Play interactive tour

Edit tour

Analysis Report TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Overview

General Information

Sample Name:	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Analysis ID:	385427
MD5:	2ef55b1fc8a71f26898afbd5b80979e5
SHA1:	25dc8c1b98e144e42e8e5bd1fa13f9e82c20021c
SHA256:	5a82c01b01e67439af7d84353cca82079e1cc4773e88ad2f4659aae05bf1609b
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Initial sample is a PE file and has a suspicious name

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

TRANSACTION_INTTRANSFER_1617266945242_PDF.exe (PID: 5380 cmdline: 'C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe' MD5: 2EF55B1FC8A71F26898AFBD5B80979E5)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "godfrey@nke.com.myGodfrey@2021mail.nke.com.my"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.494505239.00000000075C0000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "godfrey@nke.com.myGodfrey@2021mail.nke.com.my"}

Multi AV Scanner detection for submitted file

Show sources

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

ReversingLabs: Detection: 12%

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: global traffic

TCP traffic: 192.168.2.5:49732 -> 137.59.110.57:587

Source: Joe Sandbox View

IP Address: 137.59.110.57 137.59.110.57

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: global traffic

TCP traffic: 192.168.2.5:49732 -> 137.59.110.57:587

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.488217052.0000000002DCC000.00000004.00000001.sdmp	String found in binary or memory: http://mail.nke.com.my
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: http://wfkefE.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484096368.00000000011C7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486417483.0000000002B3C000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp	String found in binary or memory: https://hDtZw9rtG9uIErvn.com
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.483200607.0000000000D0B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00CFDB4C	0_2_00CFDB4C
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00CFC148	0_2_00CFC148
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00CFE212	0_2_00CFE212
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00CFA758	0_2_00CFA758
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E98830	0_2_00E98830
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E94968	0_2_00E94968
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E96C60	0_2_00E96C60
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E97DE0	0_2_00E97DE0
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E91620	0_2_00E91620
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E94038	0_2_00E94038
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E99920	0_2_00E99920
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Code function: 0_2_00E91E18	0_2_00E91E18

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMOErtrUIqwMWoJGEhgxNRfwXBSuTcLTh.exe4 vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.483980543.0000000000FE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.481229816.000000000062A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameStringExpressionSet.exe: vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493947868.00000000072B0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll" vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.483913949.0000000000E80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.501801912.0000000008AE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll2 vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.483200607.0000000000D0B000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.502058868.0000000008F30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Binary or memory string: OriginalFilenameStringExpressionSet.exe: vs TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Mutant created: \Sessions\1\BaseNamedObjects\qvbRxeeUtKkiP

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

ReversingLabs: Detection: 12%

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: initial sample

Static PE information: section name: .text entropy: 7.83114511715

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380, type: MEMORY
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Section loaded: OutputDebugStringW count: 222

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Window / User API: threadDelayed 5678			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Window / User API: threadDelayed 4075			Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe TID: 2092	Thread sleep time: -103592s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe TID: 1628	Thread sleep time: -11990383647911201s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Thread delayed: delay time: 103592			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.502058868.0000000008F30000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.501568858.000000000898B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.502058868.0000000008F30000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.502058868.0000000008F30000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.502058868.0000000008F30000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Code function: 0_2_00E94968 LdrInitializeThunk,

