Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report DHLAWB# 9284880911 pdf.exe

Overview

General Information

Sample Name:DHLAWB# 9284880911 pdf.exe
Analysis ID:402352
MD5:72208e35ab96b53baffd99165d2f50cb
SHA1:ca1a5cefafcd9e4f37bb3880d96aa0fb86043cf1
SHA256:a2bb219a5ecfa042dc97a47aeda8a637f49e70e09af3f7b52f7974f7b1c39172
Tags:exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • DHLAWB# 9284880911 pdf.exe (PID: 3012 cmdline: 'C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe' MD5: 72208E35AB96B53BAFFD99165D2F50CB)
    • schtasks.exe (PID: 3468 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 2168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • DHLAWB# 9284880911 pdf.exe (PID: 1560 cmdline: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe MD5: 72208E35AB96B53BAFFD99165D2F50CB)
  • cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "97a824b7-e666-4a22-b2e3-fb501d91", "Group": "king", "Domain1": "23.105.131.171", "Domain2": "", "Port": 4040, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0xe75:$x1: NanoCore.ClientPluginHost
  • 0xe8f:$x2: IClientNetworkHost
00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmpNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
  • 0xe75:$x2: NanoCore.ClientPluginHost
  • 0x1261:$s3: PipeExists
  • 0x1136:$s4: PipeCreated
  • 0xeb0:$s5: IClientLoggingHost
00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0xff8d:$x1: NanoCore.ClientPluginHost
  • 0xffca:$x2: IClientNetworkHost
  • 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
    00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
    • 0xfcf5:$a: NanoCore
    • 0xfd05:$a: NanoCore
    • 0xff39:$a: NanoCore
    • 0xff4d:$a: NanoCore
    • 0xff8d:$a: NanoCore
    • 0xfd54:$b: ClientPlugin
    • 0xff56:$b: ClientPlugin
    • 0xff96:$b: ClientPlugin
    • 0xfe7b:$c: ProjectData
    • 0x10882:$d: DESCrypto
    • 0x1824e:$e: KeepAlive
    • 0x1623c:$g: LogClientMessage
    • 0x12437:$i: get_Connected
    • 0x10bb8:$j: #=q
    • 0x10be8:$j: #=q
    • 0x10c04:$j: #=q
    • 0x10c34:$j: #=q
    • 0x10c50:$j: #=q
    • 0x10c6c:$j: #=q
    • 0x10c9c:$j: #=q
    • 0x10cb8:$j: #=q
    Click to see the 14 entries

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0x2dbb:$x1: NanoCore.ClientPluginHost
    • 0x2de5:$x2: IClientNetworkHost
    4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
    • 0x2dbb:$x2: NanoCore.ClientPluginHost
    • 0x4c6b:$s4: PipeCreated
    0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0x1018d:$x1: NanoCore.ClientPluginHost
    • 0x429ad:$x1: NanoCore.ClientPluginHost
    • 0x101ca:$x2: IClientNetworkHost
    • 0x429ea:$x2: IClientNetworkHost
    • 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
    • 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
    0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
    • 0xff05:$x1: NanoCore Client.exe
    • 0x42725:$x1: NanoCore Client.exe
    • 0x1018d:$x2: NanoCore.ClientPluginHost
    • 0x429ad:$x2: NanoCore.ClientPluginHost
    • 0x117c6:$s1: PluginCommand
    • 0x43fe6:$s1: PluginCommand
    • 0x117ba:$s2: FileCommand
    • 0x43fda:$s2: FileCommand
    • 0x1266b:$s3: PipeExists
    • 0x44e8b:$s3: PipeExists
    • 0x18422:$s4: PipeCreated
    • 0x4ac42:$s4: PipeCreated
    • 0x101b7:$s5: IClientLoggingHost
    • 0x429d7:$s5: IClientLoggingHost
    0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
      Click to see the 54 entries

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: NanoCoreShow sources
      Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe, ProcessId: 1560, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
      Sigma detected: Scheduled temp file as task from temp locationShow sources
      Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe' , ParentImage: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe, ParentProcessId: 3012, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp', ProcessId: 3468

