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	19_2_04D5BDE4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 04D56611h	19_2_04D55D8A
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then xor edx, edx	19_2_04D5BD1E
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then xor edx, edx	19_2_04D5BD28
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then push dword ptr [ebp-20h]	19_2_04D5BAD0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	19_2_04D5BAD0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then push dword ptr [ebp-20h]	19_2_04D5BAC4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	19_2_04D5BAC4
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	19_2_04D5DA74
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	19_2_065D4460
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	19_2_065D4450
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 06602717h	19_2_066025D8
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 06602717h	19_2_066025C8
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 06603C35h	19_2_06603AA0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 4x nop then jmp 06603C35h	19_2_06603A91

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: nanopc.linkpc.net
Source: Malware configuration extractor	URLs: 185.157.161.86

Source: global traffic

TCP traffic: 192.168.2.6:49754 -> 185.157.161.86:50005

Source: Joe Sandbox View

IP Address: 185.157.161.86 185.157.161.86

Source: Joe Sandbox View

ASN Name: OBE-EUROPEObenetworkEuropeSE OBE-EUROPEObenetworkEuropeSE

Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.161.86
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.161.86
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.161.86
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.161.86

Source: gvvccsccefghhsnd.exe, 00000013.00000002.602922386.00000000009F5000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465739066.00000000026EE000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465799062.000000000271C000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465739066.00000000026EE000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465739066.00000000026EE000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: gvvccsccefghhsnd.exe, 00000013.00000002.604420150.000000000275E000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465715365.00000000026C1000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.604361409.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465715365.00000000026C1000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.604361409.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465715365.00000000026C1000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.604361409.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/

Source: InstallUtil.exe, 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY
Source: Yara match	File source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.31d9708.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.5780000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

.NET source code contains very large array initializations

Show sources

Source: PO_6620200947535257662_Arabico.PDF.exe, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488
Source: gvvccsccefghhsnd.exe.0.dr, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.240000.0.unpack, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488
Source: 0.0.PO_6620200947535257662_Arabico.PDF.exe.240000.0.unpack, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488
Source: 19.2.gvvccsccefghhsnd.exe.340000.0.unpack, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488
Source: 19.0.gvvccsccefghhsnd.exe.340000.0.unpack, Dj7z/e1J0.cs	Large array initialization: .cctor: array initializer size 2488

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: PO_6620200947535257662_Arabico.PDF.exe
Source: initial sample	Static PE information: Filename: PO_6620200947535257662_Arabico.PDF.exe

Source: C:\Users\user\gvvccsccefghhsnd.exe

Code function: 19_2_065D6E24 CreateProcessAsUserW,

19_2_065D6E24

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_002434F8	0_2_002434F8
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_00D0E020	0_2_00D0E020
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_00D0AF40	0_2_00D0AF40
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_00D0BC30	0_2_00D0BC30
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B93498	0_2_04B93498
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B94218	0_2_04B94218
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B95D98	0_2_04B95D98
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B9C5A8	0_2_04B9C5A8
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B9C598	0_2_04B9C598
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B96638	0_2_04B96638
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B96628	0_2_04B96628
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B9420E	0_2_04B9420E
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B90340	0_2_04B90340
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B97870	0_2_04B97870
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B9CB58	0_2_04B9CB58
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_04B9CB4A	0_2_04B9CB4A
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_003434F8	19_2_003434F8
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255E020	19_2_0255E020
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255A990	19_2_0255A990
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255AF40	19_2_0255AF40
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255BFE0	19_2_0255BFE0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255A358	19_2_0255A358
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0255BC30	19_2_0255BC30
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D504A0	19_2_04D504A0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D54218	19_2_04D54218
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D55D98	19_2_04D55D98
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D5C598	19_2_04D5C598
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D5C5A8	19_2_04D5C5A8
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D56638	19_2_04D56638
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D56628	19_2_04D56628
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D54208	19_2_04D54208
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D5CB58	19_2_04D5CB58
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D5CB4A	19_2_04D5CB4A
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D6558	19_2_065D6558
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D7D0F	19_2_065D7D0F
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DD258	19_2_065DD258
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D7218	19_2_065D7218
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DB22A	19_2_065DB22A
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DAB02	19_2_065DAB02
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D9038	19_2_065D9038
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DDC78	19_2_065DDC78
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DDC0F	19_2_065DDC0F
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DC4B0	19_2_065DC4B0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DC4A0	19_2_065DC4A0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D6548	19_2_065D6548
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D4B78	19_2_065D4B78
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D4B68	19_2_065D4B68
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DE8E8	19_2_065DE8E8
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DC918	19_2_065DC918
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065DC928	19_2_065DC928
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_06600C60	19_2_06600C60
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_06600040	19_2_06600040
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_06600006	19_2_06600006
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_00C820B0	28_2_00C820B0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0302E471	28_2_0302E471
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0302E480	28_2_0302E480
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0302BBD4	28_2_0302BBD4
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0564F5F8	28_2_0564F5F8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_05649788	28_2_05649788
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_05643550	28_2_05643550
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0564A610	28_2_0564A610

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB

Source: PO_6620200947535257662_Arabico.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gvvccsccefghhsnd.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000000.336475419.0000000000301000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemcntyre.exeH vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465913401.00000000027FE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAstronot plart.exe> vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470839679.0000000006390000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470947040.0000000006420000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470947040.0000000006420000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.472908360.0000000006FF0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470185755.0000000005700000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470532416.0000000006070000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PO_6620200947535257662_Arabico.PDF.exe
Source: PO_6620200947535257662_Arabico.PDF.exe	Binary or memory string: OriginalFilenamemcntyre.exeH vs PO_6620200947535257662_Arabico.PDF.exe

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'

Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.31d9708.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.5780000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.5780000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/7@0/1

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File created: C:\Users\user\gvvccsccefghhsnd.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{883c2226-d991-4f34-8646-4dd2732a341c}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_01

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PO_6620200947535257662_Arabico.PDF.exe

ReversingLabs: Detection: 20%

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File read: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe 'C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe'
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Users\user\gvvccsccefghhsnd.exe 'C:\Users\user\gvvccsccefghhsnd.exe'
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Users\user\gvvccsccefghhsnd.exe 'C:\Users\user\gvvccsccefghhsnd.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO_6620200947535257662_Arabico.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000001C.00000002.601725662.0000000000C82000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, InstallUtil.exe.0.dr

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: ghfvjjtjhhjghdgghrba.exe.19.dr

Static PE information: 0xC7142059 [Sun Nov 3 05:36:25 2075 UTC]

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_0024333E push cs; retf	0_2_00243380
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_00243381 push cs; retf	0_2_002433A0
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Code function: 0_2_0024277B push edi; iretd	0_2_0024277D
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0034333E push cs; retf	19_2_00343380
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_00343381 push cs; retf	19_2_003433A0
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_0034277B push edi; iretd	19_2_0034277D
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_04D55950 push es; retf	19_2_04D5595C
Source: C:\Users\user\gvvccsccefghhsnd.exe	Code function: 19_2_065D4B21 pushfd ; retf	19_2_065D4B2D
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_0564B5E0 push eax; retf	28_2_0564B5ED
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_056469F8 pushad ; retf	28_2_056469F9
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 28_2_056469FA push esp; retf	28_2_05646A01

Source: ghfvjjtjhhjghdgghrba.exe.19.dr, Astronotplart/My/tT7bk4FnxbYaKqMtWjIqvyKWh4J9tkfAvLZ8e5Y4BU.cs	High entropy of concatenated method names: 'nn9DM7TZkpnl4dSPqnpPS2oW', 'LztRLhG61h4KFshxtO7P7', 'G4vjdlUHNvtWZenTXSNdtGwCIYmCoKE77', '5fQycwGNtn0lBuMB2jteITZhMQF3wG', 'ZJSZEAUpgBzwUgSXvnbC6lEhXmP5VpN2nCiGvnzMTR'
Source: ghfvjjtjhhjghdgghrba.exe.19.dr, Astronotplart/gabKErPURPS76kDKjrme.cs	High entropy of concatenated method names: '.ctor', 'EmwYECB1wGyvIA2snT', 'zQyq6GQCkVXH2m9ORWKDS7znEfc2l', 'X3TE6RCIZMD7ECwwVoqD8j43J8u', 'SwV7wVQkM24hXoCSpr83uLH4TEFtSUXME6LQS7', 'gIglw7CqsSJGzE2AtTN3JYbIYwYS1QQ7ADpw', 'aciMX0Q3f70STq8WXW'
Source: ghfvjjtjhhjghdgghrba.exe.19.dr, Astronotplart/My/nVdeDLHvVsfVxwgFzORDky8W3f9u4lGmiaWnSDb.cs	High entropy of concatenated method names: '.cctor', 'ipfF6OV8JHE8Qin24Sz2H', 'GBAU51HdoykwtyLJ8j', 'A6Cmw4VPbNKHMkR6BnXqjGTCsaLYYK', 'ZhXAveIVREq8oAgNFODqxTnhx35', 'TL13XiWxESQiImm09SkPUl2iIyfqvqfNa1eW0WN', 'hXlgWtIDkKwHkCLRcj1P0yvWMryPDm997zSDv', 'crnIowWf8YVTDoRdGn'
Source: ghfvjjtjhhjghdgghrba.exe.19.dr, Astronotplart/My/Resources/cZsjfbJLI2Nt8If5QOa3YzSXxDXbcmzUTY.cs	High entropy of concatenated method names: '7tuLHfXnvgcErulp', 'vFPZGqKub8S44KK9njyrAe1CN2qDJ3IQa7tiGW3Oebu', 'p0Rr9tY6YlifmwQtRmfPXGEDX', 'IPf8zIYNrroPiylxpRDezmMidW58Fr8mLO'
Source: ghfvjjtjhhjghdgghrba.exe.19.dr, Astronotplart/rtGPmvPIdl5IaacYtOxDvUDj4cyvAKDSBQSIKnjuJ.cs	High entropy of concatenated method names: '.ctor', 'lXIhNy5k2zuUtWijXRf3Smh', 'K04wNKQqGraj7cH31jV3', 'XjtDF35KWLF6l1is3R1Q6HxEJwEr3PbjtGbh2HVd2', 'lvOSFdRQCCluXgGa7jGQkU1jNoXRaK5EpfPYnW', 'gZQk7h6spRLFg3NwAmoe'
Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 28.2.InstallUtil.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File created: C:\Users\user\gvvccsccefghhsnd.exe	Jump to dropped file
Source: C:\Users\user\gvvccsccefghhsnd.exe	File created: C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Jump to dropped file

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File created: C:\Users\user\gvvccsccefghhsnd.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Jump to behavior

Drops PE files to the user root directory

Show sources

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

File created: C:\Users\user\gvvccsccefghhsnd.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	File opened: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	File opened: C:\Users\user\gvvccsccefghhsnd.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: PO_6620200947535257662_Arabico.PDF.exe

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\gvvccsccefghhsnd.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Window / User API: threadDelayed 496	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Window / User API: threadDelayed 9288	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Window / User API: threadDelayed 361	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Window / User API: threadDelayed 9441	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Window / User API: threadDelayed 1877	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Window / User API: threadDelayed 7713	Jump to behavior

Source: C:\Users\user\gvvccsccefghhsnd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe

Jump to dropped file

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe TID: 6592	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe TID: 6668	Thread sleep count: 496 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe TID: 6668	Thread sleep count: 9288 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe TID: 6592	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe TID: 5904	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe TID: 5700	Thread sleep count: 361 > 30	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe TID: 5700	Thread sleep count: 9441 > 30	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe TID: 5904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe TID: 5904	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5960	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.471113156.0000000006634000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:!
Source: gvvccsccefghhsnd.exe, 00000013.00000002.614103031.00000000061CF000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470185755.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000007.00000002.374539474.0000000003A00000.00000002.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.613605348.0000000005770000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470185755.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000007.00000002.374539474.0000000003A00000.00000002.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.613605348.0000000005770000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470185755.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000007.00000002.374539474.0000000003A00000.00000002.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.613605348.0000000005770000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: gvvccsccefghhsnd.exe, 00000013.00000002.602922386.00000000009F5000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
Source: InstallUtil.exe, 0000001C.00000002.602877999.00000000012A4000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.470185755.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000007.00000002.374539474.0000000003A00000.00000002.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.613605348.0000000005770000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\gvvccsccefghhsnd.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\gvvccsccefghhsnd.exe

Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\gvvccsccefghhsnd.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 420000	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: EA4008	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Process created: C:\Users\user\gvvccsccefghhsnd.exe 'C:\Users\user\gvvccsccefghhsnd.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Jump to behavior

Source: InstallUtil.exe, 0000001C.00000002.605205180.00000000032A8000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603925047.00000000010C0000.00000002.00000001.sdmp, InstallUtil.exe, 0000001C.00000002.603679432.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603925047.00000000010C0000.00000002.00000001.sdmp, InstallUtil.exe, 0000001C.00000002.603679432.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603925047.00000000010C0000.00000002.00000001.sdmp, InstallUtil.exe, 0000001C.00000002.603679432.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: InstallUtil.exe, 0000001C.00000002.604626929.00000000031D2000.00000004.00000001.sdmp	Binary or memory string: Program Managerx
Source: InstallUtil.exe, 0000001C.00000002.604626929.00000000031D2000.00000004.00000001.sdmp	Binary or memory string: Program Manager`n
Source: gvvccsccefghhsnd.exe, 00000013.00000002.603925047.00000000010C0000.00000002.00000001.sdmp, InstallUtil.exe, 0000001C.00000002.603679432.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Users\user\gvvccsccefghhsnd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\gvvccsccefghhsnd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY
Source: Yara match	File source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: gvvccsccefghhsnd.exe, 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_6620200947535257662_Arabico.PDF.exe PID: 6408, type: MEMORY
Source: Yara match	File source: Process Memory Space: gvvccsccefghhsnd.exe PID: 6824, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5596, type: MEMORY
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.3739510.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.397a5ca.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bb14e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39f9dd8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38cf242.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.398d830.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41c45ad.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.38300ba.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5970000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.41bff84.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3875f1a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39e6b72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.38e24c2.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.InstallUtil.exe.5974629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.39479ea.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.39b3f92.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_6620200947535257662_Arabico.PDF.exe.3862c9a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.gvvccsccefghhsnd.exe.389c662.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation	Valid Accounts1	Valid Accounts1	Disable or Modify Tools1	Input Capture11	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Deobfuscate/Decode Files or Information1	LSASS Memory	System Information Discovery12	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection312	Obfuscated Files or Information12	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Software Packing11	NTDS	Security Software Discovery111	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading211	Cached Domain Credentials	Virtualization/Sandbox Evasion31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Valid Accounts1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Modify Registry1	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Access Token Manipulation1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Virtualization/Sandbox Evasion31	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection312	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO_6620200947535257662_Arabico.PDF.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
PO_6620200947535257662_Arabico.PDF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\gvvccsccefghhsnd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe	14%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe	26%	ReversingLabs	Win32.Trojan.Ymacco
C:\Users\user\gvvccsccefghhsnd.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
28.2.InstallUtil.exe.5970000.9.unpack	100%	Avira	TR/NanoCore.fadte		Download File
28.2.InstallUtil.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
185.157.161.86	0%	Avira URL Cloud	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
nanopc.linkpc.net	false		high
185.157.161.86	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pki.goog/gsr2/GTS1O1.crt0	PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465739066.00000000026EE000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.pki.goog/gsr2/gsr2.crl0?	gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://pki.goog/repository/0	gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465715365.00000000026C1000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.604361409.0000000002731000.00000004.00000001.sdmp	false		high
http://schema.org/WebPage	gvvccsccefghhsnd.exe, 00000013.00000002.604420150.000000000275E000.00000004.00000001.sdmp	false		high
http://crl.pki.goog/GTS1O1core.crl0	PO_6620200947535257662_Arabico.PDF.exe, 00000000.00000002.465739066.00000000026EE000.00000004.00000001.sdmp, gvvccsccefghhsnd.exe, 00000013.00000002.603029028.0000000000A22000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.157.161.86	unknown	Sweden		197595	OBE-EUROPEObenetworkEuropeSE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	382596
Start date:	06.04.2021
Start time:	10:35:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO_6620200947535257662_Arabico.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/7@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0.1%) Quality average: 22.7% Quality standard deviation: 26.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 165 Number of non-executed functions: 15
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 131.253.33.200, 13.107.22.200, 13.64.90.137, 93.184.221.240, 92.122.145.220, 216.58.207.164, 204.79.197.200, 13.107.21.200, 104.43.139.144, 20.82.209.183, 92.122.213.194, 92.122.213.247, 104.42.151.234, 52.155.217.156, 2.20.142.210, 2.20.142.209, 20.54.26.129, 20.50.102.62, 184.30.24.56, 13.88.21.125 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, 2-01-3cf7-0009.cdx.cedexis.net, store-images.s-microsoft.com-c.edgekey.net, wu-fg-shim.trafficmanager.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, cs11.wpc.v0cdn.net, audownload.windowsupdate.nsatc.net, hlb.apr-52dd2-0.edgecastdns.net, www.google.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, wu.wpc.apr-52dd2.edgecastdns.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/382596/sample/PO_6620200947535257662_Arabico.PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
10:36:25	API Interceptor	227x Sleep call for process: PO_6620200947535257662_Arabico.PDF.exe modified
10:37:23	API Interceptor	188x Sleep call for process: gvvccsccefghhsnd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.157.161.86	CN-Invoice-XXXXX9808-19011143287998.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287993.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287990.exe	Get hash	malicious	Browse
	CN-Invoice-XXXXX9808-19011143287990.exe	Get hash	malicious	Browse
	Order_List_PO# 081929.exe	Get hash	malicious	Browse
	order-1812896543124646450.exe	Get hash	malicious	Browse
	order-181289654312464649.exe	Get hash	malicious	Browse
	order-181289654312464648.exe	Get hash	malicious	Browse
	Order_1101201918_AUTECH.exe	Get hash	malicious	Browse
	50404868-c352-422f-a608-7fd64b335eec.exe	Get hash	malicious	Browse
	74725794.pdf.exe	Get hash	malicious	Browse
	Order_List_PO# 0819289.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OBE-EUROPEObenetworkEuropeSE	KUWAIT NATIONAL PETROLEUM COMPANY (KNPC).pdf.exe	Get hash	malicious	Browse	45.148.16.46
	Order PONSB 04042021.pdf(939MB).exe	Get hash	malicious	Browse	45.148.16.42
	Document.exe	Get hash	malicious	Browse	193.187.90.38
	Swift Copy Against due Invoice.PDF.exe	Get hash	malicious	Browse	45.148.16.42
	Ref150420190619A-B0270PEL. pdf.exe	Get hash	malicious	Browse	45.148.16.42
	Attached pdf.exe	Get hash	malicious	Browse	185.157.160.229
	DHL DELIVERY NOTE 2021003982721.exe	Get hash	malicious	Browse	45.148.16.42
	file.exe	Get hash	malicious	Browse	217.64.151.217
	0001.exe	Get hash	malicious	Browse	185.86.106.202
	0001.exe	Get hash	malicious	Browse	185.86.106.202
	PO_6620200947535257653_Arabico.PDF.exe	Get hash	malicious	Browse	185.157.161.20
	Purchase Order.exe	Get hash	malicious	Browse	185.157.161.113
	FedEx Tracking Details.exe	Get hash	malicious	Browse	185.86.106.202
	HBL10909LIT266NR5272RBL2021PRD66178278_LAX2778.PDF.exe	Get hash	malicious	Browse	194.32.146.143
	Purchase Order.exe	Get hash	malicious	Browse	185.157.161.113
	Nuevo orden & Aliafor Documentos.exe	Get hash	malicious	Browse	185.86.106.202
	Document.exe	Get hash	malicious	Browse	217.64.151.237
	CN-Invoice-XXXXX9808-19011143287998.exe	Get hash	malicious	Browse	185.157.161.20
	Document.exe	Get hash	malicious	Browse	217.64.151.237
	Purchase Order.exe	Get hash	malicious	Browse	185.157.161.113