0_2_00E94968

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484157437.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484157437.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484157437.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484157437.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484157437.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.494505239.00000000075C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380, type: MEMORY
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380, type: MEMORY
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.494505239.00000000075C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380, type: MEMORY
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.75c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.3bf43e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSACTION_INTTRANSFER_1617266945242_PDF.exe.2b12510.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection1	Disable or Modify Tools1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion231	Input Capture1	Security Software Discovery211	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Credentials in Registry1	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Virtualization/Sandbox Evasion231	Distributed Component Object Model	Data from Local System2	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing2	LSA Secrets	Application Window Discovery1	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TRANSACTION_INTTRANSFER_1617266945242_PDF.exe	12%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.nke.com.my	0%	Virustotal		Browse
clientconfig.passport.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://mail.nke.com.my	0%	Virustotal		Browse
http://mail.nke.com.my	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://wfkefE.com	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://hDtZw9rtG9uIErvn.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.nke.com.my	137.59.110.57	true	true	0%, Virustotal, Browse	unknown
clientconfig.passport.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.nke.com.my	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.488217052.0000000002DCC000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://wfkefE.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.tiro.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false		high
https://api.ipify.org%$	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486417483.0000000002B3C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comgrita	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.484096368.00000000011C7000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://hDtZw9rtG9uIErvn.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.493414150.0000000006C42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe, 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
137.59.110.57	mail.nke.com.my	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385427
Start date:	12.04.2021
Start time:	13:52:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 34 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 92.123.150.225, 104.43.193.48, 131.253.33.200, 13.107.22.200, 20.82.210.154, 93.184.220.29, 104.42.151.234, 92.122.145.220, 40.88.32.150, 184.30.24.56, 204.79.197.200, 13.107.21.200, 13.107.5.88, 13.107.42.23, 92.122.213.247, 92.122.213.194, 205.185.216.10, 205.185.216.42, 2.20.142.210, 2.20.142.209, 20.54.26.129, 20.82.209.183 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, cs9.wac.phicdn.net, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, e13551.dscg.akamaiedge.net, msagfx.live.com-6.edgekey.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, authgfx.msa.akadns6.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, l-0014.l-msedge.net, skypedataprdcolwus16.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:53:08	API Interceptor	715x Sleep call for process: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
137.59.110.57	IK8QsX6z2B1lPY0.exe	Get hash	malicious	Browse
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse
	Invoi-022.pdf	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.nke.com.my	IK8QsX6z2B1lPY0.exe	Get hash	malicious	Browse	137.59.110.57
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	RQF 100021790.exe	Get hash	malicious	Browse	103.6.198.237
	IK8QsX6z2B1lPY0.exe	Get hash	malicious	Browse	137.59.110.57
	efaxHanglung_302.htm	Get hash	malicious	Browse	103.6.198.35
	RFQ - HASTALLOY MATERIAL.exe	Get hash	malicious	Browse	103.6.198.237
	#1002021.exe	Get hash	malicious	Browse	103.6.198.237
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	#100028153.exe	Get hash	malicious	Browse	103.6.198.237
	#ENQ67548820.exe	Get hash	malicious	Browse	103.6.198.237
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	TaTYytHaBk.exe	Get hash	malicious	Browse	110.4.47.139
	_0000628.EXE	Get hash	malicious	Browse	103.6.198.237
	confirm bank account details pdf.exe	Get hash	malicious	Browse	103.6.198.37
	RFQ#100027386.exe	Get hash	malicious	Browse	103.6.198.237
	SWIFT COPY.png.exe	Get hash	malicious	Browse	103.6.196.156
	PAYMENT CONFIRMATION.exe	Get hash	malicious	Browse	103.6.196.156
	bank slip 10 285 USD..exe	Get hash	malicious	Browse	103.6.198.37
	1 Total New Invoices_Wendesday March 10_2021.xlsm	Get hash	malicious	Browse	137.59.109.40
	Request Quotation.exe	Get hash	malicious	Browse	103.6.198.37

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.633446722156403
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
File size:	679936
MD5:	2ef55b1fc8a71f26898afbd5b80979e5
SHA1:	25dc8c1b98e144e42e8e5bd1fa13f9e82c20021c
SHA256:	5a82c01b01e67439af7d84353cca82079e1cc4773e88ad2f4659aae05bf1609b
SHA512:	9fa5e04f357425aa71a468f3c3bf781e9805d8a4efeb3f9c2fed95dea1a76e79f0d29629b358e915cba8ea1c927a2eb60593be36ae2942c07a3028c24c3114f7
SSDEEP:	12288:O0NzfI5tixQQ/bj0zVV05dUiJEWj97v3SDP4M4lwv0ZYnKJ/:w+xQQ/30zH05dl7PStAwvqYKJ/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....s`..............P..n............... ........@.. ....................................@................................