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpackMalware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "97a824b7-e666-4a22-b2e3-fb501d91", "Group": "king", "Domain1": "23.105.131.171", "Domain2": "", "Port": 4040, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8"}
      Multi AV Scanner detection for dropped fileShow sources
      Source: C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exeReversingLabs: Detection: 10%
      Multi AV Scanner detection for submitted fileShow sources
      Source: DHLAWB# 9284880911 pdf.exeReversingLabs: Detection: 10%
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORY
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPE
      Machine Learning detection for dropped fileShow sources
      Source: C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exeJoe Sandbox ML: detected
      Machine Learning detection for sampleShow sources
      Source: DHLAWB# 9284880911 pdf.exeJoe Sandbox ML: detected
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpackAvira: Label: TR/NanoCore.fadte
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: mscorlib.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\vCohllGlVk\src\obj\Debug\StringHandleOnStack.pdb source: DHLAWB# 9284880911 pdf.exe
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Windows\dll\mscorlib.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Windows\mscorlib.pdbI source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: mscorrc.pdb source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.234251673.0000000007540000.00000002.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000004.00000002.483898535.0000000005CB0000.00000002.00000001.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then mov esp, ebp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4x nop then mov esp, ebp

      Networking:

      barindex
      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49725 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49726 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49727 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49733 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49734 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49736 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49738 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49740 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49741 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49750 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49751 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49752 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49753 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49754 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49756 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49758 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49759 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49760 -> 23.105.131.171:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49761 -> 23.105.131.171:4040
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorURLs:
      Source: Malware configuration extractorURLs: 23.105.131.171
      Source: global trafficTCP traffic: 192.168.2.3:49725 -> 23.105.131.171:4040
      Source: Joe Sandbox ViewASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.171
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA28CE WSARecv,
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207004883.000000000195D000.00000004.00000001.sdmpString found in binary or memory: http://en.w
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpString found in binary or memory: http://google.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.226163799.0000000005880000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212524209.000000000588D000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212025172.0000000005889000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212524209.000000000588D000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.226163799.0000000005880000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comceTF
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com-uA
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comc
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207425359.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comic
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208706639.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/MI:H
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/TS
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnb-n
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnerslH
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnk-s
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cns-m
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/RT
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ito
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/8T
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ko
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/liquwT
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207260612.000000000589B000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207260612.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comibiT
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krZ
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kre
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krtriFH
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207630084.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comh
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000003.207580705.000000000589B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comtn
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.226833624.00000000015C8000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: RegisterRawInputDevices

      E-Banking Fraud:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORY
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPE

      System Summary:

      barindex
      Malicious sample detected (through community Yara rule)Show sources
      Source: 00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000004.00000002.481253287.000000000383B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.37f1288.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b178d1.11.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.5b80000.13.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38850d8.5.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38850d8.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055015E2 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055015B1 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA136A NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA132F NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_00E38EF6
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_00E3C644
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_00E37693
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A23B8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A5A18
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A1E50
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031AD518
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A4950
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A5140
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031AD960
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A6878
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A975A
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A23A8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031ADBF0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031AE268
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A76B0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A86D8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A86C8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A76C0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8AF0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8AE0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031ACD38
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A6D28
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A5550
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8141
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031AE990
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A3DB0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8DC5
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A681F
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A4898
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8891
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A8CA9
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031A88A0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05511471
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05510070
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05510B20
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055104D0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055130C0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05510B10
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05511A13
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05510006
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055104C0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055117F1
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055119BB
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_00FB8EF6
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_00FBC644
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_00FB7693
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_0596ACC8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05963850
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05969068
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05968468
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_059623A0
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05962FA8
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_0596912F
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_0596306F
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_0684781F
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06844068
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06844C68
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06842270
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06841670
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06845510
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06844D2F
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06842337
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06847758
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_06846B58
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.226428505.0000000000EF4000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameStringHandleOnStack.exeF vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.235348955.0000000007860000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.235991881.0000000007B20000.00000002.00000001.sdmpBinary or memory string: originalfilename vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.235991881.0000000007B20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.234534146.0000000007620000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.226833624.00000000015C8000.00000004.00000020.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.235771128.0000000007A30000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.234251673.0000000007540000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.480974353.00000000037E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482623879.0000000004A96000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPluginNew.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.485049464.0000000006A90000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.483342885.0000000005A70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.473818106.0000000001074000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameStringHandleOnStack.exeF vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.483898535.0000000005CB0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exeBinary or memory string: OriginalFilenameStringHandleOnStack.exeF vs DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
      Source: 00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000004.00000002.481253287.000000000383B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b12c32.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.37f1288.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.37f1288.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b178d1.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b178d1.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4b099fe.10.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.5b80000.13.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.5b80000.13.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38647fc.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.3870a70.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38850d8.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.38850d8.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: HVLIxSqWJDWWZt.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
      Source: classification engineClassification label: mal100.troj.evad.winEXE@6/6@0/1
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_05501466 AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_0550142F AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA112A AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA10F3 AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile created: C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exeJump to behavior
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeMutant created: \Sessions\1\BaseNamedObjects\skdZIBbaoBoYVQ
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2168:120:WilError_01
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{97a824b7-e666-4a22-b2e3-fb501d91b8df}
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile created: C:\Users\user\AppData\Local\Temp\tmpF4A2.tmpJump to behavior
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
      Source: DHLAWB# 9284880911 pdf.exeReversingLabs: Detection: 10%
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile read: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe 'C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe'
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp'
      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp'
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: DHLAWB# 9284880911 pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: mscorlib.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\vCohllGlVk\src\obj\Debug\StringHandleOnStack.pdb source: DHLAWB# 9284880911 pdf.exe
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Windows\dll\mscorlib.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp
      Source: Binary string: C:\Windows\mscorlib.pdbI source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477033489.0000000001775000.00000004.00000040.sdmp
      Source: Binary string: mscorrc.pdb source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.234251673.0000000007540000.00000002.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000004.00000002.483898535.0000000005CB0000.00000002.00000001.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp

      Data Obfuscation:

      barindex
      .NET source code contains potential unpackerShow sources
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_00E3C1B3 push es; iretd
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_02F88808 push ebp; ret
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_02F88804 push ecx; ret
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_031AC2DB push ebp; ret
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 0_2_055121A2 push edx; ret
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_00FBC1B3 push es; iretd
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_017474B8 push ebp; ret
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_017474AC push ecx; ret
      Source: initial sampleStatic PE information: section name: .text entropy: 7.92145067275
      Source: initial sampleStatic PE information: section name: .text entropy: 7.92145067275
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
      Source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile created: C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exeJump to dropped file

      Boot Survival:

      barindex
      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp'

      Hooking and other Techniques for Hiding and Protection:

      barindex
      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile opened: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe:Zone.Identifier read attributes | delete
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion:

      barindex
      Yara detected AntiVM3Show sources
      Source: Yara matchFile source: 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 3012, type: MEMORY
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeWindow / User API: threadDelayed 412
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeWindow / User API: foregroundWindowGot 964
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe TID: 2432Thread sleep time: -99303s >= -30000s
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe TID: 592Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe TID: 5400Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe TID: 492Thread sleep time: -240000s >= -30000s
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA0DB6 GetSystemInfo,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeThread delayed: delay time: 99303
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeThread delayed: delay time: 922337203685477
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.485049464.0000000006A90000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: vmware
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: VMWARE
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.485049464.0000000006A90000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.485049464.0000000006A90000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
      Source: DHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.485049464.0000000006A90000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess information queried: ProcessInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeMemory allocated: page read and write | page guard

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      Injects a PE file into a foreign processesShow sources
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeMemory written: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe base: 400000 value starts with: 4D5A
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp'
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeProcess created: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.481821618.000000000395A000.00000004.00000001.sdmpBinary or memory string: Program Manager
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477363163.0000000001DA0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477363163.0000000001DA0000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.481906477.000000000396E000.00000004.00000001.sdmpBinary or memory string: Program Manager0
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.481253287.000000000383B000.00000004.00000001.sdmpBinary or memory string: Program ManagerX
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.477363163.0000000001DA0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_0173AF9A GetUserNameW,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

      Stealing of Sensitive Information:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORY
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPE

      Remote Access Functionality:

      barindex
      Detected Nanocore RatShow sources
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.480974353.00000000037E1000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.480974353.00000000037E1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
      Source: DHLAWB# 9284880911 pdf.exe, 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DHLAWB# 9284880911 pdf.exe PID: 1560, type: MEMORY
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.46f7978.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b4629.16.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.DHLAWB# 9284880911 pdf.exe.45ac0d8.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.4846e90.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.48b6f59.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 4.2.DHLAWB# 9284880911 pdf.exe.484b4b9.6.raw.unpack, type: UNPACKEDPE
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA2386 bind,
      Source: C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exeCode function: 4_2_05AA2353 bind,

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsScheduled Task/Job1Scheduled Task/Job1Access Token Manipulation1Masquerading1Input Capture21Security Software Discovery211Remote ServicesInput Capture21Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsProcess Injection112Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Scheduled Task/Job1Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Access Token Manipulation1NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferIngress Tool Transfer1SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection112LSA SecretsAccount Discovery1SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol1Manipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonDeobfuscate/Decode Files or Information1Cached Domain CredentialsSystem Owner/User Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsHidden Files and Directories1DCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobObfuscated Files or Information3Proc FilesystemSystem Information Discovery13Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Software Packing13/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      DHLAWB# 9284880911 pdf.exe11%ReversingLabs
      DHLAWB# 9284880911 pdf.exe100%Joe Sandbox ML

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exe100%Joe Sandbox ML
      C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exe11%ReversingLabs

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      4.2.DHLAWB# 9284880911 pdf.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File
      4.2.DHLAWB# 9284880911 pdf.exe.60b0000.17.unpack100%AviraTR/NanoCore.fadteDownload File

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      0%Avira URL Cloudsafe
      http://www.sandoll.co.krtriFH0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/a-e0%Avira URL Cloudsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.fontbureau.comceTF0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/TS0%Avira URL Cloudsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.sandoll.co.krZ0%Avira URL Cloudsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://www.fonts.comic0%URL Reputationsafe
      http://www.fonts.comic0%URL Reputationsafe
      http://www.fonts.comic0%URL Reputationsafe
      http://www.founder.com.cn/cnb-n0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
      http://www.founder.com.cn/cnerslH0%Avira URL Cloudsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.fonts.comc0%URL Reputationsafe
      http://www.fonts.comc0%URL Reputationsafe
      http://www.fonts.comc0%URL Reputationsafe
      http://www.founder.com.cn/cn/MI:H0%Avira URL Cloudsafe
      http://www.fonts.com-uA0%Avira URL Cloudsafe
      http://www.sandoll.co.kre0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.tiro.comtn0%Avira URL Cloudsafe
      http://en.w0%URL Reputationsafe
      http://en.w0%URL Reputationsafe
      http://en.w0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/ko0%Avira URL Cloudsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/ito0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      23.105.131.1710%Avira URL Cloudsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/8T0%Avira URL Cloudsafe
      http://www.sajatypeworks.comibiT0%Avira URL Cloudsafe
      http://www.founder.com.cn/cns-m0%Avira URL Cloudsafe
      http://www.tiro.comh0%Avira URL Cloudsafe
      http://www.founder.com.cn/cnk-s0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/RT0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/liquwT0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      true
      • Avira URL Cloud: safe
      		low
      23.105.131.171true
      • Avira URL Cloud: safe
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.fontbureau.com/designersGDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
        		high
        http://www.fontbureau.com/designers/?DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
          		high
          http://www.sandoll.co.krtriFHDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.founder.com.cn/cn/bTheDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          		unknown
          http://www.jiyu-kobo.co.jp/a-eDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.fontbureau.com/designers?DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
            		high
            http://www.tiro.comDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            http://www.fontbureau.com/designersDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212524209.000000000588D000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212025172.0000000005889000.00000004.00000001.sdmpfalse
              		high
              http://www.goodfont.co.krDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.fontbureau.comceTFDHLAWB# 9284880911 pdf.exe, 00000000.00000003.226163799.0000000005880000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.founder.com.cn/cn/TSDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssDHLAWB# 9284880911 pdf.exe, 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmpfalse
                		high
                http://www.sajatypeworks.comDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207260612.000000000589B000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.typography.netDDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.founder.com.cn/cn/cTheDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.galapagosdesign.com/staff/dennis.htmDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.sandoll.co.krZDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://fontfabrik.comDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.fonts.comicDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207425359.000000000589B000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.founder.com.cn/cnb-nDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.jiyu-kobo.co.jp//DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.founder.com.cn/cnerslHDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.galapagosdesign.com/DPleaseDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.jiyu-kobo.co.jp/Y0DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.fonts.comDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpfalse
                  		high
                  http://www.sandoll.co.krDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.urwpp.deDPleaseDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.zhongyicts.com.cnDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.sakkal.comDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.apache.org/licenses/LICENSE-2.0DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                    		high
                    http://www.fontbureau.comDHLAWB# 9284880911 pdf.exe, 00000000.00000003.226163799.0000000005880000.00000004.00000001.sdmpfalse
                      		high
                      http://www.fonts.comcDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.founder.com.cn/cn/MI:HDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208706639.0000000005884000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fonts.com-uADHLAWB# 9284880911 pdf.exe, 00000000.00000003.207382725.000000000589B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.sandoll.co.kreDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208289981.0000000005886000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/jp/DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.tiro.comtnDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207580705.000000000589B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://en.wDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207004883.000000000195D000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/koDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.carterandcone.comlDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/itoDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.founder.com.cn/cn/DHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers/cabarga.htmlNDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cnDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208864496.0000000005884000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/frere-jones.htmlDHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmpfalse
                          		high
                          http://www.jiyu-kobo.co.jp/DHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/jp/8TDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designers8DHLAWB# 9284880911 pdf.exe, 00000000.00000002.232662327.0000000006B12000.00000004.00000001.sdmp, DHLAWB# 9284880911 pdf.exe, 00000000.00000003.212524209.000000000588D000.00000004.00000001.sdmpfalse
                            		high
                            http://www.sajatypeworks.comibiTDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207260612.000000000589B000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.founder.com.cn/cns-mDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.tiro.comhDHLAWB# 9284880911 pdf.exe, 00000000.00000003.207630084.000000000589B000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.founder.com.cn/cnk-sDHLAWB# 9284880911 pdf.exe, 00000000.00000003.208693548.00000000058BD000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/RTDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/liquwTDHLAWB# 9284880911 pdf.exe, 00000000.00000003.209977218.0000000005884000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown

                            Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public

                            IPDomainCountryFlagASNASN NameMalicious
                            23.105.131.171
                            		unknownUnited States
                            		396362LEASEWEB-USA-NYC-11UStrue

                            General Information

                            Joe Sandbox Version:32.0.0 Black Diamond
                            Analysis ID:402352
                            Start date:03.05.2021
                            Start time:04:09:21
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 9m 32s
                            Hypervisor based Inspection enabled:false
                            Report type:light
                            Sample file name:DHLAWB# 9284880911 pdf.exe
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:30
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:MAL
                            Classification:mal100.troj.evad.winEXE@6/6@0/1
                            EGA Information:Failed
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 98%
                            • Number of executed functions: 0
                            • Number of non-executed functions: 0
                            Cookbook Comments:
                            • Adjust boot time
                            • Enable AMSI
                            • Found application associated with file extension: .exe
                            Warnings:
                            Show All
                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                            • TCP Packets have been reduced to 100
                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            04:10:17API Interceptor991x Sleep call for process: DHLAWB# 9284880911 pdf.exe modified

                            Joe Sandbox View / Context

                            IPs

                            No context

                            Domains

                            No context

                            ASN

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            LEASEWEB-USA-NYC-11USPO.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.190
                            PO.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            PO.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            SecuriteInfo.com.Trojan.Win32.Save.a.29244.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            ZBgnuLqtOd.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            ZE9u48l6N4.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            PO copy.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            invoice&packing list.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            PO.PDF.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            PO copy.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.161
                            Ordem urgente AWB674653783- FF2453,PDF.exeGet hashmaliciousBrowse
                            • 23.105.131.132
                            Remittance FormDoc.exeGet hashmaliciousBrowse
                            • 23.19.227.243
                            Presupuesto de orden urgente KTX88467638,pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.132
                            Dringende Bestellung Zitat CTX88467638,pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.132
                            shipping document.exeGet hashmaliciousBrowse
                            • 23.105.131.207
                            6V9espP5wD.exeGet hashmaliciousBrowse
                            • 23.105.131.195
                            NVAbIqNO9h.exeGet hashmaliciousBrowse
                            • 23.105.131.209
                            UUGCfhIdFD.exeGet hashmaliciousBrowse
                            • 23.105.131.228
                            KPcrOQcb5P.exeGet hashmaliciousBrowse
                            • 23.105.131.228
                            rGsJ1mXomJ.exeGet hashmaliciousBrowse
                            • 23.105.131.228

                            JA3 Fingerprints

                            No context

                            Dropped Files

                            No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DHLAWB# 9284880911 pdf.exe.log
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:modified
                            Size (bytes):664
                            Entropy (8bit):5.288448637977022
                            Encrypted:false
                            SSDEEP:12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk70U2xANlW3ANv:MLF20NaL3z2p29hJ5g522rW2xAi3A9
                            MD5:B1DB55991C3DA14E35249AEA1BC357CA
                            SHA1:0DD2D91198FDEF296441B12F1A906669B279700C
                            SHA-256:34D3E48321D5010AD2BD1F3F0B728077E4F5A7F70D66FA36B57E5209580B6BDC
                            SHA-512:BE38A31888C9C2F8047FA9C99672CB985179D325107514B7500DDA9523AE3E1D20B45EACC4E6C8A5D096360D0FBB98A120E63F38FFE324DF8A0559F6890CC801
                            Malicious:true
                            Reputation:moderate, very likely benign file
                            Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\35774dc3cd31b4550ab06c3354cf4ba5\System.Runtime.Remoting.ni.dll",0..
                            C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):1647
                            Entropy (8bit):5.207288139039549
                            Encrypted:false
                            SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBhjtn:cbh47TlNQ//rydbz9I3YODOLNdq3rx
                            MD5:68BA3B143C5974B5DED04F92F7827666
                            SHA1:F8BE95A25B6028A32CB00EC509277E43C8F6B745
                            SHA-256:B12C7C79B35BF6F2B71A1D379C60D69F3B29F63D887CAF320FAFE74FC029A612
                            SHA-512:667D269D27739268F1B37BF193CE05EF88CFE5B60561AFFE0E2C44F988C7C4EA1C300707B2A7616CC0793095F04AD1022EF8A04369F4144D0A54B181BBC72430
                            Malicious:true
                            Reputation:low
                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):2320
                            Entropy (8bit):7.024371743172393
                            Encrypted:false
                            SSDEEP:48:Ik/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwh:flC0IlC0IlC0IlC0IlC0IlC0IlC0IlCr
                            MD5:0FBED11864C03FDED0E70014DCF84578
                            SHA1:453723D938A03252F705B0A104986FE4C5CA7056
                            SHA-256:70F5E49EE3091777827ED661B63842061220C899A708860986E9AA1BD87C5004
                            SHA-512:DB53E3F1D18171F1D86C1B9BBF6BBD07153FC3E561834A35834BC0CA1E034FEDCD83AAAE7EDF9262C4E175C3D2287B647F55282E49627EAAF587F43714204667
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):8
                            Entropy (8bit):3.0
                            Encrypted:false
                            SSDEEP:3:26Vt:26H
                            MD5:62A6C13CD893BCE61252A1FBDEF3D1E7
                            SHA1:D600274F5EC2D00AFA5248B17FC1AF3D26B618E6
                            SHA-256:3AB5689F7F661B5857C8B9B89ED75FBE1E672C1D1FB6503EBC7F7C27D37DC5A3
                            SHA-512:8DEE624F1D97EF4B30336D5534389659A251F26D0E6CEC1ECA7B8AE283AFA014EF3D86BD7121172D97D54A26838A47BE86843220EE4FF2631766E25650888EE8
                            Malicious:true
                            Reputation:low
                            Preview: .f_.$..H
                            C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exe
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):791040
                            Entropy (8bit):7.913655996564074
                            Encrypted:false
                            SSDEEP:12288:25+tz1qUQFb6Jn7Hqty7Q6gUKljtD8hgeo2JvKy12cmLqfnkp6gM:2oJ1qLFba7QyE6ghVt8geJ52cmLqf5g
                            MD5:72208E35AB96B53BAFFD99165D2F50CB
                            SHA1:CA1A5CEFAFCD9E4F37BB3880D96AA0FB86043CF1
                            SHA-256:A2BB219A5ECFA042DC97A47AEDA8A637F49E70E09AF3F7B52F7974F7B1C39172
                            SHA-512:71D28A8965CDDF7968804AC0FC446C8A303FE860555818C98F98962810EB459D0422B6EEAF86A40620EDE4226901EAFB0330E12C1188ADB3884412EB03F02E28
                            Malicious:true
                            Antivirus:
                            • Antivirus: Joe Sandbox ML, Detection: 100%
                            • Antivirus: ReversingLabs, Detection: 11%
                            Reputation:low
                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...NM.`..............P..............$... ...@....@.. ....................................@..................................$..O....@..4....................`......P#............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................$......H.......4...............8>...............................................0............(....(..........(.....o.....*.....................(.......( ......(!......("......(#....*N..(....oe...($....*&..(%....*.s&........s'........s(........s)........s*........*....0...........~....o+....+..*.0...........~....o,....+..*.0...........~....o-....+..*.0...........~....o.....+..*.0...........~....o/....+..*.0..<........~.....(0.....,!r...p.....(1...o2...s3............~.....+..*.0......
                            C:\Users\user\AppData\Roaming\HVLIxSqWJDWWZt.exe:Zone.Identifier
                            Process:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):26
                            Entropy (8bit):3.95006375643621
                            Encrypted:false
                            SSDEEP:3:ggPYV:rPYV
                            MD5:187F488E27DB4AF347237FE461A079AD
                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                            Malicious:true
                            Reputation:high, very likely benign file
                            Preview: [ZoneTransfer]....ZoneId=0

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                            Entropy (8bit):7.913655996564074
                            TrID:
                            • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                            • Win32 Executable (generic) a (10002005/4) 49.75%
                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                            • Windows Screen Saver (13104/52) 0.07%
                            • Generic Win/DOS Executable (2004/3) 0.01%
                            File name:DHLAWB# 9284880911 pdf.exe
                            File size:791040
                            MD5:72208e35ab96b53baffd99165d2f50cb
                            SHA1:ca1a5cefafcd9e4f37bb3880d96aa0fb86043cf1
                            SHA256:a2bb219a5ecfa042dc97a47aeda8a637f49e70e09af3f7b52f7974f7b1c39172
                            SHA512:71d28a8965cddf7968804ac0fc446c8a303fe860555818c98f98962810eb459d0422b6eeaf86a40620ede4226901eafb0330e12c1188adb3884412eb03f02e28
                            SSDEEP:12288:25+tz1qUQFb6Jn7Hqty7Q6gUKljtD8hgeo2JvKy12cmLqfnkp6gM:2oJ1qLFba7QyE6ghVt8geJ52cmLqf5g
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...NM.`..............P..............$... ...@....@.. ....................................@................................

                            File Icon

                            Icon Hash:00828e8e8686b000

                            Static PE Info

                            General

                            Entrypoint:0x4c24da
                            Entrypoint Section:.text
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                            Time Stamp:0x608F4D4E [Mon May 3 01:09:34 2021 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:v2.0.50727
                            OS Version Major:4
                            OS Version Minor:0
                            File Version Major:4
                            File Version Minor:0
                            Subsystem Version Major:4
                            Subsystem Version Minor:0
                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                            Entrypoint Preview

                            Instruction
                            jmp dword ptr [00402000h]
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0xc24880x4f.text
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x634.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xc60000xc.reloc
                            IMAGE_DIRECTORY_ENTRY_DEBUG0xc23500x1c.text
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x20000xc04e00xc0600False0.935686474578data7.92145067275IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                            .rsrc0xc40000x6340x800False0.33984375data3.51853256281IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .reloc0xc60000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountry
                            RT_VERSION0xc40900x3a4data
                            RT_MANIFEST0xc44440x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                            Imports

                            DLLImport
                            mscoree.dll_CorExeMain

                            Version Infos

                            DescriptionData
                            Translation0x0000 0x04b0
                            LegalCopyrightCopyright Opti-Tek
                            Assembly Version1.0.1.7
                            InternalNameStringHandleOnStack.exe
                            FileVersion1.0.1.7
                            CompanyNameOpti-Tek
                            LegalTrademarks
                            CommentsMachine Operator
                            ProductNameInternalArrayTypeE
                            ProductVersion1.0.1.7
                            FileDescriptionInternalArrayTypeE
                            OriginalFilenameStringHandleOnStack.exe

                            Network Behavior

                            Snort IDS Alerts

                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                            05/03/21-04:10:23.692897TCP2025019ET TROJAN Possible NanoCore C2 60B497254040192.168.2.323.105.131.171
                            05/03/21-04:10:29.991238TCP2025019ET TROJAN Possible NanoCore C2 60B497264040192.168.2.323.105.131.171
                            05/03/21-04:10:36.191569TCP2025019ET TROJAN Possible NanoCore C2 60B497274040192.168.2.323.105.131.171
                            05/03/21-04:10:42.540681TCP2025019ET TROJAN Possible NanoCore C2 60B497334040192.168.2.323.105.131.171
                            05/03/21-04:10:47.683486TCP2025019ET TROJAN Possible NanoCore C2 60B497344040192.168.2.323.105.131.171
                            05/03/21-04:10:53.831453TCP2025019ET TROJAN Possible NanoCore C2 60B497364040192.168.2.323.105.131.171
                            05/03/21-04:11:00.147141TCP2025019ET TROJAN Possible NanoCore C2 60B497384040192.168.2.323.105.131.171
                            05/03/21-04:11:06.368003TCP2025019ET TROJAN Possible NanoCore C2 60B497404040192.168.2.323.105.131.171
                            05/03/21-04:11:12.549875TCP2025019ET TROJAN Possible NanoCore C2 60B497414040192.168.2.323.105.131.171
                            05/03/21-04:11:18.828670TCP2025019ET TROJAN Possible NanoCore C2 60B497504040192.168.2.323.105.131.171
                            05/03/21-04:11:25.226719TCP2025019ET TROJAN Possible NanoCore C2 60B497514040192.168.2.323.105.131.171
                            05/03/21-04:11:32.050089TCP2025019ET TROJAN Possible NanoCore C2 60B497524040192.168.2.323.105.131.171
                            05/03/21-04:11:38.190410TCP2025019ET TROJAN Possible NanoCore C2 60B497534040192.168.2.323.105.131.171
                            05/03/21-04:11:44.381807TCP2025019ET TROJAN Possible NanoCore C2 60B497544040192.168.2.323.105.131.171
                            05/03/21-04:11:50.630024TCP2025019ET TROJAN Possible NanoCore C2 60B497564040192.168.2.323.105.131.171
                            05/03/21-04:11:56.886506TCP2025019ET TROJAN Possible NanoCore C2 60B497584040192.168.2.323.105.131.171
                            05/03/21-04:12:02.999852TCP2025019ET TROJAN Possible NanoCore C2 60B497594040192.168.2.323.105.131.171
                            05/03/21-04:12:09.279030TCP2025019ET TROJAN Possible NanoCore C2 60B497604040192.168.2.323.105.131.171
                            05/03/21-04:12:15.429008TCP2025019ET TROJAN Possible NanoCore C2 60B497614040192.168.2.323.105.131.171

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            May 3, 2021 04:10:23.308895111 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:23.637084007 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:23.637183905 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:23.692897081 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:24.038207054 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:24.038295031 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:24.431047916 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:24.431204081 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:24.761238098 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:24.761467934 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.142074108 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.142237902 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.524909973 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.525513887 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.538619041 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.538675070 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.538707018 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.538757086 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.539366007 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.539419889 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.540429115 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.540513039 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.540590048 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.541428089 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.541517973 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.541542053 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.541850090 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.542438030 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.542567015 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.542603970 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.542740107 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.543353081 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.543406963 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.577517986 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.869527102 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.869627953 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.870480061 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.870650053 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.870682955 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.870731115 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.871331930 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.871392012 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.871515036 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.871557951 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.872340918 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.872395039 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.872596025 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.873377085 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.873459101 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.873682976 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.874253035 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.874397993 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.874519110 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.874548912 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.874629974 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.875372887 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.875430107 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.875561953 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.875614882 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.876296043 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.876339912 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.877504110 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.877588034 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.877597094 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.879426956 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.879489899 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.880337000 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.880518913 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.880577087 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:25.881630898 CEST40404972523.105.131.171192.168.2.3
                            May 3, 2021 04:10:25.881704092 CEST497254040192.168.2.323.105.131.171
                            May 3, 2021 04:10:29.655863047 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:29.987122059 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:29.988065004 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:29.991238117 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:30.338108063 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:30.338293076 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:30.708023071 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:30.708209038 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.043282986 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.043447018 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.413105965 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.413206100 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.791016102 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.791140079 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.826256037 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.826469898 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.826493025 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.826510906 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.826565027 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.826618910 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.826832056 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.827486992 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.827555895 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.827646971 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.827800035 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.828376055 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.828445911 CEST497264040192.168.2.323.105.131.171
                            May 3, 2021 04:10:31.828535080 CEST40404972623.105.131.171192.168.2.3
                            May 3, 2021 04:10:31.828588009 CEST497264040192.168.2.323.105.131.171

                            Code Manipulations

                            Statistics

                            Behavior

                            Click to jump to process

                            System Behavior

                            Analysis Process: DHLAWB# 9284880911 pdf.exe PID: 3012 Parent PID: 5620

                            General

                            Start time:04:10:11
                            Start date:03/05/2021
                            Path:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            Wow64 process (32bit):true
                            Commandline:'C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe'
                            Imagebase:0xe30000
                            File size:791040 bytes
                            MD5 hash:72208E35AB96B53BAFFD99165D2F50CB
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.230786532.0000000004501000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.227902373.0000000003540000.00000004.00000001.sdmp, Author: Joe Security
                            Reputation:low

                            Analysis Process: schtasks.exe PID: 3468 Parent PID: 3012

                            General

                            Start time:04:10:20
                            Start date:03/05/2021
                            Path:C:\Windows\SysWOW64\schtasks.exe
                            Wow64 process (32bit):true
                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\HVLIxSqWJDWWZt' /XML 'C:\Users\user\AppData\Local\Temp\tmpF4A2.tmp'
                            Imagebase:0x190000
                            File size:185856 bytes
                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high

                            Analysis Process: conhost.exe PID: 2168 Parent PID: 3468

                            General

                            Start time:04:10:20
                            Start date:03/05/2021
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6b2800000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high

                            Analysis Process: DHLAWB# 9284880911 pdf.exe PID: 1560 Parent PID: 3012

                            General

                            Start time:04:10:21
                            Start date:03/05/2021
                            Path:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\Desktop\DHLAWB# 9284880911 pdf.exe
                            Imagebase:0xfb0000
                            File size:791040 bytes
                            MD5 hash:72208E35AB96B53BAFFD99165D2F50CB
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.483729377.0000000005B80000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                            • Rule: NanoCore, Description: unknown, Source: 00000004.00000002.472666786.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            • Rule: NanoCore, Description: unknown, Source: 00000004.00000002.481253287.000000000383B000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.484302259.00000000060B0000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: NanoCore, Description: unknown, Source: 00000004.00000002.482228223.00000000047E1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            Reputation:low

                            Disassembly

                            Code Analysis

                            Reset < >