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	payment notification.exe	Get hash	malicious	Browse
	Payment Notification.exe	Get hash	malicious	Browse
	s.exe	Get hash	malicious	Browse
	MV.exe	Get hash	malicious	Browse
	e.exe	Get hash	malicious	Browse
	SL_PO8192.PDF.exe	Get hash	malicious	Browse
	QUOTATIONs#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe	Get hash	malicious	Browse
	RFQ9088QTY.exe	Get hash	malicious	Browse
	NEWQUOTATION#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe	Get hash	malicious	Browse
	OUTSTANDING PAYMENT,PDF.exe	Get hash	malicious	Browse
	New Order 567w43.exe	Get hash	malicious	Browse
	SRESTKM-series.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Siggen12.56637.29917.exe	Get hash	malicious	Browse
	VITR000413774..exe	Get hash	malicious	Browse
	Order 100955-21042021.exe	Get hash	malicious	Browse
	R ALHTQ19-P0401-940 GR2P5 TYPBLDG-NASE FERDAN Q0539 NE-Q22.exe	Get hash	malicious	Browse
	ORDER 100955-21042021.exe	Get hash	malicious	Browse
	DOCUMENT_395849584954.exe	Get hash	malicious	Browse
	Documents_00924930493030493.exe	Get hash	malicious	Browse
	All Details.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_6620200947535257662_Arabico.PDF.exe.log Download File
Process:	C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1402
Entropy (8bit):	5.338819835253785
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4bE4Ko84qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKoesX3:MIHK5HKXE1qHbHKovmAHKzvRYHKhQnoe
MD5:	8273F0DD3A6F885D475E92688D9D7583
SHA1:	2DD9D780D4E2F2AD7B458F5A5722D36081F426C4
SHA-256:	D17626929C751206513FE9CF332754F45480CA9E262F746E86D38E6ADD16F8AB
SHA-512:	FB70A91B9B67C2A78D77EBD2B3F8E104664AC97AA4C487CCB90ED3A114A311B46DCD77052CEB184501CECE4A577D952CC479E0AF8F891CB44D2B2C70228C0A1E
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Co

C:\Users\user\AppData\Local\Temp\InstallUtil.exe Download File
Process:	C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.164873449128079
Encrypted:	false
SSDEEP:	384:FtpFVLK0MsihB9VKS7xdgE7KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+sPZTd:ZBMs2SqdD86Iq8gZZFyViML3an
MD5:	EFEC8C379D165E3F33B536739AEE26A3
SHA1:	C875908ACBA5CAC1E0B40F06A83F0F156A2640FA
SHA-256:	46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
SHA-512:	497847EC115D9AF78899E6DC20EC32A60B16954F83CF5169A23DD3F1459CB632DAC95417BD898FD1895C9FE2262FCBF7838FCF6919FB3B851A0557FBE07CCFFA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: payment notification.exe, Detection: malicious, Browse Filename: Payment Notification.exe, Detection: malicious, Browse Filename: s.exe, Detection: malicious, Browse Filename: MV.exe, Detection: malicious, Browse Filename: e.exe, Detection: malicious, Browse Filename: SL_PO8192.PDF.exe, Detection: malicious, Browse Filename: QUOTATIONs#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe, Detection: malicious, Browse Filename: RFQ9088QTY.exe, Detection: malicious, Browse Filename: NEWQUOTATION#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe, Detection: malicious, Browse Filename: OUTSTANDING PAYMENT,PDF.exe, Detection: malicious, Browse Filename: New Order 567w43.exe, Detection: malicious, Browse Filename: SRESTKM-series.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen12.56637.29917.exe, Detection: malicious, Browse Filename: VITR000413774..exe, Detection: malicious, Browse Filename: Order 100955-21042021.exe, Detection: malicious, Browse Filename: R ALHTQ19-P0401-940 GR2P5 TYPBLDG-NASE FERDAN Q0539 NE-Q22.exe, Detection: malicious, Browse Filename: ORDER 100955-21042021.exe, Detection: malicious, Browse Filename: DOCUMENT_395849584954.exe, Detection: malicious, Browse Filename: Documents_00924930493030493.exe, Detection: malicious, Browse Filename: All Details.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..h>...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.exe Download File
Process:	C:\Users\user\gvvccsccefghhsnd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	4.369296705546591
Encrypted:	false
SSDEEP:	768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5:	0E362E7005823D0BEC3719B902ED6D62
SHA1:	590D860B909804349E0CDC2F1662B37BD62F7463
SHA-256:	2D0DC6216F613AC7551A7E70A798C22AEE8EB9819428B1357E2B8C73BEF905AD
SHA-512:	518991B68496B3F8545E418CF9B345E0791E09CC20D177B8AA47E0ABA447AA55383C64F5BDACA39F2B061A5D08C16F2AD484AF8A9F238CA23AB081618FBA3AD3
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 14%, Browse Antivirus: ReversingLabs, Detection: 26%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y ................P..&...........D... ........@.. ....................................`..................................D..W....`..............................hD............................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................D......H.......l....%......)....................................................0..6.......(8...t....&.(8...t....&......(8...t...................8;....8%.....(8...t....&.(8...t............:.....(8...t....:.....(8...t....:....(8...t....................................\:@....(8...t....&.)...&8.....(8...t....&(8...t....&.....:.......8x........:L...88....(8...t....&(8...t....&(8...t....&(8...t.....................:....8!.....(8...t....&......(8...t....&.....(8...t....:8.....(8...t....&.

C:\Users\user\AppData\Local\Temp\ghfvjjtjhhjghdgghrba.txt Download File
Process:	C:\Users\user\gvvccsccefghhsnd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.279486946865809
Encrypted:	false
SSDEEP:	3:X8ONEE1Jn:MONEE1Jn
MD5:	C50B8CB81A83FE38A157C2B6099037A3
SHA1:	FC12D6A3FFE15AF1F556278A241A0E6C2C9B99FA
SHA-256:	F7A45394303B3F40F087D96F532DD3D980FAC1B235750420F816DF422B5EB65F
SHA-512:	9519F5FB1EFA2D201690772109ECEBF15DF1F4485D26AE547AE93A115C843D89FEA78B145C55C31405D5E0FFF27131EBBEDBEC490D0DE08740098AA2AC018A13
Malicious:	false
Reputation:	low
Preview:	6824..C:\Users\user\gvvccsccefghhsnd.exe..0..

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:5Hsn:Zsn
MD5:	F9E71D3F4FE71AEA2CFFFD1007D5C98A
SHA1:	577D0D6A494CDB5DBE47D6ECD4917C05A3448604
SHA-256:	36B9796CEAD21232A868FD8644B236F4BB7775645263371280526609A8AF78AC
SHA-512:	9E3BD49F498FBAD737B0D712BDE57847D6457C29AB84989B9883CA71DD0026E38430C8B4D2F95878EBD8D2B386F86F5BE01DFED029DE1D6BAEEAA6322B1E724D
Malicious:	true
Reputation:	low
Preview:	d~.."..H

C:\Users\user\gvvccsccefghhsnd.exe Download File
Process:	C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819712
Entropy (8bit):	6.584112685753224
Encrypted:	false
SSDEEP:	12288:uA1hpIV1Fn6OAVo1TCIV7B+AcieFXe7SIcNo5fqOedXJuL:pG65o12c7BWGSP4fqXK
MD5:	B737570F9E9A1BDD794F78E3906E61B9
SHA1:	0DD10ACAB603B2F1269D05534902B09D38E31AC5
SHA-256:	0A3A85FD6964B0CF1B61E41CC7C117ADA4C8607A0107AD4921DAFA69933EF0AC
SHA-512:	89FF7B15CE9C7D9B689C1C1A72DE630F3EC1DC2B3073818665DE0CB73C879D85ED853F0352BD6DBA93ED14D0674BE95DC726183B1D5218BE2BBA8F488057C446
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M.(................................. ........@.. ....................................`.................................@...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......<M...m......,....L..............................................Y.......E9......GP*...z....F..l..c.bZ.+$O\......a.CB...0...)Xq.@.^.r.s.....v.S.y.s)..Y..bfC.%%.C.....0.C...i.\D.z.G@Jh.L..0gj.....b...CZQ.]. ...............nF..........i..+6z1....C.....u6.x9.t....~...\|.z./l..._.Q.....1x2.n.>...(..x{(].d7gNaVb..0#...u.$.`..h)W.....J(...........P...V@.d..>.f......m..p...........J.ex....}..r.....d.......[.mYZ..[)]k&...Lh.-.uf.. ..o._F....Vc.>jh..g}...+.

C:\Users\user\gvvccsccefghhsnd.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.584112685753224
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO_6620200947535257662_Arabico.PDF.exe
File size:	819712
MD5:	b737570f9e9a1bdd794f78e3906e61b9
SHA1:	0dd10acab603b2f1269d05534902b09d38e31ac5
SHA256:	0a3a85fd6964b0cf1b61e41cc7c117ada4c8607a0107ad4921dafa69933ef0ac
SHA512:	89ff7b15ce9c7d9b689c1c1a72de630f3ec1dc2b3073818665de0cb73c879d85ed853f0352bd6dba93ed14d0674be95dc726183b1d5218be2bba8f488057c446
SSDEEP:	12288:uA1hpIV1Fn6OAVo1TCIV7B+AcieFXe7SIcNo5fqOedXJuL:pG65o12c7BWGSP4fqXK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M.(................................. ........@.. ....................................`................................

File Icon


Icon Hash:	c2d2cacad2dac2b5

Static PE Info

General
Entrypoint:	0x4aba8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x28EC4D1C [Fri Oct 4 11:14:36 1991 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaba40	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x1e1ba	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa9a94	0xa9c00	False	0.646130568851	data	6.66011560165	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x1e1ba	0x1e200	False	0.31882942168	data	5.62921284867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xac250	0x4b17	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xb0d68	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0xc1590	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xc57b8	0x25a8	data
RT_ICON	0xc7d60	0x10a8	data
RT_ICON	0xc8e08	0x988	data
RT_ICON	0xc9790	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xc9bf8	0x68	data
RT_VERSION	0xc9c60	0x370	data
RT_MANIFEST	0xc9fd0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 1992 AFJJ37@>78:@HDI
Assembly Version	1.0.0.0
InternalName	mcntyre.exe
FileVersion	1.2.2.2
CompanyName	AFJJ37@>78:@HDI
Comments	F57J8JB63IE655B2;:3
ProductName	96B<978J9;I>I72><3
ProductVersion	1.2.2.2
FileDescription	96B<978J9;I>I72><3
OriginalFilename	mcntyre.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
04/06/21-10:36:02.258188	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.290439	ICMP	449	ICMP Time-To-Live Exceeded in Transit	84.17.52.126	192.168.2.6
04/06/21-10:36:02.293339	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.325672	ICMP	449	ICMP Time-To-Live Exceeded in Transit	5.56.20.161	192.168.2.6
04/06/21-10:36:02.326654	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.364823	ICMP	449	ICMP Time-To-Live Exceeded in Transit	81.95.15.57	192.168.2.6
04/06/21-10:36:02.366540	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.404984	ICMP	449	ICMP Time-To-Live Exceeded in Transit	152.195.101.202	192.168.2.6
04/06/21-10:36:02.406086	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.444532	ICMP	449	ICMP Time-To-Live Exceeded in Transit	152.195.101.129	192.168.2.6
04/06/21-10:36:02.445016	ICMP	384	ICMP PING	192.168.2.6	93.184.221.240
04/06/21-10:36:02.482920	ICMP	408	ICMP Echo Reply	93.184.221.240	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 10:38:01.661478996 CEST	49754	50005	192.168.2.6	185.157.161.86
Apr 6, 2021 10:38:04.667439938 CEST	49754	50005	192.168.2.6	185.157.161.86
Apr 6, 2021 10:38:10.667876959 CEST	49754	50005	192.168.2.6	185.157.161.86
Apr 6, 2021 10:38:20.153971910 CEST	49756	50005	192.168.2.6	185.157.161.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 6, 2021 10:35:59.397299051 CEST	49283	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:35:59.443243980 CEST	53	49283	8.8.8.8	192.168.2.6
Apr 6, 2021 10:35:59.517369986 CEST	58377	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:35:59.563328028 CEST	53	58377	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:00.804811954 CEST	55074	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:00.853636026 CEST	53	55074	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:02.191914082 CEST	54513	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:02.257329941 CEST	53	54513	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:02.711837053 CEST	62044	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:02.770776987 CEST	53	62044	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:09.553786039 CEST	63791	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:09.602634907 CEST	53	63791	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:09.999507904 CEST	64267	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:10.064980984 CEST	53	64267	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:10.082122087 CEST	49448	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:10.136673927 CEST	53	49448	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:26.339577913 CEST	60342	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:26.396933079 CEST	53	60342	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:27.212419987 CEST	61346	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:27.269778967 CEST	53	61346	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:32.991431952 CEST	51774	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:33.037364006 CEST	53	51774	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:36.954302073 CEST	56023	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:37.012487888 CEST	53	56023	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:45.596035004 CEST	58384	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:45.641974926 CEST	53	58384	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:46.486073017 CEST	60261	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:46.541996956 CEST	53	60261	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:48.242137909 CEST	56061	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:48.290954113 CEST	53	56061	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:49.800721884 CEST	58336	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:49.942778111 CEST	53	58336	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:50.392990112 CEST	53781	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:50.441786051 CEST	53	53781	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:50.506048918 CEST	54064	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:50.569228888 CEST	53	54064	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:51.103629112 CEST	52811	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:51.158143997 CEST	53	52811	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:51.644021034 CEST	55299	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:51.725781918 CEST	63745	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:51.728620052 CEST	50055	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:51.774887085 CEST	53	50055	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:51.783021927 CEST	53	63745	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:51.787916899 CEST	53	55299	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:51.880153894 CEST	61374	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:51.935127974 CEST	53	61374	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:52.171984911 CEST	50339	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:52.253487110 CEST	53	50339	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:52.340657949 CEST	63307	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:52.386590004 CEST	53	63307	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:52.925522089 CEST	49694	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:52.983159065 CEST	53	49694	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:53.452385902 CEST	54982	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:53.507927895 CEST	53	54982	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:55.018774986 CEST	50010	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:55.067365885 CEST	53	50010	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:56.314537048 CEST	63718	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:56.360495090 CEST	53	63718	8.8.8.8	192.168.2.6
Apr 6, 2021 10:36:56.813999891 CEST	62116	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:36:56.871093988 CEST	53	62116	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:07.923084974 CEST	63816	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:07.968991995 CEST	53	63816	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:08.062706947 CEST	55014	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:08.090409040 CEST	62208	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:08.127232075 CEST	53	55014	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:08.167853117 CEST	53	62208	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:08.515583992 CEST	57574	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:08.561724901 CEST	53	57574	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:08.577095985 CEST	51818	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:08.633795023 CEST	53	51818	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:11.131500006 CEST	56628	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:11.189194918 CEST	53	56628	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:23.345535994 CEST	60778	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:23.391628027 CEST	53	60778	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:33.386636019 CEST	53799	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:33.435512066 CEST	53	53799	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:35.820000887 CEST	54683	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:35.908873081 CEST	53	54683	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:42.182859898 CEST	59329	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:42.228646040 CEST	53	59329	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:43.043751001 CEST	64021	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:43.098184109 CEST	53	64021	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:45.124299049 CEST	56129	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:45.194892883 CEST	53	56129	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:46.069515944 CEST	58177	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:46.115487099 CEST	53	58177	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:53.475512981 CEST	50700	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:53.521442890 CEST	53	50700	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:54.615837097 CEST	54069	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:54.661771059 CEST	53	54069	8.8.8.8	192.168.2.6
Apr 6, 2021 10:37:59.579653025 CEST	61178	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:37:59.626425982 CEST	53	61178	8.8.8.8	192.168.2.6
Apr 6, 2021 10:38:01.148498058 CEST	57017	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:38:01.199031115 CEST	53	57017	8.8.8.8	192.168.2.6
Apr 6, 2021 10:38:05.286000013 CEST	56327	53	192.168.2.6	8.8.8.8
Apr 6, 2021 10:38:05.334856033 CEST	53	56327	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PO_6620200947535257662_Arabico.PDF.exe PID: 6408 Parent PID: 5988