File Icon


Icon Hash:	1749c81a994c2d93

Static PE Info

General
Entrypoint:	0x488bfa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6073FED2 [Mon Apr 12 08:03:30 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
or dword ptr [edx], ecx
or eax, 00000020h
add byte ptr [ecx+49h], cl
sub al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
dec ebp
dec ebp
add byte ptr [edx], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x88ba8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x1ec28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x86c18	0x86e00	False	0.889191380908	data	7.83114511715	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x1ec28	0x1ee00	False	0.307652770749	data	5.22340096407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x8a250	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x8a6b8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 86452005, next used block 10132114
RT_ICON	0x8b760	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 54805568, next used block 21251136
RT_ICON	0x8dd08	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 54805568, next used block 4473920
RT_ICON	0x91f30	0x10828	data
RT_ICON	0xa2758	0x539b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0xa7af4	0x5a	data
RT_GROUP_ICON	0xa7b50	0x14	data
RT_VERSION	0xa7b64	0x39c	data
RT_MANIFEST	0xa7f00	0xd25	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Adobe Inc, Sel 2011 - 2021
Assembly Version	1.0.0.0
InternalName	StringExpressionSet.exe
FileVersion	1.0.0.0
CompanyName	Adobe Inc, Sel
LegalTrademarks
Comments
ProductName	Image Studio
ProductVersion	1.0.0.0
FileDescription	Image Studio
OriginalFilename	StringExpressionSet.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 13:54:49.843331099 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:50.132499933 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:50.137842894 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:50.725764990 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:50.781702995 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:50.801002026 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:51.088076115 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:51.090944052 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:51.378777027 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:51.422034025 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:52.056128979 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:52.352475882 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:52.353357077 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:52.640491009 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:52.640882969 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:52.952547073 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:52.953001976 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.239926100 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.240770102 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.244474888 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.244702101 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.244911909 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.245105028 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.245260000 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.245415926 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.245562077 CEST	49732	587	192.168.2.5	137.59.110.57
Apr 12, 2021 13:54:53.531872988 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.532782078 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.532794952 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.573863029 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.633867025 CEST	587	49732	137.59.110.57	192.168.2.5
Apr 12, 2021 13:54:53.687767029 CEST	49732	587	192.168.2.5	137.59.110.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 13:52:51.267096043 CEST	52212	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:51.325884104 CEST	54302	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:51.341690063 CEST	53	52212	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:51.377657890 CEST	53	54302	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:51.859311104 CEST	53784	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:51.866210938 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:51.925247908 CEST	53	53784	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:51.928251982 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:52.117456913 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:52.166098118 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:52.222078085 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:52.272620916 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:54.616442919 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:54.668226957 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:54.858855963 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:54.919817924 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:56.061322927 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:56.118808031 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 12, 2021 13:52:57.151643038 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:52:57.203411102 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:04.468415022 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:04.519978046 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:22.850883961 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:22.913650036 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:24.645097017 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:24.719494104 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:25.009644985 CEST	59736	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:25.059499025 CEST	53	59736	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:25.688704014 CEST	51058	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:25.692552090 CEST	52636	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:25.740876913 CEST	53	51058	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:25.749636889 CEST	53	52636	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:29.430058956 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:29.490336895 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:33.176800013 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:33.228513956 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:36.488691092 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:36.545816898 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:40.570827961 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:40.631701946 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:46.870949984 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:46.935791016 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:49.068998098 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:49.142513037 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 12, 2021 13:53:50.535154104 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:53:50.614370108 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:04.142829895 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:04.193952084 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:07.179743052 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:07.242058039 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:10.401568890 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:10.452960014 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:11.283385038 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:11.332289934 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:12.104264021 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:12.152900934 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:38.168983936 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:38.219060898 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:39.600851059 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:39.663256884 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 12, 2021 13:54:49.117861032 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 12, 2021 13:54:49.491079092 CEST	53	50394	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2021 13:52:51.267096043 CEST	192.168.2.5	8.8.8.8	0xaac4	Standard query (0)	clientconfig.passport.net	A (IP address)	IN (0x0001)
Apr 12, 2021 13:54:49.117861032 CEST	192.168.2.5	8.8.8.8	0x7c74	Standard query (0)	mail.nke.com.my	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 12, 2021 13:52:51.341690063 CEST	8.8.8.8	192.168.2.5	0xaac4	No error (0)	clientconfig.passport.net	authgfx.msa.akadns6.net		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 13:54:49.491079092 CEST	8.8.8.8	192.168.2.5	0x7c74	No error (0)	mail.nke.com.my		137.59.110.57	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 12, 2021 13:54:50.725764990 CEST	587	49732	137.59.110.57	192.168.2.5	220-newserver.windaq.com ESMTP Exim 4.94 #2 Mon, 12 Apr 2021 19:54:50 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 12, 2021 13:54:50.801002026 CEST	49732	587	192.168.2.5	137.59.110.57	EHLO 632922
Apr 12, 2021 13:54:51.088076115 CEST	587	49732	137.59.110.57	192.168.2.5	250-newserver.windaq.com Hello 632922 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 12, 2021 13:54:51.090944052 CEST	49732	587	192.168.2.5	137.59.110.57	AUTH login Z29kZnJleUBua2UuY29tLm15
Apr 12, 2021 13:54:51.378777027 CEST	587	49732	137.59.110.57	192.168.2.5	334 UGFzc3dvcmQ6
Apr 12, 2021 13:54:52.352475882 CEST	587	49732	137.59.110.57	192.168.2.5	235 Authentication succeeded
Apr 12, 2021 13:54:52.353357077 CEST	49732	587	192.168.2.5	137.59.110.57	MAIL FROM:<godfrey@nke.com.my>
Apr 12, 2021 13:54:52.640491009 CEST	587	49732	137.59.110.57	192.168.2.5	250 OK
Apr 12, 2021 13:54:52.640882969 CEST	49732	587	192.168.2.5	137.59.110.57	RCPT TO:<godfrey@nke.com.my>
Apr 12, 2021 13:54:52.952547073 CEST	587	49732	137.59.110.57	192.168.2.5	250 Accepted
Apr 12, 2021 13:54:52.953001976 CEST	49732	587	192.168.2.5	137.59.110.57	DATA
Apr 12, 2021 13:54:53.240770102 CEST	587	49732	137.59.110.57	192.168.2.5	354 Enter message, ending with "." on a line by itself
Apr 12, 2021 13:54:53.245562077 CEST	49732	587	192.168.2.5	137.59.110.57	.
Apr 12, 2021 13:54:53.633867025 CEST	587	49732	137.59.110.57	192.168.2.5	250 OK id=1lVv9Z-0000YT-26

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380 Parent PID: 5744

General

Start time:	13:52:58
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TRANSACTION_INTTRANSFER_1617266945242_PDF.exe'
Imagebase:	0x5a0000
File size:	679936 bytes
MD5 hash:	2EF55B1FC8A71F26898AFBD5B80979E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.489145058.0000000003AE1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.488080452.0000000002D70000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.486016885.0000000002AE1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.494505239.00000000075C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: TRANSACTION_INTTRANSFER_1617266945242_PDF.exe PID: 5380 Parent PID: 5744 TRANSACTION_INTTRANSFER_1617266945242_PDF.exeCOMMON

Executed Functions

Function 00E94968, Relevance: 2.3, APIs: 1, Instructions: 793libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E95140

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6653ec631ea4ab7367c1e68854dfe51b93d988f0bb98315e4f15af6c069e185b
Instruction ID: 08f19c5ae1286c20b39982ee614bf3ab84c72b3d5e2aaab359d99a0e0f2e2f5f
Opcode Fuzzy Hash: 6653ec631ea4ab7367c1e68854dfe51b93d988f0bb98315e4f15af6c069e185b
Instruction Fuzzy Hash: 4E622871E006188FCB64EF78C9556EDB7F5AF89304F1085AAD50AAB350EF319E89CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00E96C60, Relevance: 1.1, Instructions: 1131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af487a431e46b67a34b9e31cb229649c8e8ed24924787677facf756091a8517b
Instruction ID: eeb5f32eca0010f20f97f73c84cded996abaee17566df3594193b1cb18f1b62b
Opcode Fuzzy Hash: af487a431e46b67a34b9e31cb229649c8e8ed24924787677facf756091a8517b
Instruction Fuzzy Hash: A5A24E74F002188FDB24EB74C8557AEB7F2AF89704F1484A9E50AEB380DF759D498B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E97DE0, Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f498b3364c1c8c80ef3dd55fc9e1ab7906c2d42dea1bcd44c266b73436a914
Instruction ID: 3cc1b40f9667f1780545cfe52a81ec060669d4ce96c67f1d611a058413bfaa60
Opcode Fuzzy Hash: b1f498b3364c1c8c80ef3dd55fc9e1ab7906c2d42dea1bcd44c266b73436a914
Instruction Fuzzy Hash: 8352D070B043448FDB05EB74C9547AE7BE2AF86708F1584AAD145EB3A2EF359C0AC791

Uniqueness

Uniqueness Score: -1.00%

Function 00E91620, Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6309cbf5aafa619b48b19abbe812af888264cadaae901ab17fca2daacc2f6399
Instruction ID: 617e4fefb8949cf43dc10742e38029e956d01956d3998eda84041c500214ac77
Opcode Fuzzy Hash: 6309cbf5aafa619b48b19abbe812af888264cadaae901ab17fca2daacc2f6399
Instruction Fuzzy Hash: 2322F470B042458FDF19DB74C850BAEBBF6AF85304F1984A9E105EB392EB35DC468B51

Uniqueness

Uniqueness Score: -1.00%

Function 00E98830, Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8526b1797b0a304972093af680f3b271c825467c58f7a664fe4d34190c9d7396
Instruction ID: 9d1a4fa70bad43c31a13680558b390e5258858bdf91b87d312eaa284fa8b33b0
Opcode Fuzzy Hash: 8526b1797b0a304972093af680f3b271c825467c58f7a664fe4d34190c9d7396
Instruction Fuzzy Hash: 41E11030B002049FDB28EB748859B6E76E7AFC5704F188429E506AF3D4EF74EC058B95

Uniqueness

Uniqueness Score: -1.00%

Function 00CFDB4C, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a61e16902c57a56e3db885737d3b0d712c318dd75fdc06f0f3c4cfb193ef46
Instruction ID: b2718abfa6097d65baa9c419494d76ed9ee7887efad670d0138aa3d5f84a7c34
Opcode Fuzzy Hash: d6a61e16902c57a56e3db885737d3b0d712c318dd75fdc06f0f3c4cfb193ef46
Instruction Fuzzy Hash: 07917335E0031D8FCB04DFA0D8549EDBBBAFF89314F158225E515AB3A4EB30A989DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CFE212, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0460540b50f17d88c561d02746b268d2415c014b818c6b7ae1eb9e6464570e27
Instruction ID: 8351383deefde245a1332ca0d375500775f8385b8c7ca09b3fe238d89eb7c6ba
Opcode Fuzzy Hash: 0460540b50f17d88c561d02746b268d2415c014b818c6b7ae1eb9e6464570e27
Instruction Fuzzy Hash: 9F817035E003198FCB05DFE0D8549EDBBBAFF89310F548225E515AB264EB30A989DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CF6A40, Relevance: 6.1, APIs: 4, Instructions: 127threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00CF6AB0
GetCurrentThread.KERNEL32 ref: 00CF6AED
GetCurrentProcess.KERNEL32 ref: 00CF6B2A
GetCurrentThreadId.KERNEL32 ref: 00CF6B83

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4fe4d0b4bbe0b911c97c20c77b4a3b8c18de0c537b4ca86fbbfbd2dd641d1202
Instruction ID: 7143231836cd083f01cadc07c800d7a46f92e0797b8e33feb33671032e1320f9
Opcode Fuzzy Hash: 4fe4d0b4bbe0b911c97c20c77b4a3b8c18de0c537b4ca86fbbfbd2dd641d1202
Instruction Fuzzy Hash: B65155B0A007888FDB14CFA9D548BAEBBF0EF49314F14846AE419B7350D7749949CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00CF6A50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00CF6AB0
GetCurrentThread.KERNEL32 ref: 00CF6AED
GetCurrentProcess.KERNEL32 ref: 00CF6B2A
GetCurrentThreadId.KERNEL32 ref: 00CF6B83

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 21a7182429a9177bfb97ede6c19d2f459467435ea38622587c59f85d87c705a2
Instruction ID: 6855b559f8927e635c367ea27985e155324805d1930b162c092f91d273232f67
Opcode Fuzzy Hash: 21a7182429a9177bfb97ede6c19d2f459467435ea38622587c59f85d87c705a2
Instruction Fuzzy Hash: B05144B4A006888FDB14CFA9D548BAEBBF0EF48314F248469E519B7350D774A948CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00CFBA50, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00CFBCA6

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 43c8ec5a0d95f0a3093c619c0105879b4c886bcc3d44106fefa6915763651e65
Instruction ID: 1d36fb5cb8e2b96b8835311de54c53d676cbe340e5ba0f7068312e5561ff5c31
Opcode Fuzzy Hash: 43c8ec5a0d95f0a3093c619c0105879b4c886bcc3d44106fefa6915763651e65
Instruction Fuzzy Hash: 388127B0A00B098FD764DF29C45176ABBF1FF48314F00892DD59ADBA50DB75E90A8F92

Uniqueness

Uniqueness Score: -1.00%

Function 00E9B648, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9B689

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e59fa5f0157171f4d39f8b00da0e48483300c7695b6467d38e0db67431205066
Instruction ID: e689f42b981aa9036784d811a0cc7f75c8921e36ec2d62cd9ae69ba155bc55d1
Opcode Fuzzy Hash: e59fa5f0157171f4d39f8b00da0e48483300c7695b6467d38e0db67431205066
Instruction Fuzzy Hash: 0F615070A10205DBDF28EFB4E5597AE7BB6AF88304F108529E412AB794DF359845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CFDF0D, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00CFE02A

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 71a1deb32160161fee710b7953101d65eed8f4844c8b08f0e2f8724c592a8ca9
Instruction ID: 4ced014dd98045db0b3ce52c324c03aa3728a905bda9d307ca232ccc8d9ffa10
Opcode Fuzzy Hash: 71a1deb32160161fee710b7953101d65eed8f4844c8b08f0e2f8724c592a8ca9
Instruction Fuzzy Hash: 1851E0B1D00349DFDF14CFA9C884ADEBBB5BF48310F64812AE919AB210D7B49985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E9B080, Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00E9B189

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 187427d83ef0a2c63d87e484329c9a2e0ad88458e4377e0de2f7ce19e577d4c8
Instruction ID: b0b3c328925663913c0943fe87f0272b94ad66d29f267bf865fd1211272a9c1a
Opcode Fuzzy Hash: 187427d83ef0a2c63d87e484329c9a2e0ad88458e4377e0de2f7ce19e577d4c8
Instruction Fuzzy Hash: 874101B1E01258DFDF10CFAAD994A9EBBF5BF48704F14802AE919AB350D770A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CFDF18, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00CFE02A

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6df7ca03417bf4c25766945c465a080e3ba7be3d344c077a498b4cef19ed275e
Instruction ID: 205b54a9e93007f6f42ca92f6a70a5e36706529ed19436058036466a1613b47d
Opcode Fuzzy Hash: 6df7ca03417bf4c25766945c465a080e3ba7be3d344c077a498b4cef19ed275e
Instruction Fuzzy Hash: AC41D1B1D00348DFDF14CF99C984ADEBBB5BF48310F64812AE919AB210D7B4A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E9ADC8, Relevance: 1.6, APIs: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00E9AECC

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d7d43f2099043da47f75b2436ee4df09136314390b326ff945042b0d4f71107f
Instruction ID: a84e4e207fca009e4862014c19132e24db56574cf0d7d23313a72f638b5e43d4
Opcode Fuzzy Hash: d7d43f2099043da47f75b2436ee4df09136314390b326ff945042b0d4f71107f
Instruction Fuzzy Hash: 3A4127B1E042898FDB10CF99C544B9EFBF5AF48308F28816AE519AB345C7759845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00CF7009, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CF7107

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ac21fc75cd273de336e39ac12cc305bbd48e87e5837b975b1aa86767b9de2bb
Instruction ID: 39bf0a49e471686ed7e6efdc3a1734e6ed04b15b0280a709fb4cc66d6921af3e
Opcode Fuzzy Hash: 5ac21fc75cd273de336e39ac12cc305bbd48e87e5837b975b1aa86767b9de2bb
Instruction Fuzzy Hash: 33417976900258AFCB01CFA9D844AEEBFF5EF48310F04806AE954E7321C735A915DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E93D38, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00E9B189

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: acd5a73ab5c9719b0319932a992cac81f968a7d61d3e701f0092a1b229407110
Instruction ID: ed0e6b3fa966d99d251511d97fcb111d681ec9313ddcea2fbd47fc8afe8bd594
Opcode Fuzzy Hash: acd5a73ab5c9719b0319932a992cac81f968a7d61d3e701f0092a1b229407110
Instruction Fuzzy Hash: CB31EFB1D012589FCB10CF9AD994ADEBBF5BF48314F54802AE819BB310D7709945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E93D2C, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00E9AECC

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 339aed7f081a07f996b8e3efe648616a50e6db0e4ea9b9d603ce04117868973f
Instruction ID: 233208248b8e1d1ab03a0f3a9facfa330c23d1b72975b6424644ef7727af9645
Opcode Fuzzy Hash: 339aed7f081a07f996b8e3efe648616a50e6db0e4ea9b9d603ce04117868973f
Instruction Fuzzy Hash: F331F1B1D052898FDB10CF99C584B9EFBF5AF48304F28816AE809BB345C7759985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CF7078, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CF7107

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0eba0af4c9deb7260fcb88bd35d10082eec3c9a3cb83d41f59ebc257bdd1c6fb
Instruction ID: da02b206493fc77d754722007a22438a5d5dbefdfa361bfb738e68e899965dfb
Opcode Fuzzy Hash: 0eba0af4c9deb7260fcb88bd35d10082eec3c9a3cb83d41f59ebc257bdd1c6fb
Instruction Fuzzy Hash: 7F21E5B59002499FDF10CFA9D984AEEBBF4EF48324F14842AE918A7310D374A945DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00CF7080, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CF7107

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 17e7a418f421d2fe1a6f460f4d1f23875573afebc16365ffcee70c923fe5e213
Instruction ID: 4d692b70a1b672a5d119d61c59a750c4494c8c1a82c1f9a540216b8199661e78
Opcode Fuzzy Hash: 17e7a418f421d2fe1a6f460f4d1f23875573afebc16365ffcee70c923fe5e213
Instruction Fuzzy Hash: F721C4B59002599FDB10CF99D984AEEBBF8EB48324F14841AE918A7310D374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E9B639, Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9B689

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 69ccbe428613ea11dc3acee87de5f3b6bcab835107e8d0240e2eef0798e83a3e
Instruction ID: e3e4e98f60d361bd662e3454169a593d573d0df89bdb969222b30f1d5883631c
Opcode Fuzzy Hash: 69ccbe428613ea11dc3acee87de5f3b6bcab835107e8d0240e2eef0798e83a3e
Instruction Fuzzy Hash: 35218E70D10248EFDB28DFB4E584A9DBBB5FF89315F20846DD402AB251CB369886CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00CFA998, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00CFBD21,00000800,00000000,00000000), ref: 00CFBF32

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 586fb5cbc08bd7d78e21711fc04d8d8b9c3bc0c10a31daff7bd6d3a12d9fcd9f
Instruction ID: b7c260445cb8ffa74eb06d703bfe1913a3791241bfd5aaed4ea72c4a28f41a68
Opcode Fuzzy Hash: 586fb5cbc08bd7d78e21711fc04d8d8b9c3bc0c10a31daff7bd6d3a12d9fcd9f
Instruction Fuzzy Hash: A811E4B69042499FDB10CF9AD844BEEFBF4EB48314F14842AE529B7200C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CFBEC0, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00CFBD21,00000800,00000000,00000000), ref: 00CFBF32

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b442c5a6ce093012793e76bd3944f48dfd543b10a904472aa037bb29b4cbd15c
Instruction ID: ba8233bc372925bcc46a3daa8e579cb6e5d69b895d9d3c389a68721c0e0b6871
Opcode Fuzzy Hash: b442c5a6ce093012793e76bd3944f48dfd543b10a904472aa037bb29b4cbd15c
Instruction Fuzzy Hash: 6D2108B6D042498FCB10CF99D444BEEFBF4AF88314F15855AD515A7600C3749945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CFBC40, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00CFBCA6

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 307da2b9ba8474779c3685177ebc7d8fc6edd788d0743a44d76e8881cf16328c
Instruction ID: 02ed01714fe68586750e195ef63e8c89b8fc256bd1f9f56f90574c339f2412a0
Opcode Fuzzy Hash: 307da2b9ba8474779c3685177ebc7d8fc6edd788d0743a44d76e8881cf16328c
Instruction Fuzzy Hash: 7B11D2B5D006498FDB10CF9AC444BDFFBF8AB89324F14841AD529B7600D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD124, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa4c09f71c88a98f62800f008673977b0581f993cb4d1bd0eb29ffb1b09c575
Instruction ID: d63cd1d34ec2219ef68c1d986aa6518c99a0ba84edd5dcd7de5c76b64f140f2b
Opcode Fuzzy Hash: 3fa4c09f71c88a98f62800f008673977b0581f993cb4d1bd0eb29ffb1b09c575
Instruction Fuzzy Hash: F4213AB1504248DFDB01DF14D8C0B3ABFA6FB84314F24C6A9EA055B246C336D959D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1461e5adad2291ceeee8281abb6c5fe1b53821c78ecda2f9842c9ccba77789
Instruction ID: a061031dcbbe959280a371af4cfa1ac4a2c1411b6aa65ad7cc0cf673be8cb88d
Opcode Fuzzy Hash: df1461e5adad2291ceeee8281abb6c5fe1b53821c78ecda2f9842c9ccba77789
Instruction Fuzzy Hash: A7213A71504248DFCB00CF54D9C0B3ABFA6FBA8328F2485A9EA054B216C336D859D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482667965.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ed4cc5af3c9a71959f12942845d0fe423222759303752f5cb4455cbb72109d
Instruction ID: 75951e82f0b764a113ad0cde3e17355db52ef0b0cf61e7a78d109515314ea12f
Opcode Fuzzy Hash: 00ed4cc5af3c9a71959f12942845d0fe423222759303752f5cb4455cbb72109d
Instruction Fuzzy Hash: A3213771504240EFCB01CF10D9C0B6ABBA1FB85314F34C6ADE81A4B246C336DC86DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482667965.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a01f0e3134b9f57c8bdfac1b297da7694a5c9760c355fb8c26db20a614bb8d
Instruction ID: 2aff26bf08fef986f70f3edf38cfe9f2d3e790cb246c4710afc673bc97bb2ffd
Opcode Fuzzy Hash: 72a01f0e3134b9f57c8bdfac1b297da7694a5c9760c355fb8c26db20a614bb8d
Instruction Fuzzy Hash: 20213475608240EFCB14CF14D9C0B6ABB61FB89314F24C5ADE80A4B246C33AD887EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482667965.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df48e59c843eeb9d96e54da25d9eaba5cc22a2207dd87a70c581f0f750792b0
Instruction ID: d4f4a534af8049a0c0e227addfac32243b98cca2336d3cb9b1c4329229a79634
Opcode Fuzzy Hash: 8df48e59c843eeb9d96e54da25d9eaba5cc22a2207dd87a70c581f0f750792b0
Instruction Fuzzy Hash: B821C2355093C08FCB02CF24D990755BF71EB46314F28C1EAD8498B2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD11F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction ID: 56eb1753cef7a9118707b16583365181a4a5b52a3cb4c9d37656e012ec3bf51b
Opcode Fuzzy Hash: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction Fuzzy Hash: BF11D376504284DFCB12CF14D9C4B66BFB2FB84324F24C6A9D9040B616C336D95ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction ID: c73279f15bea9b23929a24592bd3d7e4dcb02312942ddfbc184cfdb923ff6532
Opcode Fuzzy Hash: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction Fuzzy Hash: 5C11D376504284DFCB11CF10D9C4B26BFB2FB94324F24C6A9D9050B616C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482667965.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a5dd89c4e04e7b034098b9a6b3c5328201ea2187bf87cfbe925b6137f2990e
Instruction ID: 3b52cd48af6b7f346d23152acd3a5be9f118f50d1993c77913d0782a43e632ff
Opcode Fuzzy Hash: 13a5dd89c4e04e7b034098b9a6b3c5328201ea2187bf87cfbe925b6137f2990e
Instruction Fuzzy Hash: DB11DD75904280DFCB01CF10D5C0B55FBB1FB85324F28C6ADD85A4B656C33AD99ADB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD669, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952b3195c86d443b3472d8f56df00ee682f68900f1af701a88f0a1d7eb1082e6
Instruction ID: 25ff876cfc62ccd21f55761b3fcdf1c6b4dc9d0bafba07b2122daa324372d939
Opcode Fuzzy Hash: 952b3195c86d443b3472d8f56df00ee682f68900f1af701a88f0a1d7eb1082e6
Instruction Fuzzy Hash: 7701A771509388AEE7104B15DCC477ABBD8EF41324F18C5AAFA099B246C7759848D771

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD668, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.482514319.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560db08b61b86e974979e47e9a0eeec1900a713faf0b83051da1689d724f25b8
Instruction ID: 2311670d79174e05eb7cd8ff88baa050e21dd25468e04c904819ac1da57e50c2
Opcode Fuzzy Hash: 560db08b61b86e974979e47e9a0eeec1900a713faf0b83051da1689d724f25b8
Instruction Fuzzy Hash: C1F04471404248AEE7108A15D884766FBD8DB41724F18C45AED085B256C2759C44DA61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00E91E18, Relevance: 1.8, Instructions: 1782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e62f8d85d1270498bfb7c9b1c96a3284c31b592060cc97f5a5005a6eae212a
Instruction ID: 6ed2903037b46905d7d7e31601959faff642def572d487a1d2b9e507b00e82c3
Opcode Fuzzy Hash: 85e62f8d85d1270498bfb7c9b1c96a3284c31b592060cc97f5a5005a6eae212a
Instruction Fuzzy Hash: ED030A70D10A198ECB14EF68C884AADF7F1BF99300F15D69AE559B7211EB30AAC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00CFC148, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14e370094670868582dbf1e2edb6125e034eed8256b10286ccd57a288ad0416
Instruction ID: c9c12094eb2b9156f3641ec05eb303a9b7f6e20134e2882780cdc6c8945411cd
Opcode Fuzzy Hash: b14e370094670868582dbf1e2edb6125e034eed8256b10286ccd57a288ad0416
Instruction Fuzzy Hash: D55249B160874A8FD7A8CF14E5D81997FB2FB41328BD08228C6715FA99D3B465CACF44

Uniqueness

Uniqueness Score: -1.00%

Function 00E99920, Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94249d272ef20b0b45b4976de7ff1cfc762c95808797059646779f9606807731
Instruction ID: d94064fa371c57cd5b4756498f77118c0c0201d6c845e7b14cea904dd01ce00d
Opcode Fuzzy Hash: 94249d272ef20b0b45b4976de7ff1cfc762c95808797059646779f9606807731
Instruction Fuzzy Hash: 9C025870A002588FCB14EBB8C854BAEB7B6BF88304F1584A9D40AEB755DF35DD858F90

Uniqueness

Uniqueness Score: -1.00%

Function 00E94038, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483931500.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce26c0a131754105799d7b698d7e05a43fe2a123e7f76fc24ef27e747f210fb
Instruction ID: 8748a340f2e8e7c9b058222d2709033c9f7521c6151c166ef8a4dd71efd3f7ab
Opcode Fuzzy Hash: dce26c0a131754105799d7b698d7e05a43fe2a123e7f76fc24ef27e747f210fb
Instruction Fuzzy Hash: 3F91D0B0B002049FDF14EBB5C85ABAE76E6AF84704F148568E606EB3D4EF74DD068791

Uniqueness

Uniqueness Score: -1.00%

Function 00CFA758, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.483066465.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba99f566e7c8e79a8edd478e2c57293e2d091ad2827aab158d1ade6606b1c33
Instruction ID: 60306fb316ff4099ce3a0c10ad00cb7d1762cbe838fff597bd75acf53906ee2d
Opcode Fuzzy Hash: 5ba99f566e7c8e79a8edd478e2c57293e2d091ad2827aab158d1ade6606b1c33
Instruction Fuzzy Hash: A1A18072E002198FCF15DFA5C8445EEBBB2FF85300B15816AEA15BB225EB71AD45CF81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TRANSACTION_INTTRANSFER_1617266945242_PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage