Analysis Report faktura_fk.exe

ID:	394253
Product:	CloudBasic
Start time:	11:18:37
Start date:	21.04.2021
Sample:	faktura_fk.exe
Cookbook:	default.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	66fb235f133e2f690184675fe27bcc32
SHA1:	12f471ad9d4f8ef90cc548d1e0eb498c12ed0230
SHA256:	168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1O7Zrj0oTVUPxo7h5leOqWms2QfQkCgBK", "Injection Process": ["RegAsm.exe", "RegSvcs.exe", "MSBuild.exe"]}

Multi AV Scanner detection for submitted file

Source: faktura_fk.exe

Virustotal: Detection: 17%

Perma Link

Compliance:

Uses 32bit PE files

Source: faktura_fk.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1O7Zrj0oTVUPxo7h5leOqWms2QfQkCgBK

Found strings which match to known social media urls

Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\faktura_fk.exe

Process Stats: CPU usage > 98%

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Users\user\Desktop\faktura_fk.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

PE file contains strange resources

Source: faktura_fk.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameehres.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWMPSideShowGadgetj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameonex.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemsvfw32.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamethumbcache.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamelocalsec.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameUI0Detect.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWLANGPUI.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMSV1_0.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamehotplug.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSTI.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemmcss.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewuaueng.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameOLE32.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamew32time.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameslui.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameUSERCPL.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenametaskschd.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWMDM.dll.muiZ vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamebthci.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMSHTMLER.DLL.MUID vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenapdsnap.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameREGSVC.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamesbdropj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamebrserid.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamecomdlg32.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSXS.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamedps.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWMPNSCFG.EXE.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamesdclt.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWEBCHECK.DLL.MUID vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameAuxiliaryDisplayCpl.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMBLCTR.EXE.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameEFSADU.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWPDMTPDR.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameNetworkItemFactory.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMSCTF.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameaudiodev.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameaelupsvc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamejscript.dll.muiH vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamegpedit.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMSOERES.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000000.2068280402.0000000000433000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameKnudepunkternes2.exe vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3147746520.00000000027E8000.00000004.00000040.sdmp	Binary or memory string: OriginalFilenameKnudepunkternes2.exeFE2XeSafe SolutionseSafe Solutions vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3147383700.0000000000260000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewersvcj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewbengine.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepuiapi.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWfsR.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewmplayer.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemsfltr32.acm.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameaudiosrv.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamebatt.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMDMINST.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWCNCSVC.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamePOWRPROF.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameAUTOPLAY.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamedmdskres.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamegpscript.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamesdcpl.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamesrchadmin.dll.mui@ vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWPDSp.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameVfWWDM32.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameUsbui.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameERCj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamecscsvc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameehRecvr.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamessdpsrv.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameRUNDLL32.EXE.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenetcfgx.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemsfeedsbs.dll.muiD vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameunregmp2.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWUDFSvc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWPCCPL.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameTrustedInstaller.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameUxTheme.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenetprof.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamebattc.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewevtsvc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameappmgmts.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSHDOCVW.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamesti_ci.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamefaultrep.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewdc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameqwavedrv.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewucltux.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameunpnhost.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameappinfo.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemidimap.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemmcndmgr.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameAccessibilityCpl.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMSRATING.DLL.MUID vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameoleres.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewmploc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameACCTRES.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameOLEACCRC.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameIPBusEnum.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamerstrui.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameieinstal.exe.muiD vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewmisvc.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSRVSVC.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamedeskadp.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamePowerCPL.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemsadp32.acm.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSRV.SYS.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameiccvid.drv.muiN vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamegpapi.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamebluetooth.cpl.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewpd_ci.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameINETRES.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameMFC42.DLL.MUIR vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSWPRV.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamePhotoScreensaver.scr.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameATL.DLL.MUIR vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemmcbase.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamelhdfrgui.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamePDH.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWMPNSSCI.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamescsiport.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameAVIFIL32.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemmci.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenametermsrv.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameBubblesj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameIE4UINIT.EXE.MUID vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameiedkcs32.dll.muiD vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWinMail.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewevtutil.exe.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameTBSSVC.DLL.MUIj% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameulib.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamei8042prt.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemycomput.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameparport.sys.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamedsound.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamefwcfg.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameqwave.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe, 00000000.00000002.3151745116.0000000003517000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameumrdp.dll.muij% vs faktura_fk.exe
Source: faktura_fk.exe	Binary or memory string: OriginalFilenameKnudepunkternes2.exe vs faktura_fk.exe

Uses 32bit PE files

Source: faktura_fk.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to development resources

Source: faktura_fk.exe, 00000000.00000002.3151288024.0000000003330000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal96.rans.troj.evad.winEXE@1/0@0/0

PE file has an executable .text section and no other executable section

Source: faktura_fk.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\faktura_fk.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\faktura_fk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: faktura_fk.exe

Virustotal: Detection: 17%

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: faktura_fk.exe PID: 284, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match

File source: Process Memory Space: faktura_fk.exe PID: 284, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\faktura_fk.exe	Code function: 0_2_00407828 push ds; ret		0_2_00407833
Source: C:\Users\user\Desktop\faktura_fk.exe	Code function: 0_2_004063F3 push 85E0C3F5h; retf		0_2_00406412
Source: C:\Users\user\Desktop\faktura_fk.exe	Code function: 0_2_00407792 push es; ret		0_2_0040779B

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\faktura_fk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D29E9 second address: 00000000002D29E9 instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D29AA second address: 00000000002D29AA instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D284C second address: 00000000002D28CA instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov ecx, dword ptr [eax+1Ch] 0x0000000d test ah, ah 0x0000000f mov dword ptr [ebp+14h], ecx 0x00000012 fnop 0x00000014 mov ecx, dword ptr [eax+24h] 0x00000017 mov dword ptr [ebp+10h], ecx 0x0000001a mov esi, dword ptr [eax+20h] 0x0000001d add esi, dword ptr [ebp+04h] 0x00000020 xor ecx, ecx 0x00000022 test edx, edx 0x00000024 mov edx, dword ptr [esi] 0x00000026 test ebx, ebx 0x00000028 add edx, dword ptr [ebp+04h] 0x0000002b push ecx 0x0000002c test dh, ch 0x0000002e push esi 0x0000002f push edx 0x00000030 test bl, cl 0x00000032 call 00007F92C0FE272Bh 0x00000037 pushad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D28CA second address: 00000000002D28CA instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D2886 second address: 00000000002D2886 instructions:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: faktura_fk.exe, 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE9
Source: faktura_fk.exe, 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D29E9 second address: 00000000002D29E9 instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D29AA second address: 00000000002D29AA instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D284C second address: 00000000002D28CA instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov ecx, dword ptr [eax+1Ch] 0x0000000d test ah, ah 0x0000000f mov dword ptr [ebp+14h], ecx 0x00000012 fnop 0x00000014 mov ecx, dword ptr [eax+24h] 0x00000017 mov dword ptr [ebp+10h], ecx 0x0000001a mov esi, dword ptr [eax+20h] 0x0000001d add esi, dword ptr [ebp+04h] 0x00000020 xor ecx, ecx 0x00000022 test edx, edx 0x00000024 mov edx, dword ptr [esi] 0x00000026 test ebx, ebx 0x00000028 add edx, dword ptr [ebp+04h] 0x0000002b push ecx 0x0000002c test dh, ch 0x0000002e push esi 0x0000002f push edx 0x00000030 test bl, cl 0x00000032 call 00007F92C0FE272Bh 0x00000037 pushad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D28CA second address: 00000000002D28CA instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D2886 second address: 00000000002D2886 instructions:
Source: C:\Users\user\Desktop\faktura_fk.exe	RDTSC instruction interceptor: First address: 00000000002D187C second address: 00000000002D187C instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F92C0D179FAh 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp edx, ecx 0x0000001f pop ecx 0x00000020 add edi, edx 0x00000022 dec ecx 0x00000023 cmp eax, eax 0x00000025 cmp ecx, 00000000h 0x00000028 jne 00007F92C0D179DCh 0x0000002a push ecx 0x0000002b test ah, FFFFFF84h 0x0000002e call 00007F92C0D17A11h 0x00000033 call 00007F92C0D17A0Ah 0x00000038 lfence 0x0000003b mov edx, dword ptr [7FFE0014h] 0x00000041 lfence 0x00000044 ret 0x00000045 mov esi, edx 0x00000047 pushad 0x00000048 rdtsc

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: faktura_fk.exe, 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe9
Source: faktura_fk.exe, 00000000.00000002.3147398939.00000000002D0000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\faktura_fk.exe

Process Stats: CPU usage > 90% for more than 60s

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: faktura_fk.exe, 00000000.00000002.3147518081.00000000009C0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: faktura_fk.exe, 00000000.00000002.3147518081.00000000009C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: faktura_fk.exe, 00000000.00000002.3147518081.00000000009C0000.00000002.00000001.sdmp	Binary or memory string: !Progman