General

Start time:	10:36:07
Start date:	06/04/2021
Path:	C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO_6620200947535257662_Arabico.PDF.exe'
Imagebase:	0x240000
File size:	819712 bytes
MD5 hash:	B737570F9E9A1BDD794F78E3906E61B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.466854129.00000000037EA000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.467149528.0000000003947000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6780 Parent PID: 6408

General

Start time:	10:36:22
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6788 Parent PID: 6780

General

Start time:	10:36:22
Start date:	06/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 6816 Parent PID: 6780

General

Start time:	10:36:23
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' /f /v 'Shell' /t REG_SZ /d 'explorer.exe,C:\Users\user\gvvccsccefghhsnd.exe,'
Imagebase:	0x10a0000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: gvvccsccefghhsnd.exe PID: 6824 Parent PID: 6408

General

Start time:	10:37:05
Start date:	06/04/2021
Path:	C:\Users\user\gvvccsccefghhsnd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\gvvccsccefghhsnd.exe'
Imagebase:	0x340000
File size:	819712 bytes
MD5 hash:	B737570F9E9A1BDD794F78E3906E61B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000013.00000002.612087588.00000000039B3000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000013.00000002.611698378.0000000003738000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000013.00000002.611940927.0000000003856000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: InstallUtil.exe PID: 5596 Parent PID: 6824

General

Start time:	10:37:55
Start date:	06/04/2021
Path:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Imagebase:	0xc80000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001C.00000002.601546888.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001C.00000002.611212434.0000000005970000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001C.00000002.605270680.0000000004179000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000001C.00000002.610481587.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO_6620200947535257662_Arabico.PDF.exe PID: 6408 Parent PID: 5988 PO_6620200947535257662_Arabico.PDF.exeCOMMON

Executed Functions

Function 04B93498, Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

t, xrefs: 04B93530

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: ff2155d5375ac0f2a893cf48f738da2edfe38acc6d9697e1ce7e5b33e97f77ea
Instruction ID: f10c88dfbba9f3be817593c95e0d651577b242cfecd35a1efbd792a3e09db45d
Opcode Fuzzy Hash: ff2155d5375ac0f2a893cf48f738da2edfe38acc6d9697e1ce7e5b33e97f77ea
Instruction Fuzzy Hash: 9931C5B5A04204CFDB418BADC4802AEBBF8EF59304F4251ABD911DB352D638ED469792

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E020, Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5229a8c8329d603df6d5c05f812648e94f7f9fb3f1b3e10a093f514acb06a7
Instruction ID: 1d857db06ddeea4178d0d8ec12eeb655af536a7ea0978f2e65b26b70caf725ec
Opcode Fuzzy Hash: 5a5229a8c8329d603df6d5c05f812648e94f7f9fb3f1b3e10a093f514acb06a7
Instruction Fuzzy Hash: 4E825B71A001199FDB14DF68C884BAEBBF6FF88304F198869E449DB291DB34DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B95D98, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b221387c89acecabbb5bc8ac3e777426bb0060648ef7112066b13d730e11c60
Instruction ID: 7fc07c976b8e8ad4246dd34d3497f9f45e2314e3b47611177408922f3fe545cb
Opcode Fuzzy Hash: 3b221387c89acecabbb5bc8ac3e777426bb0060648ef7112066b13d730e11c60
Instruction Fuzzy Hash: 63320474A01268CFDB64DF64D844BADBBB2FB49305F1094EAD44AA7394DB399E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04B95D8A, Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e1ad380c29c0e8c98bee47361af6873dd541fad269d6d2dedb0d346a175e05
Instruction ID: afaaa836fa48b1f0abd5f2f13c75e739f7e0529fed31bf812c3c1cd95e4da9e3
Opcode Fuzzy Hash: 12e1ad380c29c0e8c98bee47361af6873dd541fad269d6d2dedb0d346a175e05
Instruction Fuzzy Hash: 00320574A01268CFDB64DF64D844BADBBB2FB49305F1094EAD44AA7394DB399E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04B94218, Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd99fe7cd50c2f478242da0863ed58d8648297033b2ea3cc132236b6d355590
Instruction ID: 6cb91f4d0fe1919de29c2d0ce32c531761b9d0ad260dba698a8afa3e6411ca8f
Opcode Fuzzy Hash: 3bd99fe7cd50c2f478242da0863ed58d8648297033b2ea3cc132236b6d355590
Instruction Fuzzy Hash: 8822C075A00218DFDB15CFA8C940F99BBB2FF49304F1580E9E609AB266DB31AD91DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00D0AF40, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db0fbea0405de06469a106a6933d8e50e02d591e3347d9709a17b665adcd45a
Instruction ID: 496b7931510cce3bebe1c9cda1610e3db56625ba742a1b5298ab841bda237d27
Opcode Fuzzy Hash: 8db0fbea0405de06469a106a6933d8e50e02d591e3347d9709a17b665adcd45a
Instruction Fuzzy Hash: A1A1D1707182455FE314AA389855B7B7696EB80704F21C82AB60BDB3CADF789C418BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04B9B700, Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fdb52c5be60def1886201de86ec67df030e72862d8689dc35f7247d5e2f2f6
Instruction ID: a5775c76d350566346ad51a4b5869331c9cdc238d77560ffa33ddc237e50e925
Opcode Fuzzy Hash: c0fdb52c5be60def1886201de86ec67df030e72862d8689dc35f7247d5e2f2f6
Instruction Fuzzy Hash: 27B13774E002089FCF14DFA9C494A9EBBF6EF49304F24856AE449AB361DB31AD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 063F4460, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470907601.00000000063F0000.00000040.00000001.sdmp, Offset: 063F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05423c79bb80d28bf818bc669360d58b989c42c3ed8ef81282ba5162af0f1c61
Instruction ID: 42ddc959aae6df732fdcf34041de153eed8870ba93e309acad4b6cf8e7490ea0
Opcode Fuzzy Hash: 05423c79bb80d28bf818bc669360d58b989c42c3ed8ef81282ba5162af0f1c61
Instruction Fuzzy Hash: 1251E074E042188FDB14DFA5C554BEEBBF2EB89304F14802AE815AB395C739994ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 063F8090, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470907601.00000000063F0000.00000040.00000001.sdmp, Offset: 063F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ef33f5542bada82481f07cdd6a587d440e8e7f1e06f13579d8bd5c2592829f
Instruction ID: cc39f612043b131e4a110b867a6aacfa2e6b99baa6628d0ad63f3f787bd34759
Opcode Fuzzy Hash: e1ef33f5542bada82481f07cdd6a587d440e8e7f1e06f13579d8bd5c2592829f
Instruction Fuzzy Hash: 0A514734E15208DFCB48CFA8D854AADFBB5FF89314F10912AD429A3390CB35A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04B9E0A4, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343bea0f84c3c4e878bc4d4351ece348d9f7e467f092bc0493fccd3a0c6c113a
Instruction ID: 24fc0a23a699de3144e2a92f384421d491525b56d25132b97ca81d6966c186e7
Opcode Fuzzy Hash: 343bea0f84c3c4e878bc4d4351ece348d9f7e467f092bc0493fccd3a0c6c113a
Instruction Fuzzy Hash: 3B4198B4D002589FDF10CFA9C584ADEBBF5EB09304F20956AE819BB260DB31A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04B9DA74, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2746530247473426ddd8b12d61dcadde1f54dfa539e553bc9284da88ab0be1af
Instruction ID: fe35c322b1d4cc438d09eb9d5f3de4fc0c3df397e428f2f71508b1cc292bd4d8
Opcode Fuzzy Hash: 2746530247473426ddd8b12d61dcadde1f54dfa539e553bc9284da88ab0be1af
Instruction Fuzzy Hash: 5B419AB4D002589FDF10CFA9C584ADEBBF5FB09304F24946AE815BB260D770A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04B9B1EC, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d74e322c2772178329098873f91a72faab16d5d69374d9cf13b344c7c9336a7
Instruction ID: fa1b3b2750fe8c81f3141fd64db0ba95e81bd4dc00f3c1bba7c78f25789c4241
Opcode Fuzzy Hash: 9d74e322c2772178329098873f91a72faab16d5d69374d9cf13b344c7c9336a7
Instruction Fuzzy Hash: C141AAB4D042489FDF10CFA9D584ADEBBF4FB09314F20946AE405BB260DB74A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04B9AFF4, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f94afe58c228e0cb1b59ddddcf62a5cf95a3c0ddf41ebc7650221cb6fe9c285
Instruction ID: f7c1a10b8c861bda886b5c61e6704c34f10d7b96fe6a2397d1bb3d8797cd7b5c
Opcode Fuzzy Hash: 6f94afe58c228e0cb1b59ddddcf62a5cf95a3c0ddf41ebc7650221cb6fe9c285
Instruction Fuzzy Hash: 8741B8B4D082489FDF10CFA9D584ADEBBF0FB09314F20906AE415BB260DB74A949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BDE4, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3721924a72fa65619a74536d8e45c6d7a281e161e7512f2ddb92513098141c0
Instruction ID: ae606824df28d6c38ec2e51678d327521a56721f67bcc549d38249d19d494cf7
Opcode Fuzzy Hash: e3721924a72fa65619a74536d8e45c6d7a281e161e7512f2ddb92513098141c0
Instruction Fuzzy Hash: 4121B074D04609EFCB14DFAAD4446EEBBF5BB49310F20E969E814BB250D734A941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BDF0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbae0422551e0497473374d960cf58bc98ab8ee2927f3e3ff6615db0ba4e69f
Instruction ID: 6d1f44878d1fab9dd03739bd83c109fa40479c9be495f0bb56d0fc91259cf7a9
Opcode Fuzzy Hash: 6cbae0422551e0497473374d960cf58bc98ab8ee2927f3e3ff6615db0ba4e69f
Instruction Fuzzy Hash: 5B217D74D04609DFDB04CFAAD4446EDBBF5BB49310F10E969E924BB250D734A941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 063F48CC, Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 063F7119

Memory Dump Source

Source File: 00000000.00000002.470907601.00000000063F0000.00000040.00000001.sdmp, Offset: 063F0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: e883271f62d54a58fb9867814bcdea6e9123ccd22bd1c1b1f8b3e86f58632c32
Instruction ID: 67715c271f980f019eddb6ddd5584ec320e43bdbed832af10e98aaf1567fcfe3
Opcode Fuzzy Hash: e883271f62d54a58fb9867814bcdea6e9123ccd22bd1c1b1f8b3e86f58632c32
Instruction Fuzzy Hash: 18C1EF74E102188FDB64CFA8D981BDEBBB2BF49304F1481A9E509B7351DB34A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 063F6E6C, Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470907601.00000000063F0000.00000040.00000001.sdmp, Offset: 063F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bc693f51ae47b48260dbab767742fcd98174c6caa20a0b7860b24c5d4e06f6
Instruction ID: 6172f4dea83102f44db7e37e16bc8305f2c9d27753253760717d33dd5d5c5d2d
Opcode Fuzzy Hash: 65bc693f51ae47b48260dbab767742fcd98174c6caa20a0b7860b24c5d4e06f6
Instruction Fuzzy Hash: 61B1F174E142188FDB64CFA8D981BDEBBB2BF49304F1481AAE508B7351D734A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B94CE0, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04B95781

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 52278a07493a41ad8299aa3514e53e83b2978301ee881e41c0404cebf440398f
Instruction ID: 9482fcdb56ab30d46738054c05082b1f7c13fd7b706cf4657840f7a8f25f51e2
Opcode Fuzzy Hash: 52278a07493a41ad8299aa3514e53e83b2978301ee881e41c0404cebf440398f
Instruction Fuzzy Hash: 6331A9B5D05258DFCF10CFA9D884AEEFBF5AB49314F14806AE418B7210D778AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B956E0, Relevance: 1.6, APIs: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04B95781

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 37cd587c0b32ebecaa683b6c87b262d156eb212bd6a009cd725e1f2901e3aef8
Instruction ID: d6e8081a53a62ee66b45c6f0568ad8898b879e4b1818240f9a520adc63294f90
Opcode Fuzzy Hash: 37cd587c0b32ebecaa683b6c87b262d156eb212bd6a009cd725e1f2901e3aef8
Instruction Fuzzy Hash: 1631CAB5D05259DFCB10CFA9D884AEEFBF5AB49314F14806AE404B7210D738AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D638, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1aaae5a752fce12e5dc9f9849f7848432a6fd9e7ed58061a95a2ef0d41c0118
Instruction ID: 5bef860d446a5366eb67841a01c6dd8651f515e7ceac2dd4380b49b3a92a6356
Opcode Fuzzy Hash: e1aaae5a752fce12e5dc9f9849f7848432a6fd9e7ed58061a95a2ef0d41c0118
Instruction Fuzzy Hash: 91F1CE317002149FDB19ABA4D858B6E77A7EB88744F18846EE54ADB3C4CF78DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FAF0, Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244170cae92feea28eda1fdb5a381bba3abcdffbe847ff80e74a143da1066340
Instruction ID: 4627608f91d925dcab1ca7369ccdb474ed4ff364246c785434da417c3857a88c
Opcode Fuzzy Hash: 244170cae92feea28eda1fdb5a381bba3abcdffbe847ff80e74a143da1066340
Instruction Fuzzy Hash: 5CE1DB75A002198FCB14DF6CC584A9DBBF6FF88314B2A8465E519EB7A2C734EC41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D0DC88, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e503495902e94f0bf245cbeea7729308e01399b3a8550a2121375735b3929bf5
Instruction ID: ddbcda9ea90d1d6ef7ad76917a2b6b96ed99d071fc6eb2897bb6ff86512507c3
Opcode Fuzzy Hash: e503495902e94f0bf245cbeea7729308e01399b3a8550a2121375735b3929bf5
Instruction Fuzzy Hash: EA814E75B002058FDB14CFA9C484BAAB7F3AF99314B19816AE44ADB3A5D731EC41CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D0C118, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b0ff1bf3ea575ce6514d9f0fa0da72a8730f62597cd76f3693f34aecffadb0
Instruction ID: 1b90aabbd63e513758137642e9ca5b364abb54c0e56a0169ec1f993c93579a39
Opcode Fuzzy Hash: 57b0ff1bf3ea575ce6514d9f0fa0da72a8730f62597cd76f3693f34aecffadb0
Instruction Fuzzy Hash: C671C230B252048FDB049BB8C85577E72E3AB89344F289575E94ADB7C1DE34DC418BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D0F938, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e112e9d8aabea3a7ca9f685d5a511fd9d9a0504a6d06ae8ce1539078fe6526c2
Instruction ID: 2df65c8aa67bfbef80eb722b4d76f3e154585d7c202e937dbe492beef50a50b8
Opcode Fuzzy Hash: e112e9d8aabea3a7ca9f685d5a511fd9d9a0504a6d06ae8ce1539078fe6526c2
Instruction Fuzzy Hash: 833192327001449FCB149B68D854BAE7BF6EB89714F18447AE506EB7D1CF399C01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0C8A8, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675ad9f8d31dd6a1e27b02a30e743d2a8a8db250d90f4b0d9ff000b028eb5280
Instruction ID: 972f810d31d6464127a5595472ad3953c888c7d287f4b934680fea7151f95839
Opcode Fuzzy Hash: 675ad9f8d31dd6a1e27b02a30e743d2a8a8db250d90f4b0d9ff000b028eb5280
Instruction Fuzzy Hash: 9931A272A1421ACBCB009FA9D8807AEBB70FB09305F149727E59DD72C1C334D9149BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0B6B8, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3042025203128dee3e497f3317b344582881d4c7ef1ab6539b96de56c6c104c0
Instruction ID: 1a524a6334b17a2e659ccee0207bf56baa985b4aef1e9ba70c861ef44ebda7ac
Opcode Fuzzy Hash: 3042025203128dee3e497f3317b344582881d4c7ef1ab6539b96de56c6c104c0
Instruction Fuzzy Hash: 1021B135E082559BC7109BACC4813BABBA6EFC1720F55866BD5199B286C331DD80C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00D0AE18, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e48992e8bca95ec06223bda99ff6c0b898f86a89f167342066a6af46d9c2e07
Instruction ID: 05634dbb64b6a3fd397a515adaed469ff81eb5d0d5bcd24fdcbd7c5c86ea44de
Opcode Fuzzy Hash: 6e48992e8bca95ec06223bda99ff6c0b898f86a89f167342066a6af46d9c2e07
Instruction Fuzzy Hash: A5218072B483198BD750CA6DC8447AAF3A5EB94310F244126F69EC77D0D634DC419763

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f1966549c9d18d73b55b67bd1c518e93140a58fb65c9c267976031d2a4d9bf
Instruction ID: be95eaa164c1596d92f8535051dc64612e8b5e182c149382936bb4e5fcb8de9d
Opcode Fuzzy Hash: 45f1966549c9d18d73b55b67bd1c518e93140a58fb65c9c267976031d2a4d9bf
Instruction Fuzzy Hash: 5721F1B5504240DFCB09DF14D8C0F16BBA5FB98324F24C5BDE9054B346C336E856D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd24e5dd2926955182c11f7f5abf8a4ceb839e26a2cd9002fab862066d0b3f2
Instruction ID: a87d1ef709b066c673087283a23e1c10a6ac5475854a5d052dd929c55b6cc20a
Opcode Fuzzy Hash: 6bd24e5dd2926955182c11f7f5abf8a4ceb839e26a2cd9002fab862066d0b3f2
Instruction Fuzzy Hash: B02133B5504200DFDB05DF14D8C0F27BBA5FBA8328F2085BDE9050B246C336D856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D08FD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a4d5a38a7178cbcb6ee6c2892bc40fd5bff26cfd7c40763ce8383ea4f5b339
Instruction ID: 80d6cf0f088b7e5d299caa86a88d2b2b525cbf9aeabb94726736e9ae9a401eaf
Opcode Fuzzy Hash: 44a4d5a38a7178cbcb6ee6c2892bc40fd5bff26cfd7c40763ce8383ea4f5b339
Instruction Fuzzy Hash: 4511D0317041485FE7386A7D8860B2B759AEB88B08F10883EFA07DB7C1CE69DC4153B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0AD08, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86e6404f6eb120e14e58afa6ca8db842c978d389f89184b630c5ca51986cca5
Instruction ID: 51c3dcf86de43449b923afb48186bd9aeff77426abdd2911a9e3a0b5d2c43132
Opcode Fuzzy Hash: a86e6404f6eb120e14e58afa6ca8db842c978d389f89184b630c5ca51986cca5
Instruction Fuzzy Hash: DC117271A0420A8BD7508E9DE8407BEF6BAEB90301F204527D55AD7AC4E678DA4197B3

Uniqueness

Uniqueness Score: -1.00%

Function 00D0BB38, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb44eba0e37820ccf2ed82248c7f85307714018502efdf4dd6f23e4941ddc4b
Instruction ID: ef2437fe4182f1a52223bb8f82e851fe8709187f3bf534568031e5b1cd9d6855
Opcode Fuzzy Hash: ecb44eba0e37820ccf2ed82248c7f85307714018502efdf4dd6f23e4941ddc4b
Instruction Fuzzy Hash: A511B2317082409FD3206B69981A77AB696EB81720F24842BE64ACB7D5DF79DC418732

Uniqueness

Uniqueness Score: -1.00%

Function 06310B81, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50440ab497feadbbc1c184b3d781e06e216873b1f58096a9e736f52e5acb61a
Instruction ID: 9b77f6caf67c213dcf03953b277d0dcc3d9d766486f8ce6dfd0241ff4127137c
Opcode Fuzzy Hash: f50440ab497feadbbc1c184b3d781e06e216873b1f58096a9e736f52e5acb61a
Instruction Fuzzy Hash: E9212F70D0E3C4DFCB57CBB49854598BFB0AF07204B1980EBC484DB662D7385A49DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D0C9F8, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8cc6d9a14a33a3d2579c8b251bd7a936a5bc2936ab99d52d1ee18429be1f3b
Instruction ID: 4d01766b55446673c78dd0f702cdcbc944644c97c5527fd5f777ac892d7ea18e
Opcode Fuzzy Hash: 1f8cc6d9a14a33a3d2579c8b251bd7a936a5bc2936ab99d52d1ee18429be1f3b
Instruction Fuzzy Hash: D11193327102089FDB05EF29E444B6B37A6EF84714F089569F90E8B394CB39DD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction ID: 2cc57e314a4261dbddbbb4709a5b8162e5c30a0c4ec0a1c9ae78996a02da017c
Opcode Fuzzy Hash: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction Fuzzy Hash: 2111AF76504280CFCB15CF10D9C4B16BFB1FB94324F24C6ADD9454B656C336E85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction ID: 857ef04332e17b0f50fd507b4505a693d7879db9f5d0db8b2582783237d5c657
Opcode Fuzzy Hash: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction Fuzzy Hash: CF11B176504280CFCB12CF14D5C4B16BFB1FB94324F24C6ADD8050B656C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06310001, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3f4b00f12311488e5c427e52445d688e28f09c0800ea85c5ece3f402ec4826
Instruction ID: b7b717f8da11f784f808c9a29ef14d60e272ae09dd319cac2fb7c6760ac2fb36
Opcode Fuzzy Hash: cd3f4b00f12311488e5c427e52445d688e28f09c0800ea85c5ece3f402ec4826
Instruction Fuzzy Hash: FE11057184E3C4AFC3079BB48C251967FB59F17204B1A04EBD484CB1A3E6384D49CB72

Uniqueness

Uniqueness Score: -1.00%

Function 06310B25, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19853c01539dbcb357d1677e3b00fd73c0b72a8cd91d07242176293c077d5d9
Instruction ID: 4a4525a2fa1bba9cd9f570ee720b089f91b26ea5ebcbb6174f0ac38fdff14c3e
Opcode Fuzzy Hash: d19853c01539dbcb357d1677e3b00fd73c0b72a8cd91d07242176293c077d5d9
Instruction Fuzzy Hash: 5D113630D0A388DFCB5ACBB89450699BFB0EF06204F1481EBC454DB6A1D7399A85DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D03E40, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4221f9cd2b97c8c168f7b0145b164d477306f9a9b2a043fb8bb778a4781a0083
Instruction ID: 1073067dc072c879c7e847b4cd673b7d7a769d930f6758c6d355685256b73f04
Opcode Fuzzy Hash: 4221f9cd2b97c8c168f7b0145b164d477306f9a9b2a043fb8bb778a4781a0083
Instruction Fuzzy Hash: BB115B70E05248AFCB41EFE8C4516EEBFF5EF85304B2089EAD115EB265EB305A159F81

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD819, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b56878877afdd07e398799a19253ec71a9609971aca3ba7891958e7b8a152a0
Instruction ID: ec61cc6d4992c7184863b83c403854a671199091598ed9876390276d6262252f
Opcode Fuzzy Hash: 1b56878877afdd07e398799a19253ec71a9609971aca3ba7891958e7b8a152a0
Instruction Fuzzy Hash: 880126B5408344AAEB205A69CCC4FA7FBD8EF41334F1884AEEE045B282D379DC44C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D03E50, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b672ce2ec50f3038864b36cd3401c682999a215d06d7517caac37572182594
Instruction ID: b63bc4f8d9e05fdab6c7c2cd80f951916028c80ebfac7c8884d6b43a520fb82c
Opcode Fuzzy Hash: c2b672ce2ec50f3038864b36cd3401c682999a215d06d7517caac37572182594
Instruction Fuzzy Hash: 78011E70E0020DAFDB40EFE8C4416EEBBF5EB84304F50C9AAD115AB354EB309A059F81

Uniqueness

Uniqueness Score: -1.00%

Function 063107C5, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d50b8fa1fd80c38265e15d1bb03cb40dbbc00df74a916b65bf8b965669ca9b0
Instruction ID: a187b0841b5c6e43253fb67341af0fbde34e5848da1a9b5d872c5c8d7798c10b
Opcode Fuzzy Hash: 7d50b8fa1fd80c38265e15d1bb03cb40dbbc00df74a916b65bf8b965669ca9b0
Instruction Fuzzy Hash: 0E01A93480A388EFC746CFA4D844999BFB4EF06310F0540DBE884DB262D7349D98DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D07B08, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b4f51fadf2e8cb58c1184eb74f06701674047dbd7f40663325287ad0ebb3a8
Instruction ID: ac8a371913fc291690067ff8af3df6f580ba90fed7f166ad5913ce16d47d0a2e
Opcode Fuzzy Hash: 72b4f51fadf2e8cb58c1184eb74f06701674047dbd7f40663325287ad0ebb3a8
Instruction Fuzzy Hash: 59F03A30E0D10DDBD744AFACE80637A76A0E704301F200476946ECB2C0EA39E9919B72

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD818, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465132447.0000000000BCD000.00000040.00000001.sdmp, Offset: 00BCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8b09fa6c28f9960eb9cb063e8ebab9fb5e6ccc3081ccc0aae78f0ff49eaa21
Instruction ID: da42f1a6ed6ee5bf333bee6edce0dd3afa8e5d4e30c3790a2048a71660c4420f
Opcode Fuzzy Hash: 6a8b09fa6c28f9960eb9cb063e8ebab9fb5e6ccc3081ccc0aae78f0ff49eaa21
Instruction Fuzzy Hash: 6EF06271404384AEEB108A59DCC4BA2FFD8EB41774F18C55EED085B296C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0AC48, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcff2ec24d531dde46cd83752a5d11d7c549ee7551d35c2440f92333d65fdd8e
Instruction ID: 86bce5ba2a812b1bf125e556affa5de9e19b1c0700d9c83648b24f4936eee4ff
Opcode Fuzzy Hash: bcff2ec24d531dde46cd83752a5d11d7c549ee7551d35c2440f92333d65fdd8e
Instruction Fuzzy Hash: 79F09070E14329DBEB005A9CD8057BA7A64EB44B10F124867E54AE73C0CAB88E009BE6

Uniqueness

Uniqueness Score: -1.00%

Function 06310989, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a706763b5c371a7807a1c4589f5a9305aa76154afd0d1bf7703e16fd7c6e928
Instruction ID: 47ec4b04211cf660ede4c8ab165098e14ad09d55551c9a721a48aa8da9ec55cb
Opcode Fuzzy Hash: 3a706763b5c371a7807a1c4589f5a9305aa76154afd0d1bf7703e16fd7c6e928
Instruction Fuzzy Hash: F9F0FF34D0E3849FC746DBB49865559BFF4EF06210B1540EBD844DB2A2D6385D45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 06310535, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc15b098a2b35d86cb599965f9a5b5ff6bf73397ebd37555302ebdf7b17ef6c
Instruction ID: 084471b2b4caaaf258209ecf7f30b4dfeb04e042d7d25adc2c47fee97c09f7b1
Opcode Fuzzy Hash: 7dc15b098a2b35d86cb599965f9a5b5ff6bf73397ebd37555302ebdf7b17ef6c
Instruction Fuzzy Hash: CEF05E3480E388EFC7068BA4EC54999BF74AF57300F0580D6E8449B262C7349E54DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06310819, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe46f2a6a66c03b1d5659d91738b572bfa3256b545352cde160589c8e313811
Instruction ID: e30f90cdb410dd6bc9502f0368bf4f9dd79d28535e526f223d0d3e072be6ad90
Opcode Fuzzy Hash: 1fe46f2a6a66c03b1d5659d91738b572bfa3256b545352cde160589c8e313811
Instruction Fuzzy Hash: F6F0F23040F3C49FC30797B499256967F399F03209B0A00DBE484CB1A3DA695D58E3B6

Uniqueness

Uniqueness Score: -1.00%

Function 06310E65, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ab5b3001081092655f177c94206e6f0742280bebbc73d5eec8241ca825184e
Instruction ID: d1718d590fdd9fcf704de8515af5a6e5e4f67db363317badd974368b0c92ad69
Opcode Fuzzy Hash: 89ab5b3001081092655f177c94206e6f0742280bebbc73d5eec8241ca825184e
Instruction Fuzzy Hash: D8F03A3480E3D8AFC757DBB458616A9BFB89F02204B5800EBD884D7193D7785E58D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 06310B40, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7540596bf077acf26ffb3bafada6066b9ab1a49cd514063f2a7d56a163c7a024
Instruction ID: 92ccc273c5041acf61839288b90ec9e9cb0eaa7756dc69c5840dcfcaf085c0eb
Opcode Fuzzy Hash: 7540596bf077acf26ffb3bafada6066b9ab1a49cd514063f2a7d56a163c7a024
Instruction Fuzzy Hash: D5E0E574D05218EFCB58DFA8E40069DFBF4EB49304F1080AAD81497340D739AA45EF91

Uniqueness

Uniqueness Score: -1.00%

Function 063109A8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c852e7a9726066107caacb69e0a468d971865cfe5034cd3ee2b51c8037f8d1
Instruction ID: caba7a24d2c9c84e4d174ff127f86480f9b27d159dd22e5e9d0fa89bcc5def90
Opcode Fuzzy Hash: 06c852e7a9726066107caacb69e0a468d971865cfe5034cd3ee2b51c8037f8d1
Instruction Fuzzy Hash: 4FE0C234E05208EFCB84DFA8D544A9CBBF4EB48304F1080AAD80897350D734AA40DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06310BA0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba9e91b178f699da908884d15a4f15fc005b000928eb3906b2d44385e84cf82
Instruction ID: 2c43d3ceefb7c0e8ca88c5051324c949485eb75ad9fb7e3938ffbc5a91358bbe
Opcode Fuzzy Hash: cba9e91b178f699da908884d15a4f15fc005b000928eb3906b2d44385e84cf82
Instruction Fuzzy Hash: 72E01234D0520CEFCB48DFE8E40029CBBB4EB48308F1080EAC818A3340DB39AA45DF80

Uniqueness

Uniqueness Score: -1.00%

Function 063107E0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd44c3334b34aee36edc55dc01c3b1a4a8cc013bfdaf1f3cfa5225e123ccc94e
Instruction ID: d31126dfbc40e43cea5edb2b28b9d1c49e7b7bb04cfaf9162ec0e64a4b440442
Opcode Fuzzy Hash: fd44c3334b34aee36edc55dc01c3b1a4a8cc013bfdaf1f3cfa5225e123ccc94e
Instruction Fuzzy Hash: 81E04F34905208EFCB48DFA4D44499CBBB5FF09311F108095E80457360C731AE94EB90

Uniqueness

Uniqueness Score: -1.00%

Function 06310550, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd44c3334b34aee36edc55dc01c3b1a4a8cc013bfdaf1f3cfa5225e123ccc94e
Instruction ID: 91fa6f5ea5756455f8a4f72fc49193a82615fba2086673fb70b470bfa1889a4d
Opcode Fuzzy Hash: fd44c3334b34aee36edc55dc01c3b1a4a8cc013bfdaf1f3cfa5225e123ccc94e
Instruction Fuzzy Hash: F7E04F34905208EFCB48DF94D44499CBBB5FF09311F108095E80457360C731AE54EB90

Uniqueness

Uniqueness Score: -1.00%

Function 06310E80, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1112da4b49cc9c311524860f0266e89862dd5a5aeed7ac71f6f23fae7cf454ca
Instruction ID: 248f9a8a3e4a4db63f9244cd7f3770676838e3c5cdc8265c99960a0fec7f7dad
Opcode Fuzzy Hash: 1112da4b49cc9c311524860f0266e89862dd5a5aeed7ac71f6f23fae7cf454ca
Instruction Fuzzy Hash: F9E0EC34C1625CDFCB58EFB8A51429CBBB49B04205F6000EAC94896240EB759F55DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06310048, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125db79c777393369a0309b56e1271df5ca827980d1c06d87f8c4734fc375267
Instruction ID: f7767089da71a59c89d7cf4ec548d34a42dc51584e668e3e088be161b8dc8695
Opcode Fuzzy Hash: 125db79c777393369a0309b56e1271df5ca827980d1c06d87f8c4734fc375267
Instruction Fuzzy Hash: 6EE0EC30D1520CDFCB58EFB8954429CBBB5AB04205F6000E9C90497340EB759E85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06310838, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470759474.0000000006310000.00000040.00000001.sdmp, Offset: 06310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31522da4c55850f911ad83e7ac66278f311e8a4964d2eba717013ee0b4ecd068
Instruction ID: 4913a0ca6520c66c3086975d5376f9cbf51702829754f093552420195b243e02
Opcode Fuzzy Hash: 31522da4c55850f911ad83e7ac66278f311e8a4964d2eba717013ee0b4ecd068
Instruction Fuzzy Hash: D2D0C93080A208DBC718EBE4A5117A9B779DB01209F5001A9D40857250DF76AD45D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0DF38, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7bed0418767f325297b67210a51090b1724a718243d19c3b15c9d5d24017df
Instruction ID: 80035e2c9311e2d9482955d12d73ce8be897bcf351b78d825d30eca068938fab
Opcode Fuzzy Hash: 5c7bed0418767f325297b67210a51090b1724a718243d19c3b15c9d5d24017df
Instruction Fuzzy Hash: 2BC012300742088EC240BF65E945875339BD6805083409C64D1088A16DDFB85E554FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D04D91, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e2d0545f7d4e8378cfa60c1e7fc60444cb668a960febe8a7bd272e2ed332db
Instruction ID: ebb1c800166c46bb9cb2b3838e7f5b76da5a8e00196a865eaf98b8084a6e31fc
Opcode Fuzzy Hash: 91e2d0545f7d4e8378cfa60c1e7fc60444cb668a960febe8a7bd272e2ed332db
Instruction Fuzzy Hash: 7DC0486280A3D80ADB0247A0485229A7F30AE4354878D80CA98889E093E618991E8355

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002434F8, Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

viP, xrefs: 002436FE

Memory Dump Source

Source File: 00000000.00000002.462295616.0000000000242000.00000002.00020000.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.462284995.0000000000240000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.462473005.0000000000301000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: viP
API String ID: 0-1202044730
Opcode ID: 47e9faf24138c983385c65af52727735e2e7d855f29f337fc5d2fa83d1fa05a0
Instruction ID: ee9bb108b6b46849aa63b58e60abab2a71631801e77ba620bb256191f2ea1694
Opcode Fuzzy Hash: 47e9faf24138c983385c65af52727735e2e7d855f29f337fc5d2fa83d1fa05a0
Instruction Fuzzy Hash: 25B141B24686539FD71ACF7499825DAFF68FA47320334529ED5918F663C3208A23CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 04B90340, Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d95c727c6f2f6e484f84ea602ab590451960e8b68ca414aae91105cf73523
Instruction ID: 8af8ad3286c92e1bfd26be6b14f6d7fc93a2a97f666ecfe558c3211107a9b639
Opcode Fuzzy Hash: 519d95c727c6f2f6e484f84ea602ab590451960e8b68ca414aae91105cf73523
Instruction Fuzzy Hash: C6C1D535B142148BCF14EB7898506BEB7F6EB88314F15886ED416DB385EF39AC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 04B97870, Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ebb2ef3a3012cd2b49ae9e0880be0803330b98198b3d232aa942abe72f8747
Instruction ID: 8f076b6c259cfd2a18cb2b51e9b0f3e640d03850d8b5fe07408c9e55cb2c9195
Opcode Fuzzy Hash: 00ebb2ef3a3012cd2b49ae9e0880be0803330b98198b3d232aa942abe72f8747
Instruction Fuzzy Hash: 71B19034724202CBDF241F66894937A77F6EF80B41F1489BDD4868AAA4DF34EC81D762

Uniqueness

Uniqueness Score: -1.00%

Function 04B9C598, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd2965c27ce3c3b6eb101eac07a753a08c168ee975481c626e385fd74eefd33
Instruction ID: 2b33b6301dd87c94bea3c3e6a58a2e6b46b426e5a0f5b0601db466dc8f21cbfb
Opcode Fuzzy Hash: 9bd2965c27ce3c3b6eb101eac07a753a08c168ee975481c626e385fd74eefd33
Instruction Fuzzy Hash: F3D1E831C2075A8ACB10EF64D950AE9B3B1FF95300F60DB9AD1497B214EB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B9C5A8, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a76751eec750918d2751ae020910e7ef30b9371f1dddf8f79bafe58da62b64
Instruction ID: eeb3e0c80f5357c17491d20b20c7d4b9f16a2c6e5a8a009fec2b5e21a5e09325
Opcode Fuzzy Hash: b2a76751eec750918d2751ae020910e7ef30b9371f1dddf8f79bafe58da62b64
Instruction Fuzzy Hash: E2D1E731C2065A8ACB10EF64D950AE9B3B1FFD5300F60DB9AD5497B214EB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00D0BC30, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.465270733.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a85957cee7e198a3d873cec961348cb78fb6989b407ae1e0e8825925d83bb27
Instruction ID: f27b2f27aea682625ec660b91e9f47f9f96b9e90e0943feb8ab8d9706d99e7bc
Opcode Fuzzy Hash: 8a85957cee7e198a3d873cec961348cb78fb6989b407ae1e0e8825925d83bb27
Instruction Fuzzy Hash: A251F261B081445BF7286678C86277F729ADB84B08F20842AB70B9F7C6DF75CC4153B1

Uniqueness

Uniqueness Score: -1.00%

Function 04B9420E, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6bc0ef04747d841f86ee09f31572480a7abe4faa184f83d0f9a6b064cbdf02
Instruction ID: c79a944ea046e218c721bf0c3e13180eb45eb9589bfaa8d68301ee36e270e693
Opcode Fuzzy Hash: 1f6bc0ef04747d841f86ee09f31572480a7abe4faa184f83d0f9a6b064cbdf02
Instruction Fuzzy Hash: A73196B5E056189BDB18CF6AD9406CAFBF3AFC9304F14C0BAD548A7214EB3059458F50

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BAC4, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f4f2819082fb22a0c36f21a8721db13282f5b3fd0b2e945d9d8bac9525fee
Instruction ID: 187072b15a6bc67c4b5f8cf01b0a84087fc04ec46eefe9033c26589c316ed2e9
Opcode Fuzzy Hash: ad9f4f2819082fb22a0c36f21a8721db13282f5b3fd0b2e945d9d8bac9525fee
Instruction Fuzzy Hash: F2319EB4D05209EFCB14CFA9E484AEDBBF1FF49310F249569E814A7294D734AA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BAD0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666c5989fc7a6eba5200a7b4f66fef5717ab550551bc5419851302eb977dccc4
Instruction ID: 1083f81d8cad4912f77bbbeaefcba603c9f5f7755d7e8418ecd22c622fad3066
Opcode Fuzzy Hash: 666c5989fc7a6eba5200a7b4f66fef5717ab550551bc5419851302eb977dccc4
Instruction Fuzzy Hash: D6314BB4D05208EFCB14CFA9E484AADBBF2FB49310F249169E814B7394D734AA41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04B9CB4A, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb46794ac07cbc77e8b864e760b046e0bed8c054beb702913d1287c32ddaf6de
Instruction ID: 9d860812dfc42883cd9aa8cee87559667ba54cfc183c37ff05dd227cf129f2b9
Opcode Fuzzy Hash: fb46794ac07cbc77e8b864e760b046e0bed8c054beb702913d1287c32ddaf6de
Instruction Fuzzy Hash: C421F071E056589BEB18CFABD95079AFBF3AFC9200F18C1BAD448A7255EB3019028F10

Uniqueness

Uniqueness Score: -1.00%

Function 04B96628, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f2d657936f4cc0f370aedc480c2dd06f0aa1f210573796bddd7bf0d2e4eb73
Instruction ID: a0946a573001127728738d15c3da764eaba9141ffb77925732a29293792911ca
Opcode Fuzzy Hash: 41f2d657936f4cc0f370aedc480c2dd06f0aa1f210573796bddd7bf0d2e4eb73
Instruction Fuzzy Hash: 0121A771E056588BEB58CFABC95029EFBF3AFC9300F14C56AC419AB265EB355906CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04B9CB58, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ada0fdf9384f162df1ac760784f441fea99f8858531a2bf846aaa8dfb43ea7
Instruction ID: 4ffd1949b0d026406beae30b49d5e564d71a8b818b6764f83c691af27564f468
Opcode Fuzzy Hash: 05ada0fdf9384f162df1ac760784f441fea99f8858531a2bf846aaa8dfb43ea7
Instruction Fuzzy Hash: 9921D371E016189BEB18CFABD94079DFAF7AFC8300F14C1BAD808A7254EB3059428F10

Uniqueness

Uniqueness Score: -1.00%

Function 04B96638, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d4108a59f900a1fca3ad4834797aaac8b027f6d5201c43e1f11f56d8774e10
Instruction ID: 6f42815550aca4715247c6530777318ad8707ac37779d693e3ea8d3d02ef7a13
Opcode Fuzzy Hash: 00d4108a59f900a1fca3ad4834797aaac8b027f6d5201c43e1f11f56d8774e10
Instruction Fuzzy Hash: 7C218871E006188BEB58CFABC94529EFBF7AFC8304F14C57AC518AB264EB755902CE50

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BD1E, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ac437c5c30b097cee553949dce8038e95426fee65ff7eeddb2babf739737ab
Instruction ID: 36eddf1c19db33cdc4ef5fc9ffa0d21372afcc0bcc2119b4fcc9f7e37f3f9518
Opcode Fuzzy Hash: 02ac437c5c30b097cee553949dce8038e95426fee65ff7eeddb2babf739737ab
Instruction Fuzzy Hash: AB01A4B5E052089FCF04CFA9D8408DEFBF1AF4A300F14A16AE844B3210E3309951CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 04B9BD28, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470020602.0000000004B90000.00000040.00000001.sdmp, Offset: 04B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 7e7bfe7e129674d149d5e54cf1838da99720df52136c5e5005c88bf9ae6fbf5a
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: BCF042B5D0520C9F8F04DFA9D5418EEFBF2BB59310F14A16AE814B3310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gvvccsccefghhsnd.exe PID: 6824 Parent PID: 6408 gvvccsccefghhsnd.exeCOMMON

Executed Functions

Function 065D6E24, Relevance: 1.8, APIs: 1, Instructions: 253processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,065DE31D,?,?,?), ref: 065DE584

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 2678c60c87a402489146388f1e27e8b4a10690bc4028a052888767898479c178
Instruction ID: caf80126c973a5581904a454e60828deaded4fd9a9d1ea008c3857a76d44a6f8
Opcode Fuzzy Hash: 2678c60c87a402489146388f1e27e8b4a10690bc4028a052888767898479c178
Instruction Fuzzy Hash: D291DE74D0022D8FCF25CFA8C880BDDBBB5BB19304F0495A9E549B7250EB70AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0255E020, Relevance: 1.0, Instructions: 952COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b53cf20ce552eda5287b1c543398e7092afb5fd0427548aea5ff0e569a48cf3
Instruction ID: 0bf5845a8b91749a79cd789e243e26c6405e86e4448f5d996ef082c03e473f11
Opcode Fuzzy Hash: 0b53cf20ce552eda5287b1c543398e7092afb5fd0427548aea5ff0e569a48cf3
Instruction Fuzzy Hash: 87828E74A001299FCB14DFA8C895AAEBBF6FF88304F14846AE905DB361DB34DE41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0255AF40, Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91da792ff4532bc85ea5ca79643eb3f9ab7574cb1590d3b17a5bd3ea6bebe0b5
Instruction ID: 90b8b73b60d8b7b19881f3b743b8c1d8ceaf1ce3d3601b014fddad7213d010de
Opcode Fuzzy Hash: 91da792ff4532bc85ea5ca79643eb3f9ab7574cb1590d3b17a5bd3ea6bebe0b5
Instruction Fuzzy Hash: C9E159717082558FE724AB7898647BE3753EFC0708F11846BEA068F3C9DE789D4287A5

Uniqueness

Uniqueness Score: -1.00%

Function 0255BFE0, Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b838bc1a6df4add9847a05f68147694288becf4dfb3f7d2eb6c1b50af0f2aa
Instruction ID: 9a7b9e69b586fdc076c26cffe9db2d59995f638060f00930c84f7d1518c83c6a
Opcode Fuzzy Hash: a4b838bc1a6df4add9847a05f68147694288becf4dfb3f7d2eb6c1b50af0f2aa
Instruction Fuzzy Hash: C6C11230B042589BD7049BB8C865BBEB7B2BF85305F148827E916DB380DB34DD45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0255A990, Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f5c17afdb816e3e9e224209b622292099e7ad7e834691470e546c34897bf23
Instruction ID: a3dca95dd6ffb3f5509201b13af69054fe9f30292cea1034c042cf9929252045
Opcode Fuzzy Hash: 96f5c17afdb816e3e9e224209b622292099e7ad7e834691470e546c34897bf23
Instruction Fuzzy Hash: E9815830B181699BE7108A6CCC653FF7B7AFBC1310F054667AD028B685CB28D945C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 065D6DA5, Relevance: 1.8, APIs: 1, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f92fd252ac18d20963b1243fe83f57dab4ba0c4b36114e11c63d315569cda41
Instruction ID: 3e05943d1c968c418d4aa903fa404966454d589b233e1af2205c7cbea8938f8a
Opcode Fuzzy Hash: 8f92fd252ac18d20963b1243fe83f57dab4ba0c4b36114e11c63d315569cda41
Instruction Fuzzy Hash: 22A10470C052589FCB25CFA8C890BDDBBB1AF1A304F0594E6E549AB251D7349E84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 065DE38C, Relevance: 1.8, APIs: 1, Instructions: 258processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,065DE31D,?,?,?), ref: 065DE584

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 2a15500a56b35fdb96751819a3e4918ea48f4f333a9b63b79053d89511bbff33
Instruction ID: 1d8627a212d5b02fee920e86429aed71bcd805ef0f1f40ce30fc199f612e95c2
Opcode Fuzzy Hash: 2a15500a56b35fdb96751819a3e4918ea48f4f333a9b63b79053d89511bbff33
Instruction Fuzzy Hash: 5591E074D0022D9FCF25CFA8D880BDDBBB5BB09304F0490A9E549B7250EB70AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 065DC130, Relevance: 1.6, APIs: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065DC22F

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1a455cc0a57e2d62f733e9642ebc6f717e4639b150a51971bdc2ca06c42c3090
Instruction ID: 5ab44f01967a76e890e8e2e9e81b8c0ff8800158dca4a1e222dddd74868f26fe
Opcode Fuzzy Hash: 1a455cc0a57e2d62f733e9642ebc6f717e4639b150a51971bdc2ca06c42c3090
Instruction Fuzzy Hash: DB41DE78D052589FCB10CFE9E880AEEFBB5BF09314F14906AE814BB250D734A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066016A8, Relevance: 1.6, APIs: 1, Instructions: 119injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 06601783

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a29b5fe268e468ed8c47e029218b017be27f727928121ca27210037ec21e694f
Instruction ID: daed9e87de1c6bbf7db80a267232565bdcf9f7abc54d2ec171b56fdcc1878ee1
Opcode Fuzzy Hash: a29b5fe268e468ed8c47e029218b017be27f727928121ca27210037ec21e694f
Instruction Fuzzy Hash: A641AAB4D012589FDF00CFA9D984AEEFBF1BB49314F24902AE414B7250D734A946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 066016B0, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 06601783

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ebad5ff3b142642649be011b4182c0bfdc9f83e734504e87b3e471a77f5fd660
Instruction ID: e9daea406020b148097d852919710fe2c5cc3d9ced79106233585fe8f8036e4c
Opcode Fuzzy Hash: ebad5ff3b142642649be011b4182c0bfdc9f83e734504e87b3e471a77f5fd660
Instruction Fuzzy Hash: 6C4197B4D012589FDF00CFA9D984AEEFBF1BB49314F14902AE818B7240D735AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 066013C0, Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06601472

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b6b4c4ec4758fb877f496d19264d968a197291fddfa765c78c5703206b303727
Instruction ID: a3ed4f6b508514f5efe91dcee286eb41f4d056c3a4ae676c38f9c922419b69d6
Opcode Fuzzy Hash: b6b4c4ec4758fb877f496d19264d968a197291fddfa765c78c5703206b303727
Instruction Fuzzy Hash: 0131A9B8D042489FCF10CFE9D880ADEFBB5AB09314F10942AE814B7210D775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066013C8, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06601472

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bd08395a17f57c0ac80d10575b1a3c1610c1c585cd489899869c6054b60d8c5c
Instruction ID: 51cc9e52b9fe1b2f43aae423f486504f89a43f3cb1688fe81d71586acae39f74
Opcode Fuzzy Hash: bd08395a17f57c0ac80d10575b1a3c1610c1c585cd489899869c6054b60d8c5c
Instruction Fuzzy Hash: 123197B8E042589FCF00CFE9D880ADEFBB5BB49314F10942AE815B7210D735A905CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066008CA, Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,?), ref: 0660097F

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e5eecdab6002aced320ebb0914f095b87383f96323fb95183dabb12a3891d803
Instruction ID: 0f1c8af384c223d1223d716c57a6fe5a0dfd889041f47bfb19446b38292b41c1
Opcode Fuzzy Hash: e5eecdab6002aced320ebb0914f095b87383f96323fb95183dabb12a3891d803
Instruction Fuzzy Hash: 8641CAB4D012589FDB54CFA9D884AEEFBF1AF49314F14802AE418B7240C778A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 065D7C08, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065D7CB7

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 76cf14a816142db7f0c36510f4157c502b0595c10f100e4d303e3a2889b5068a
Instruction ID: 9f982df9c62d6de555e2a7e7b13f18e0b7dde18a4cc13e6baca570e34882a645
Opcode Fuzzy Hash: 76cf14a816142db7f0c36510f4157c502b0595c10f100e4d303e3a2889b5068a
Instruction Fuzzy Hash: 1A31AAB9D042589FCB10CFA9E984ADEFBF0BB09310F14902AE814B7210D735A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06601AFA, Relevance: 1.6, APIs: 1, Instructions: 95threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNEL32(?,?), ref: 06601BAF

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5c680ce51296f6529e7de39361e619f9bf99a82478131129c5c65c1ae47e16b7
Instruction ID: 149f90461bee7f5fcf2d23a32fe070573ea03235e723ab9672509beeb1560b1e
Opcode Fuzzy Hash: 5c680ce51296f6529e7de39361e619f9bf99a82478131129c5c65c1ae47e16b7
Instruction Fuzzy Hash: F341A9B4D012589FDB54CFE9D884AEEFBF1AB4A314F14802AE814B7240D778A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06601B00, Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNEL32(?,?), ref: 06601BAF

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: fac988a13bfde1faf17faa825d37fd4073b6d6b909a7a11ca50517958be492f0
Instruction ID: 08eec3c7d03632af2a370bac832031287cdf391de2f85d6a4ca661cdc2180efc
Opcode Fuzzy Hash: fac988a13bfde1faf17faa825d37fd4073b6d6b909a7a11ca50517958be492f0
Instruction Fuzzy Hash: ED31B8B4D002589FDB54CFE9D884AEEFBF1AB49314F14802AE414B7340D738A949CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 066008D0, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,?), ref: 0660097F

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: bd10326e89a9517105b9c6faca4cb0a0d83b1248986af68910c74ac9e5120401
Instruction ID: 8330122aefb9a1684da608965bba3c897f99e3e71f2204b11da2e972d6183cfd
Opcode Fuzzy Hash: bd10326e89a9517105b9c6faca4cb0a0d83b1248986af68910c74ac9e5120401
Instruction Fuzzy Hash: 5A31B9B4D002589FDB54CFA9D884AEEFBF1BF49314F14902AE418B7240D778A949CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 065D7C10, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065D7CB7

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2a4a2098863b73dc95ece6660c0e4d6989b531875ddc9fbd7e3e6c78e2a97d4e
Instruction ID: b69a376a0ad9f96bd26ffaa45095180a35ead1bc3dddca4ee986ef008df1e34b
Opcode Fuzzy Hash: 2a4a2098863b73dc95ece6660c0e4d6989b531875ddc9fbd7e3e6c78e2a97d4e
Instruction Fuzzy Hash: 7C3197B9D042589FCB10CFA9D984ADEFBF1BB09310F14902AE814B7250D735AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 065DC188, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065DC22F

Memory Dump Source

Source File: 00000013.00000002.614948124.00000000065D0000.00000040.00000001.sdmp, Offset: 065D0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54b600c4ca31f306a48564c2d0c0cdbcbfa6b6c7fae5b7c4792eccb50c67dc2a
Instruction ID: 9d3a987b03103761d0980199891b9beb5784eb4b32daa806da1a8cbe4f00e32b
Opcode Fuzzy Hash: 54b600c4ca31f306a48564c2d0c0cdbcbfa6b6c7fae5b7c4792eccb50c67dc2a
Instruction Fuzzy Hash: 9B3184B9D042589FCB10CFE9D884AEEFBB5BB19314F14A02AE814B7250D734A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04D556E0, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04D55781

Memory Dump Source

Source File: 00000013.00000002.613387300.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0538b2df456fe18d7a66b729c1a36700bdf80cac32e6c3e6b27d1e1b52b924e6
Instruction ID: dc2f30819fcbf9badef5f422e1c6e8ec765cfb763965cf624025d0eb928ef82d
Opcode Fuzzy Hash: 0538b2df456fe18d7a66b729c1a36700bdf80cac32e6c3e6b27d1e1b52b924e6
Instruction Fuzzy Hash: 1C31CAB4D05258DFCB00CFA9E884AEEFBF5BB49314F14806AE804B7210D774A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04D54CE0, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04D55781

Memory Dump Source

Source File: 00000013.00000002.613387300.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c131ab9ab89283a34a2f0665ef54d04a9f6fa082674ce81eae4eae2ca451d6ec
Instruction ID: c1d7ca2f60d8bb587ac98a1a53a709849018e534e36053cbccce5727664e36eb
Opcode Fuzzy Hash: c131ab9ab89283a34a2f0665ef54d04a9f6fa082674ce81eae4eae2ca451d6ec
Instruction Fuzzy Hash: A431CAB4D05258DFCF10CFA9E884AEEFBF5BB49314F14806AE805B7220D734A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06601D51, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 06601DD6

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6bc5413fb915c1aff4dbc278feedfb42dee53a1cad43975daa218d2f1dd3aa46
Instruction ID: 3ad6ee3cbb719bf3668162d4d22b8477831731d743d9d13c1433ad72b6222472
Opcode Fuzzy Hash: 6bc5413fb915c1aff4dbc278feedfb42dee53a1cad43975daa218d2f1dd3aa46
Instruction Fuzzy Hash: F231ECB4D002489FDF14CFA9E884ADEFBB5AF49314F14842AE814B7340CB35A902CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06601D58, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 06601DD6

Memory Dump Source

Source File: 00000013.00000002.615064189.0000000006600000.00000040.00000001.sdmp, Offset: 06600000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 74e621b513a66f001bfe99e68091d96df67e6998a99c939abd7b21b3507a90c7
Instruction ID: f8f0e842743ebdfa98d1501dc7a41c2c5c8135e3fb0bfc56260e2f83e6ddfa81
Opcode Fuzzy Hash: 74e621b513a66f001bfe99e68091d96df67e6998a99c939abd7b21b3507a90c7
Instruction Fuzzy Hash: AC31AAB4E012589FDF14CFA9D884AEEFBB5AF49314F14842AE815B7340DB35A905CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0255D638, Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e222930685f5df5aee1ef9c852a4f1d33496779b1133d610b05cb9662d110a8
Instruction ID: 1fe666e884e9c155234b3ce4297e2612047574aa9794675af676c500bef6b018
Opcode Fuzzy Hash: 7e222930685f5df5aee1ef9c852a4f1d33496779b1133d610b05cb9662d110a8
Instruction Fuzzy Hash: B2F1CA397011259FDB14AB64C864B7E7BB6FBC8714F14846AEA0A8B384CF74DC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0255FAF0, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61919d6290af65ca8e4f8e7598adc4d975ae9f91e36ab4b23d535b44ca77d6f
Instruction ID: 80668e534b0694988ebd600c2ef3f7ab35c6fc54e9a24fa581eda768f3cc2fd0
Opcode Fuzzy Hash: b61919d6290af65ca8e4f8e7598adc4d975ae9f91e36ab4b23d535b44ca77d6f
Instruction Fuzzy Hash: 81E12B75A005298FCB04DF6CC994A9DBBF2FF89314B16849AE909EB762C734EC41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0255DC88, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e866c6c5898ee34cdbae0c0e598d1b0994fa7ec2efa138dee61aa6c272960e
Instruction ID: 53d44b0e19e2d7d1e22e47cc6c50f6f75a9505ff0e1a6c70dcead3e00b416529
Opcode Fuzzy Hash: 48e866c6c5898ee34cdbae0c0e598d1b0994fa7ec2efa138dee61aa6c272960e
Instruction Fuzzy Hash: 9481C536B02125CFDB14CF69C494AAEB7F2FF89214B1584AAD806EB364D731EC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0255B800, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eac8876a489c26e494612ec11ebead5e4cf1a57b08cf293d30d3a40e9731f7c
Instruction ID: 37c4c409126c77198df80addd419a7d6c6e26ca2c3575d136507380e2cbcb579
Opcode Fuzzy Hash: 3eac8876a489c26e494612ec11ebead5e4cf1a57b08cf293d30d3a40e9731f7c
Instruction Fuzzy Hash: 0A412335B042148FD700ABB9C99567FB6B6FBC5308F10853AD906DB388EA74DC428B92

Uniqueness

Uniqueness Score: -1.00%

Function 0255F938, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fff2d9b38abe49efd6019c2c6614fdd546a73fd549639780768ea207d20411
Instruction ID: fb6d80255ee833cc408c9419209603075a543f5cf3041f25f08712fdec18d2e9
Opcode Fuzzy Hash: e0fff2d9b38abe49efd6019c2c6614fdd546a73fd549639780768ea207d20411
Instruction Fuzzy Hash: 1441DE397002149FC7149B68D9646AE7BB6EBC9714F14446AE906DB7A0CF34EC01C791

Uniqueness

Uniqueness Score: -1.00%

Function 0255C8A8, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee03dc1f6628fe6393b2a2af923645947cc50df572be5798aca53bf686b030ee
Instruction ID: fa5666c6e91e28d9b5eb75061fa3681605709614b55dcbbf2bebf81c4a0a1cfb
Opcode Fuzzy Hash: ee03dc1f6628fe6393b2a2af923645947cc50df572be5798aca53bf686b030ee
Instruction Fuzzy Hash: 0431B472A0432ACFCB008FA9CC607AEBB71FB45316F004927E955D7282C339E954CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0255B6B8, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2763117cfc5bff840c2e329720a7b1321248c88ff69a519352fa6f7bfd6d99
Instruction ID: ef79ee81bd38cd5cfb81fb544ef884f745f52a5fc224f75268cfa8b8ca29663d
Opcode Fuzzy Hash: bd2763117cfc5bff840c2e329720a7b1321248c88ff69a519352fa6f7bfd6d99
Instruction Fuzzy Hash: 7121E135A141758BC7108BACC4A92BEBBA6FF45718F158A67C9159B249C330D980C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0255AE18, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaac1fe12fb548af8ce58964cd86ec0b7735b5bf4ee1e989b74308486eb5e1a
Instruction ID: fcd6666e90306dce75e1f8d16eca44bd9c5b8aba4d418f81d15a858ea39e23e9
Opcode Fuzzy Hash: bfaac1fe12fb548af8ce58964cd86ec0b7735b5bf4ee1e989b74308486eb5e1a
Instruction Fuzzy Hash: 4521B0317482298BC7108A6DD8606AAF7A6FBC4210F104B2BEDD6C7790D334EC45C759

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.603508248.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8adfa4ce39b6bea4d65b9b06197924046aae1bb171af1f11d9f385c6de11bd
Instruction ID: 0e7507dbbc8c53fc227b2957f96105e84f552509e78e0464363e2dba6a68e4f0
Opcode Fuzzy Hash: ce8adfa4ce39b6bea4d65b9b06197924046aae1bb171af1f11d9f385c6de11bd
Instruction Fuzzy Hash: E9214871504200DFDF11DF14D8C0BA7BFA5FBA8328F2485A9D8050B206D37AD856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02558FD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52761f8ed4456aaa7ed9401ec1c26e7d0ec5e81bba434abf9ad2ac1e43eb5ca1
Instruction ID: c5bad00f0c5497a968f87f2e0614ea2deb241554adcf1671f2557c90fe6ce975
Opcode Fuzzy Hash: 52761f8ed4456aaa7ed9401ec1c26e7d0ec5e81bba434abf9ad2ac1e43eb5ca1
Instruction Fuzzy Hash: 6711D0757041885BE7386A7D8864B3B755BEBC8A04F00883EBB03DB6C0DE799C4543A1

Uniqueness

Uniqueness Score: -1.00%

Function 0255AD08, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba502233fc5e7a5b8140f8131b0866ec34f544f5dbf8b673f9aaea8a1e362be
Instruction ID: 3d5934dc0f2300eadd47eae001bb7c4da459861e84d55149b1fd444a2d578c27
Opcode Fuzzy Hash: 0ba502233fc5e7a5b8140f8131b0866ec34f544f5dbf8b673f9aaea8a1e362be
Instruction Fuzzy Hash: EC11B471A041298BD700AE99D4507BFF6BAFFC0341F104A27D912D7284DF789A01C796

Uniqueness

Uniqueness Score: -1.00%

Function 0255BA20, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff450e39fe2caeffd63f5a46e55a71551b40620b76accf4781eaeeb91c34ca6
Instruction ID: de4fdb399bd77388b2654031a62dc307499fa0856844dea4ca25fba27c0cc393
Opcode Fuzzy Hash: 2ff450e39fe2caeffd63f5a46e55a71551b40620b76accf4781eaeeb91c34ca6
Instruction Fuzzy Hash: A41129353441248BE314517DC82977B31CBEBC4618F10453BBE0BCB788EE28DC8147A6

Uniqueness

Uniqueness Score: -1.00%

Function 0255BB38, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f284f84dc211ef34e88b5e16549548d4d429dca01cca838263ce3141d53a8c57
Instruction ID: 5cabd366bcbd99ff1d0f3a705f0456996503e407e48a5932e38fab87cb7a1d56
Opcode Fuzzy Hash: f284f84dc211ef34e88b5e16549548d4d429dca01cca838263ce3141d53a8c57
Instruction Fuzzy Hash: 1911E6353082508FD3105A29982972AB656FFC1618F14483BEA02CB689DEB9DC418726

Uniqueness

Uniqueness Score: -1.00%

Function 0255C9F8, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9439235594d0ef931eadb90a153bd37c74758b3f0b18c14e6e25765f4402f1a3
Instruction ID: 23f6f14a2aa30b13d157449904f28632ca8189047c5c374ee8bc044e9dc4d676
Opcode Fuzzy Hash: 9439235594d0ef931eadb90a153bd37c74758b3f0b18c14e6e25765f4402f1a3
Instruction Fuzzy Hash: C311AF357002199FEB05EF28D82476B3BA2FB84715F04806AF90A8B354DB38DC54CB94

Uniqueness

Uniqueness Score: -1.00%

Function 064F0001, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4318943bc700278d22e0a0a53386ddb17470ba380ff11649cd95d0019315a5
Instruction ID: ea0c420cb0f925c9a45010c374d3e7cb41471d96b3b9a52fcb7fd072f3b41dc0
Opcode Fuzzy Hash: 6b4318943bc700278d22e0a0a53386ddb17470ba380ff11649cd95d0019315a5
Instruction Fuzzy Hash: C011652480F3C8AFC7178B705C26A86BF749E43204B4E45DBD484CF6A3D6284E89C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.603508248.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction ID: 86c40dcf2d7f4158328fee84e721b5f378f375b74588256a9fc1c769a9cb6130
Opcode Fuzzy Hash: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction Fuzzy Hash: 8A11D376504280CFCF12CF14D5C4B66BFB1FB94324F24C6A9D8050B656C37AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD819, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.603508248.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdb90c8800f56851035bb096be82905087f3fc6b6d6ba42c88477a063334cf5
Instruction ID: 05054fb87e936e4314bffa85a8a04cbbe3e3f174a62e3615695c29f4f734a712
Opcode Fuzzy Hash: fcdb90c8800f56851035bb096be82905087f3fc6b6d6ba42c88477a063334cf5
Instruction Fuzzy Hash: 1901F771508344ABD7104A69CCC07F7BBD8DF41379F18859AED045B246E7BD9844C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02553E40, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc59452b1748ddeb10e94054d48b4d1e626a6ae7e67cdd59e1d34fded3f5c25
Instruction ID: fc1e9bd86b13d6f13f859c22c49d6facc601ab853232d5989e17ca9448fa28e6
Opcode Fuzzy Hash: 5cc59452b1748ddeb10e94054d48b4d1e626a6ae7e67cdd59e1d34fded3f5c25
Instruction Fuzzy Hash: EB116D71E0420CAFDB00EFE8D4516EEBBF1EF84304F1085BAD215AB255EB305A059F81

Uniqueness

Uniqueness Score: -1.00%

Function 02553E50, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b42d35e93a534f1cce7ce604fd3885340cb646de06f23244ed770bff84edcd
Instruction ID: 772c08efa426308cd8f12d788a76c2dc158b8cc5f1de6333e95f56b74f8c23dd
Opcode Fuzzy Hash: 25b42d35e93a534f1cce7ce604fd3885340cb646de06f23244ed770bff84edcd
Instruction Fuzzy Hash: 5E011A71E0020DAFDB40EFE8D4516EEBBF5EF84304F1089AAD115AB254EB30AA059F81

Uniqueness

Uniqueness Score: -1.00%

Function 064F0B7F, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb4953fca518df88e75e37adc3342c26463c6e11fdb073c0917afcb9a82cab1
Instruction ID: 0a8d1615a70ef96962989eee5d8628108fa17c796eccd1a3c1bf77b1bec4cff3
Opcode Fuzzy Hash: dfb4953fca518df88e75e37adc3342c26463c6e11fdb073c0917afcb9a82cab1
Instruction Fuzzy Hash: 76013C3490E3C8AFCB078BB498206997FB49F47204F0940E7D484DB293D7385E49CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02557B08, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773aed280781acf862a913faf9faeba94e3eaedd5796376e040d10f200a47a7e
Instruction ID: c492c636214cc9a3954d23576f5bc7ed3ff37501ee757a7278d735412f96ae1b
Opcode Fuzzy Hash: 773aed280781acf862a913faf9faeba94e3eaedd5796376e040d10f200a47a7e
Instruction Fuzzy Hash: 4FF03070A19929CBD7409EE8D826379F6A1F70C321F0008779C1AC7280FA39C990CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 064F0C29, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41d652980879963e4fb441c6618878cf323134eb87c18c45c6b142f74e092d2
Instruction ID: 123106ec0f5eb5c25956dc70e282e64a30c711f69cfcacd3d25f11229dec48d5
Opcode Fuzzy Hash: a41d652980879963e4fb441c6618878cf323134eb87c18c45c6b142f74e092d2
Instruction Fuzzy Hash: DE01813480E3C8AFC703CBB49864599BFB4AF47200B0541DBD444CB263D2385E58CB62

Uniqueness

Uniqueness Score: -1.00%

Function 064F07C3, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fb50e8d88572d3b856f7f4c6357dc025b0511ec2634cf25f86375d949a09c7
Instruction ID: a5ab9c55d1cda3f385b20695e15fd9a87986e3be9da86836b03f191fb6f6d752
Opcode Fuzzy Hash: d3fb50e8d88572d3b856f7f4c6357dc025b0511ec2634cf25f86375d949a09c7
Instruction Fuzzy Hash: A7F0903840A388AFC706DBA0E855DDABFB4EF46211F0581D6E8449B263C7349D89DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 064F0989, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308943364d2f40cb99320403a7bbd9978d37b494f56f11e3f78f24e1a1c4a882
Instruction ID: c96152c9bcd89ce2e3662f36ed8e5ec97d557d38532f6437a1771ce497762ea9
Opcode Fuzzy Hash: 308943364d2f40cb99320403a7bbd9978d37b494f56f11e3f78f24e1a1c4a882
Instruction Fuzzy Hash: 9F013C3490E388AFC747CB749814999BFB4AF46200B1981DBD884DB363D6389E09CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD818, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.603508248.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142602a1cd813ac13f89dad8590218a69bde09cb3cb28a57516e4a03594b09c1
Instruction ID: 2955ac5600484db3c3b1f12a70dcefbe82334e5f7953a463636ab6f98d6f3bf6
Opcode Fuzzy Hash: 142602a1cd813ac13f89dad8590218a69bde09cb3cb28a57516e4a03594b09c1
Instruction Fuzzy Hash: 40F06271504284ABEB118A59DC84BB2FFD8EB41774F18C55AED085B286D3B99844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0255AC48, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d017aba3cfd15ef36488766db3fd1fed8a6197a1c5367e95edfc2fe2d77d9312
Instruction ID: c0822d7d4da781124dc68089fd9f19ad54d3186bf80fe94eb979da50cd9f1505
Opcode Fuzzy Hash: d017aba3cfd15ef36488766db3fd1fed8a6197a1c5367e95edfc2fe2d77d9312
Instruction Fuzzy Hash: B6F09030E642389BDB005A9899157BA7A64EB84B10F104977B91AE7380C7B44E008BD6

Uniqueness

Uniqueness Score: -1.00%

Function 064F0E67, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9b1b43f7b16cfa487f01bf46bf1605b38ad9bce0d8adc7785d39a596b904e6
Instruction ID: d14285e7107d981236ecf828ed8fc9c95036f6edd5216c9c63896b063225f53a
Opcode Fuzzy Hash: 2b9b1b43f7b16cfa487f01bf46bf1605b38ad9bce0d8adc7785d39a596b904e6
Instruction Fuzzy Hash: 2FF06D3444E388AFC7078B749C299997F74AF47210B0681DBE8849B2A3C734AD58E762

Uniqueness

Uniqueness Score: -1.00%

Function 064F0B25, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5823bb591f34d37e618d7de971a011b4637311732cb8030f759a44c92df9521b
Instruction ID: a082714d89563040a85b33b8a5a7d5da2275875a5a9187c70955e529f0da82a5
Opcode Fuzzy Hash: 5823bb591f34d37e618d7de971a011b4637311732cb8030f759a44c92df9521b
Instruction Fuzzy Hash: 66F09634D0A388AFCB52CFB49810AA9BFB4AF46204F0480EBD844DB653D7385E45DB62

Uniqueness

Uniqueness Score: -1.00%

Function 064F0C7F, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91046ac138f1b2999aa26022576cfecd134677fe793f7dcf7fe14d16a0a93b9f
Instruction ID: bac0f8d50b70b011d6da6b309388c2ec02ff4f0176e37a2b3b300bf18072d6c7
Opcode Fuzzy Hash: 91046ac138f1b2999aa26022576cfecd134677fe793f7dcf7fe14d16a0a93b9f
Instruction Fuzzy Hash: C0F0903481E3C89FC746CB7498689997FB4EF06500F4940EBD984CB263D6389D49CB62

Uniqueness

Uniqueness Score: -1.00%

Function 064F0D7B, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a1ae6c3652987724d1652c1212b9e3a1709b7426fd8a8f52c5d1dd44573074
Instruction ID: de621ba1599deb0f4089e9f49c5ae3666c43e6daa7e5b638b6f50e03f1e16ede
Opcode Fuzzy Hash: 65a1ae6c3652987724d1652c1212b9e3a1709b7426fd8a8f52c5d1dd44573074
Instruction Fuzzy Hash: B8F05E3481F3C89FCB078BB058615EA7F359B47204B5941DBD5448B253C7399E8AD7A2

Uniqueness

Uniqueness Score: -1.00%

Function 064F0D21, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561124492de3e82053c675f03db61ec1b46fc4944e9257fe3cbd0a9bdeabf9e5
Instruction ID: c206b26926c39bc7af2f1712b6b50554167d1691c8f79fe949a7c77ec3c83e99
Opcode Fuzzy Hash: 561124492de3e82053c675f03db61ec1b46fc4944e9257fe3cbd0a9bdeabf9e5
Instruction Fuzzy Hash: EEF04F30C0E388AFC747DBB48814699BFB0AF46204F0581EBC884DB293D7399958DB61

Uniqueness

Uniqueness Score: -1.00%

Function 064F0533, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aeeaa51619bcf5915d34ab4ffb452e2bf99a6f0e66c907bf34a73bd45c504ca
Instruction ID: df220935f1cc5720d837e0513f213ac854b83adb24d597fc7c32526c8267e9e4
Opcode Fuzzy Hash: 2aeeaa51619bcf5915d34ab4ffb452e2bf99a6f0e66c907bf34a73bd45c504ca
Instruction Fuzzy Hash: 57F08238809388AFCB06CFA4EC55A99BF75BF47310F0580D6E9449B262CB34DD56DB62

Uniqueness

Uniqueness Score: -1.00%

Function 064F0817, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3189a4bb2086abd63804b7961860c656cd64f6aa4986597dc4da052a4f78f41d
Instruction ID: b739554c6918b8660a2bb1c75d4741ec4e5d0294cdda276b5efe2e3d0224af1c
Opcode Fuzzy Hash: 3189a4bb2086abd63804b7961860c656cd64f6aa4986597dc4da052a4f78f41d
Instruction Fuzzy Hash: 1BF01C2444F3C86FC30787B498216A67F789E43114B0A41DBD484CB1A3CB299D59D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 064F0F8D, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b5ea30ec41c6f2cb699e96b0b11eb97d98cf4e88e976be10b60501d8b21fb5
Instruction ID: 2307c0c143b386c82bf6417de534af7defb38a86a6502cf8d2d863ea42b7eca2
Opcode Fuzzy Hash: f1b5ea30ec41c6f2cb699e96b0b11eb97d98cf4e88e976be10b60501d8b21fb5
Instruction Fuzzy Hash: 9AF0823080A3C89FC753DB7454252A87FB0AF02108F5441EFC44897283E7355A45D762

Uniqueness

Uniqueness Score: -1.00%

Function 02554DBC, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100656c56d1b4c7796d3941fd5a058bcfeb9d3081afe16cd561c16328e9f1526
Instruction ID: 12fc5fceb6255baa8d191a1547191c4ceb8437d864f28bc56fe2d92d88a6ef1c
Opcode Fuzzy Hash: 100656c56d1b4c7796d3941fd5a058bcfeb9d3081afe16cd561c16328e9f1526
Instruction Fuzzy Hash: 52E0398780C7C94BD7231B291C253A53FA0EA63108B4C44CA89C1DF2A3E6099607EB66

Uniqueness

Uniqueness Score: -1.00%

Function 064F0B40, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591842ccc6fc84ca407ba94b42bfc90d345315528c1c82ef737d1c3842e2a076
Instruction ID: c6bdc0982a0e04a25a8f16e52a602d1cdb20ab3a5b1a7a95b13ee971998d9498
Opcode Fuzzy Hash: 591842ccc6fc84ca407ba94b42bfc90d345315528c1c82ef737d1c3842e2a076
Instruction Fuzzy Hash: 5CE0E574E0420CAFCB94DFA8D4006AEBBF4AB49305F1085AA991493340D735AA41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 064F0C48, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838ad39720a010bab32d2bb9ab3e1f7044de9105770e10f83c31717f0c584c6c
Instruction ID: e5be612840a2907dc8ec760d26437a0d2837863270d8c3963f12d50d846c0b70
Opcode Fuzzy Hash: 838ad39720a010bab32d2bb9ab3e1f7044de9105770e10f83c31717f0c584c6c
Instruction Fuzzy Hash: 15E0E538E00208EFCB54DFA9D44469DBBF4EB48304F1081EAD90893320D734AE41DF40

Uniqueness

Uniqueness Score: -1.00%

Function 064F0D40, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b52ccd3f5c531934fa400195c21346271809a535262b56d891efec299167f5
Instruction ID: 64c65e15db15f6e6401881eea2ae697cfb750606d24cff96d6842311f8dca77c
Opcode Fuzzy Hash: 71b52ccd3f5c531934fa400195c21346271809a535262b56d891efec299167f5
Instruction Fuzzy Hash: 6AE01A74D0020CEFCB58DFB8D40069DBBB5FB48304F1081AAD804A3340E735AA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 064F09A8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73dcfabdf6f355797e03d1122bcd7b018cfe6e0b08d429b3dcb749ad6cc8b44
Instruction ID: 480e278cb076d507ecbf18fc47a0c5d103cbc1526b4802c83dd0584db8b8463e
Opcode Fuzzy Hash: e73dcfabdf6f355797e03d1122bcd7b018cfe6e0b08d429b3dcb749ad6cc8b44
Instruction Fuzzy Hash: 41E0E578E01208EFCB84DFA8D544A9DBBF4EB48304F1081EAD80893310E734AE00CF40

Uniqueness

Uniqueness Score: -1.00%

Function 064F0550, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction ID: c04683332f82f8fbc081a471f8e24034b7807db726201ffb268cd8293e1252c2
Opcode Fuzzy Hash: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction Fuzzy Hash: 9CE0463890020CEFCB48DFA8D844A9DBBB5FF49311F108199E90427320C731AE50EB80

Uniqueness

Uniqueness Score: -1.00%

Function 064F07E0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction ID: 18f431457516080abe9e0c1c27e2a7cb5336f4b22f23cba55eed351bceb17b33
Opcode Fuzzy Hash: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction Fuzzy Hash: C2E0463890020CEFCB48EFA8D844A9DBBB5FF49311F108199E90427320C731AE90EB90

Uniqueness

Uniqueness Score: -1.00%

Function 064F0E88, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction ID: c76aa7330ea83e971dd09eda32488043e0ad46843f933003914ea8423dfd04bd
Opcode Fuzzy Hash: f1d82c590477565f5c0ec7a9b9a8a0950cdf52ca76109be371d12d4cd79c4f3a
Instruction Fuzzy Hash: F6E0463890020CEFCB48DFA8D844A9DBBB5FF49311F108199E94427321C731AE50EB81

Uniqueness

Uniqueness Score: -1.00%

Function 064F0BA0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a29d5fd3d65e2eb419dc183e1355da343f2dabe0c320f14b6133b8b9d0403d
Instruction ID: 274893328ac9b1015307b4d6d884975c70f4958fc3f3dce4dfb476b312d1e39a
Opcode Fuzzy Hash: d0a29d5fd3d65e2eb419dc183e1355da343f2dabe0c320f14b6133b8b9d0403d
Instruction Fuzzy Hash: A3E01A74D0020CEFCB48DFE8D40029DBBB4EB88304F1081EAC814A3300D7359A41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 064F0CA0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75834cb4fde7fb46bea267a9cb3fdefee4eaa8134b7379f7ce639491413422e7
Instruction ID: 907aa6437dd566b537fec721554fa3ab8d7e25fc9242ff1c34dcdd1f3b016827
Opcode Fuzzy Hash: 75834cb4fde7fb46bea267a9cb3fdefee4eaa8134b7379f7ce639491413422e7
Instruction Fuzzy Hash: ABE0B678D20208DFCB84DFA8D588A9DBBF4EB48615F5041EAD90897351E731AE40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 064F0048, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24c823aceab4644624f2e78777ff6fc8e30f9e9c5040df0bea4bb7446c8023c
Instruction ID: 81fe99bb1f992c7be498f63472b2b1d83e3b2e0e8174871fced98eb3206b872a
Opcode Fuzzy Hash: e24c823aceab4644624f2e78777ff6fc8e30f9e9c5040df0bea4bb7446c8023c
Instruction Fuzzy Hash: B9E0EC34D1520CDFCB58EFB8955439DBBB5AB45205F6001E9890492340EB719E85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 064F0FA8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e9f5304ce144dc52938f8e88ad195ac824a7d61c94876ef47fe4e235616a2f
Instruction ID: 5472180052c2fc36c149cfb8430e5f05cf45a640ff9d3809abc67beb6570b2cf
Opcode Fuzzy Hash: a7e9f5304ce144dc52938f8e88ad195ac824a7d61c94876ef47fe4e235616a2f
Instruction Fuzzy Hash: 17E0C234C1120CDFCB94EFB8911039DBFF4AB04209F6000EAC90892340E7359F44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 064F0D98, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5f7a232ce941d9a020bd06655651dc37cdff400a50f26ace2b57c6a7b57012
Instruction ID: 554f80090235f4a8dcb7a952c1785b2b888eb7b92f28fe30d5a9adb3dcfaee5e
Opcode Fuzzy Hash: 8b5f7a232ce941d9a020bd06655651dc37cdff400a50f26ace2b57c6a7b57012
Instruction Fuzzy Hash: 5AD01738C0520CDBCB08DFA4A5006AEBB79AB82309F6041ADC90423340DB75AE96DB85

Uniqueness

Uniqueness Score: -1.00%

Function 064F0838, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.614583816.00000000064F0000.00000040.00000001.sdmp, Offset: 064F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9bd9f1a7526f39b5b21742431896a399345943dcd6230843bb2d9f2f3888fb
Instruction ID: f1c4c1812cc7bc4477c995ed81f7e3de0f7ab3de633aada0b279f36d3ea32df7
Opcode Fuzzy Hash: 6c9bd9f1a7526f39b5b21742431896a399345943dcd6230843bb2d9f2f3888fb
Instruction Fuzzy Hash: 01D0A93480220CDBC708DBF491107AA7329EB42209F4001A9980802300DB32AD00C690

Uniqueness

Uniqueness Score: -1.00%

Function 0255DF38, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bf65d2146a93ec26c15953faf0230eddc04b868a02b321952bf25ee0ec650d
Instruction ID: c597af8b97a942b6038d401a906bd45f9ad4e8d2fce06db66461dbcf782dc9db
Opcode Fuzzy Hash: 63bf65d2146a93ec26c15953faf0230eddc04b868a02b321952bf25ee0ec650d
Instruction Fuzzy Hash: BEC0123455424847D584BF74E681469339ED7D0505340C964910C4911DDFB85D158B95

Uniqueness

Uniqueness Score: -1.00%

Function 02554D91, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.604103009.0000000002550000.00000040.00000001.sdmp, Offset: 02550000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b36bfb3b66040767b7cc4b7e84e70eb8e612aabab63403fb491981e98903779
Instruction ID: 5318de4bf960de846ece1bd64841c626d597ad957b842b4bdad89d1e2b06f124
Opcode Fuzzy Hash: 8b36bfb3b66040767b7cc4b7e84e70eb8e612aabab63403fb491981e98903779
Instruction Fuzzy Hash: D3B092E28043CD42DA22461115143E82BA0AB52009F8840CC8D892B282EA28A1076A51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: InstallUtil.exe PID: 5596 Parent PID: 6824 InstallUtil.exeCOMMON

Executed Functions

Function 0564F5F8, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654bfd71a84637f20d2a6a9f2252b51f141f673c4433eb829d2359466502db63
Instruction ID: b479af2a09dde183bf25e2640a5fe3a32b65641ca8873ccf8dfbe30fd3ba4e2a
Opcode Fuzzy Hash: 654bfd71a84637f20d2a6a9f2252b51f141f673c4433eb829d2359466502db63
Instruction Fuzzy Hash: 6CF12734A00209CFDB14DFA9C988BADFBF2BF89304F158169E409AB765DB74A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0302B6C0, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0302B730
GetCurrentThread.KERNEL32 ref: 0302B76D
GetCurrentProcess.KERNEL32 ref: 0302B7AA
GetCurrentThreadId.KERNEL32 ref: 0302B803

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3e12c19726498a0d8667448f0f30b11869c6c97bc379498bf211a028a3e4c77e
Instruction ID: 207f5cd7de6e19672ba7e9f8dcdaf781f57617cadb714ba8fa64fd4eb0dc8ea8
Opcode Fuzzy Hash: 3e12c19726498a0d8667448f0f30b11869c6c97bc379498bf211a028a3e4c77e
Instruction Fuzzy Hash: 625165B4A016488FDB10CFAAD688BDEBBF0FF48314F248459E419A7350C7789945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0302B6D0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0302B730
GetCurrentThread.KERNEL32 ref: 0302B76D
GetCurrentProcess.KERNEL32 ref: 0302B7AA
GetCurrentThreadId.KERNEL32 ref: 0302B803

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fb5e060caca644ce9356894ff5ddee72116bef22b563e23dfa9caf53b4a96a76
Instruction ID: c321f2d9e71062a281dd5fa2013cc420b549b8103f66048b4ca4f5a0f1e9adec
Opcode Fuzzy Hash: fb5e060caca644ce9356894ff5ddee72116bef22b563e23dfa9caf53b4a96a76
Instruction Fuzzy Hash: 0A5165B4E016488FDB10DFAAD688BDEBBF0BF48304F248459E419A7360C7749944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 056417E0, Relevance: 2.0, APIs: 1, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3ed548cf0e26e58608f5273cff884095c60aa0243ebbff01629134d7b62733
Instruction ID: 4d9538fff35b1b6a7bbc373caa1ba093b9d127ef147704ec4ba4cb5a51c9a3cc
Opcode Fuzzy Hash: ea3ed548cf0e26e58608f5273cff884095c60aa0243ebbff01629134d7b62733
Instruction Fuzzy Hash: CF226178E04205CFDB24DF98D598ABEBBB2FB8A710F248155E512A7754C734E882CF61

Uniqueness

Uniqueness Score: -1.00%

Function 030293E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302962E

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 412fa58c2ccdd4658935dd774a64c63aa3818cbd6488b4f046fdb5f6ddc46262
Instruction ID: f5988a39dbaaa2cce258f7e7c27e975e1461c9aa760dde7c10199be6af470ab8
Opcode Fuzzy Hash: 412fa58c2ccdd4658935dd774a64c63aa3818cbd6488b4f046fdb5f6ddc46262
Instruction Fuzzy Hash: 0E714470A01B158FDB64DF2AC44079BBBF5FF88204F04896ED48ADBA50DB34E855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0302FB81, Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0302FD0A

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 064103f84540faae607253d34d098751e74d12324248f6bf49dc37277854f2e8
Instruction ID: c84835c452cf47146ffe10f3e07a89207e9658063b4fe21a6d09afc90289b613
Opcode Fuzzy Hash: 064103f84540faae607253d34d098751e74d12324248f6bf49dc37277854f2e8
Instruction Fuzzy Hash: 5751EEB1D003499FDB14CFA9D880ADEBFB5BF48354F24812AE818AB211D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0302FBF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0302FD0A

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d9bd2472ea622e41dc51b3b0da4029378ae35c4e4a4cceac780a2f39641f6a4e
Instruction ID: b49031cd6ca4c3fa906cb578476da7e5e478fcd846498981d1b04535c1c24aa0
Opcode Fuzzy Hash: d9bd2472ea622e41dc51b3b0da4029378ae35c4e4a4cceac780a2f39641f6a4e
Instruction Fuzzy Hash: AC41BEB1D003199FDB14CF99D984ADEFFB5BF48354F24812AE819AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 056445F4, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 056446B1

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f7930f8f25463eeb7dd2533e239f7d06c820a5e3a9eb4b9afbb2055ec285eb7a
Instruction ID: 0db8faa1f019e423b38a53d3a9d24be0e41cc0e052e5ee9cb802ac67b2ce338e
Opcode Fuzzy Hash: f7930f8f25463eeb7dd2533e239f7d06c820a5e3a9eb4b9afbb2055ec285eb7a
Instruction Fuzzy Hash: 7741FF71C0061CCBDF24CFA9C885BCEBBB5BF49304F218469D408AB250DB75694ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 05643474, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 056446B1

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 305312a0eca9951bd313a213592b8a6472064c861c2985a263db8a9169652155
Instruction ID: bcdfff7af1157b6babb1d9e3a8e1f226f28b25073c1bf1d7b915155d3bd1aa8f
Opcode Fuzzy Hash: 305312a0eca9951bd313a213592b8a6472064c861c2985a263db8a9169652155
Instruction Fuzzy Hash: 2541EF70C0061CCBDF24DFA9C885BDEBBB5BF49304F20846AD408AB251DB75698ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 05642470, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05642531

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: eff0101bb90f279c26805e676b005a3935f22ea0bdd7d1ce2b9c82394589dd7b
Instruction ID: 669a014e463cc68b29d5fe987a206fb637e98f062c027a4f10116b2fc8d3831b
Opcode Fuzzy Hash: eff0101bb90f279c26805e676b005a3935f22ea0bdd7d1ce2b9c82394589dd7b
Instruction Fuzzy Hash: C44129B8A003458FCB14CF99C458BAABBF6FF88314F25C459E519AB721D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0564B898, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 82ddd566644483366d18046260bf00ce49e2aac40a63abf585e0e45f7a52d96c
Instruction ID: 155c72ddfb27ad56709ae5506b97b9c6d2eb6446dc42346d72d822ebc4842d4d
Opcode Fuzzy Hash: 82ddd566644483366d18046260bf00ce49e2aac40a63abf585e0e45f7a52d96c
Instruction Fuzzy Hash: 623169729042499FCF118FA9D844AEEBFF8EF0A210F04805AE954AB221C3359854DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0302BCF9, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0302BD87

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b8d9cd9af2fc18152f23f76e1221b4705ecf6eed48148feb26fb60a6df8acca8
Instruction ID: 5ca76d1a4abb17ee362aea83dfd16aa30c8363b99f9e2ece02af1ad1b70706ff
Opcode Fuzzy Hash: b8d9cd9af2fc18152f23f76e1221b4705ecf6eed48148feb26fb60a6df8acca8
Instruction Fuzzy Hash: 7B21E3B59012489FDB10CFA9D584AEEFBF4EF48324F15841AE954B7210D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0302BD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0302BD87

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f02d76729f38c0e67517e5cfe70bc832afb00f711f7e0ba44b79c4dd18dde1ad
Instruction ID: 68f88a9e07301c16e6cc1427e0b71459e9003f8bcf7e80aee7f144553a464e87
Opcode Fuzzy Hash: f02d76729f38c0e67517e5cfe70bc832afb00f711f7e0ba44b79c4dd18dde1ad
Instruction Fuzzy Hash: 5521E2B59002089FDB10CFAAD884ADEFFF8EB48320F14801AE914A7310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0564A504, Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0564B8B2,?,?,?,?,?), ref: 0564B957

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 78e65e2ba72bf50c82756f3d6695e4d791b0b6c9814e4e6e8595a80e77fedfc0
Instruction ID: bec39fff2bf35dd02185522a6be2429e88492b87e36623222d07766b2992ad99
Opcode Fuzzy Hash: 78e65e2ba72bf50c82756f3d6695e4d791b0b6c9814e4e6e8595a80e77fedfc0
Instruction Fuzzy Hash: E01144B18042499FCB10CF99D844BEEBBF8EB49320F14841AE914A7220C335A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03028768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030296A9,00000800,00000000,00000000), ref: 030298BA

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e8ebb01eb72b406c40a84dac3ffff10532e99fda0ea4fd62a0b29cb613adcd94
Instruction ID: ba625cc2c0b2e639676f57e482e29fe41440f51ee195a7b11e0897f835e2fea9
Opcode Fuzzy Hash: e8ebb01eb72b406c40a84dac3ffff10532e99fda0ea4fd62a0b29cb613adcd94
Instruction Fuzzy Hash: 131103B6D002098FDB10CF9AD444BDEFBF4EB48314F15842AD915A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03029849, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030296A9,00000800,00000000,00000000), ref: 030298BA

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a75f3297a4a060ccc0ed5decc5bb632ebeb8f5c8545a223640f3ac60efaf1b78
Instruction ID: 87473754edda91a22b43a953526baaa6a51532e186ed17eaf76b581a2727f9c3
Opcode Fuzzy Hash: a75f3297a4a060ccc0ed5decc5bb632ebeb8f5c8545a223640f3ac60efaf1b78
Instruction Fuzzy Hash: 341114B6D002098FDB10CF9AD444BDEFBF4EB48324F18842AD915B7600C779A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0564E6D8, Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,017253E8,00000000,?), ref: 0564E73D

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9c8846ddc9ee0cb52e4c851cf9a356d3803faa6a5a9af1b3f8a1a802d9fe9f40
Instruction ID: 59737d5a2db163670f91a7f3b673abfcfdb5cc0c9b170794667b7dd8fadc8c47
Opcode Fuzzy Hash: 9c8846ddc9ee0cb52e4c851cf9a356d3803faa6a5a9af1b3f8a1a802d9fe9f40
Instruction Fuzzy Hash: 14112E71800309DFDB10CF99D845BEEBBF8FB48324F148519D554A7650D375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 056432D8, Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,017253E8,00000000,?), ref: 0564E73D

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8bab18e01c0b22c5d5ff85aa06309de2270b4c7ab7958f7953fffcc7fef578ea
Instruction ID: 08d553c67d0ab60dbdb4d41daaf99de7f780f27a9ea9318e2e793f62a2235a12
Opcode Fuzzy Hash: 8bab18e01c0b22c5d5ff85aa06309de2270b4c7ab7958f7953fffcc7fef578ea
Instruction Fuzzy Hash: FB1128B58003099FDB10CF99C845BEEFBF8FB48320F10841AE554A7640D379A984CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0564C3D0, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,0564226A,?,00000000,?), ref: 0564C435

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: aafd581dfa05d2619fdbb42c0cb1fdc42e7c12a8fdd28009a11db8311cf0963d
Instruction ID: 209ae77dd663c1711a9065772c774affb92e670fe57770f46277936a4271cabf
Opcode Fuzzy Hash: aafd581dfa05d2619fdbb42c0cb1fdc42e7c12a8fdd28009a11db8311cf0963d
Instruction Fuzzy Hash: E611E0B59013489FDB10CF99D985BEEBBF8EB48324F10891AD855A7700C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0564D238, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 0564D29D

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 80f7011762855863383a4c496ebebb2d6c13d4878141960bdec21dc618f52e8a
Instruction ID: 6466c8eb7fd5c43a5e127ec0577ff367d4ebf6adbaa54a70b3513ecd818d59ac
Opcode Fuzzy Hash: 80f7011762855863383a4c496ebebb2d6c13d4878141960bdec21dc618f52e8a
Instruction Fuzzy Hash: 2C11DFB58002099FDB20DF99D984BDEBBF8FB48324F10881AE955A7640C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030295C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302962E

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1efbd67d8a902053a026b7ca7f4ac9bdf9adff8dc1acf52f8a1e7bfa782116c0
Instruction ID: b867d425c458d6c9607a795ae9999fbc52042ab20d3c6dd9ea6d00c0d0ec153a
Opcode Fuzzy Hash: 1efbd67d8a902053a026b7ca7f4ac9bdf9adff8dc1acf52f8a1e7bfa782116c0
Instruction Fuzzy Hash: 8F11DFB5D006598FCB20CF9AD448BDEFBF4AB89224F14845AD819A7600C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0302FE38, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0302FE9D

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 3fe1d82f598896de37d10e89f285604fe44e214535519d2220ed8bdcb2399161
Instruction ID: a983460ab2a43bc65cb4ec17c2559af3ee1338825c3cc65973721d8bd9bb8b27
Opcode Fuzzy Hash: 3fe1d82f598896de37d10e89f285604fe44e214535519d2220ed8bdcb2399161
Instruction Fuzzy Hash: B41103B58002099FDB10CF99D585BDEFBF8EB48324F14841AD954B7341C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05641540, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,0564226A,?,00000000,?), ref: 0564C435

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1404f840ee6b4d8105ea87fbdfb285166587f4f887a67468a470688884bfab49
Instruction ID: e3114233f7f9b015c38fc0ab8dbe0582ecf089bcb1d4d33daed61ec0386b4184
Opcode Fuzzy Hash: 1404f840ee6b4d8105ea87fbdfb285166587f4f887a67468a470688884bfab49
Instruction Fuzzy Hash: F41103B59003489FDB20CF9AD984BEEFBF8EB49324F10841AE955A7710C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0564A548, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0564BCBD

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f5d5e6fe8091817dc57a34da2811ef301aef079249df7d374faeee4068cdcd79
Instruction ID: 8afd0ba9166c2c0b7f4667c7fba380aa59b048582ffe531c94cf69e37e39926e
Opcode Fuzzy Hash: f5d5e6fe8091817dc57a34da2811ef301aef079249df7d374faeee4068cdcd79
Instruction Fuzzy Hash: AF11F2B59003489FCB20DF99D584BEEBBF8EB48320F10841AE955A7710C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 056450D4, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 0564D29D

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f60db888572d903e4d29788d7d0a12c4e991fdd7b8e580bcbb3519720879149f
Instruction ID: 9f905c5e6e879dbb8ff92b89c47be33498e654b3c445d063239348425500d0e6
Opcode Fuzzy Hash: f60db888572d903e4d29788d7d0a12c4e991fdd7b8e580bcbb3519720879149f
Instruction Fuzzy Hash: 5C11F2B59003089FDB20DF9AD584BDFBBF8EB48320F10845AE915A7240C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0564DC60, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0564F435

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c99e65779ee4ddb03ba47d53336f5b222a637843a8bcc84c8a6975eb2a5bde5b
Instruction ID: 5790afd033491ac3cb330b0445ec1aed74c6c30139c15ff43cd2fc76141be1b5
Opcode Fuzzy Hash: c99e65779ee4ddb03ba47d53336f5b222a637843a8bcc84c8a6975eb2a5bde5b
Instruction Fuzzy Hash: 831100B19042488FCB20DF99D488B9EFBF8EB48324F10845AE559A7700C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0564F3D8, Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0564F435

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1920a16a0b502e55da5b5ee12c289ed631589a197ffc9c4c756f9b5cf58d7e3e
Instruction ID: ab1567f241f948cd69fd3b75cd9f3339f363db31f1ca8be1c6205ce6a1e885ca
Opcode Fuzzy Hash: 1920a16a0b502e55da5b5ee12c289ed631589a197ffc9c4c756f9b5cf58d7e3e
Instruction Fuzzy Hash: 751103B59002488FCB10CFA9D5487DEFBF4EF48224F15855AD559B7700C735A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0302FE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0302FE9D

Memory Dump Source

Source File: 0000001C.00000002.604236434.0000000003020000.00000040.00000001.sdmp, Offset: 03020000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: bcf354a9d3eb0ce61a3b2b9b112a9eafa981f04be4ea2f359852a4f62580ff4e
Instruction ID: 56e1d71b4ece9009f30e1944b0094ad9db45130a971b908a040693149023838d
Opcode Fuzzy Hash: bcf354a9d3eb0ce61a3b2b9b112a9eafa981f04be4ea2f359852a4f62580ff4e
Instruction Fuzzy Hash: BD1112B58002098FDB20CF99D584BDFFBF8EB48324F10841AD814A7340C374A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0564BC59, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0564BCBD

Memory Dump Source

Source File: 0000001C.00000002.609963718.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4274933100c7c0038a7d2f7787269b377f3709b316328b5c15d39d8863515aa0
Instruction ID: 5a3d49381369dee57d59eb4712f43b78f72c13bb60d1b51420ef6fe229c80170
Opcode Fuzzy Hash: 4274933100c7c0038a7d2f7787269b377f3709b316328b5c15d39d8863515aa0
Instruction Fuzzy Hash: FF11FEB59002488FDB10CF99D584BDEBBF8EB48324F14841AD854A7610C378AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.603067115.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c2508bd07ae29fd1083215910da7d3c6e16310beefd36c9882c2e864300587
Instruction ID: c5e5e8e606f525854a145da11aae19592fd1bf5039afff01990ae893b068ea7e
Opcode Fuzzy Hash: 69c2508bd07ae29fd1083215910da7d3c6e16310beefd36c9882c2e864300587
Instruction Fuzzy Hash: 5A213671904200DFDB01DF98D8C0B17BF65FBD8328F60856AE9050B266C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0169D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.603315697.000000000169D000.00000040.00000001.sdmp, Offset: 0169D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce3359015351f222fdba511d48d3de5fb8aea5e7c2c42513f92a8716e05c68e
Instruction ID: 8e09835d25301512e7b598c57285a3e5181217b8fe8754a2b597fbe76c5879a3
Opcode Fuzzy Hash: 8ce3359015351f222fdba511d48d3de5fb8aea5e7c2c42513f92a8716e05c68e
Instruction Fuzzy Hash: 4321D071504240DFDF15DFA8D9C4B26BBA9FB88364F24C979D80A4B346C73AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0169D006, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.603315697.000000000169D000.00000040.00000001.sdmp, Offset: 0169D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f0991c06574c8417ed451b6fec0216709faf8ebf4924e403b813d9d1528437
Instruction ID: 2c551674c5e10b049d10850bc8ae5c89fb02d80ac3315a8b31628b93447f87ef
Opcode Fuzzy Hash: 58f0991c06574c8417ed451b6fec0216709faf8ebf4924e403b813d9d1528437
Instruction Fuzzy Hash: 672180754083809FDB02CF54D994B11BFB5EB46314F24C5AAD8458B297C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0143D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.603067115.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction ID: 20f5f6d553497b422d262d1ca50f8d093f40acd2fb8a8f5a7dbcf96260efa9e7
Opcode Fuzzy Hash: 90825e81fda1175a189452765487cd28cd30970da8754c189eaf9e16a5c9c767
Instruction Fuzzy Hash: 0511B176804280CFDB12CF54D5C4B16BF72FB88324F24C6AAD9050B766C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO_6620200947535257662_Arabico.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre