Analysis Report ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Overview

General Information

Sample Name: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
Analysis ID: 403997
MD5: 5777362ea00ed2dd6c40121450291e7d
SHA1: 4cbdfa68ef829f9709ee74bb883985d8a18c4048
SHA256: f6f23db6c1ecdf6b5766a22434e7a9c24585ecf94cf8a784f1a15640d0f0ba45
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

DLL reload attack detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Tries to detect virtualization through RDTSC time measurements
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
PE file contains executable resources (Code or Archives)
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1hJRfPD7mATt1zd_Z0FIM8Q9qnryDNQsL"}

Compliance:

barindex
Uses 32bit PE files
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://drive.google.com/uc?export=download&id=1hJRfPD7mATt1zd_Z0FIM8Q9qnryDNQsL

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Contains functionality to call native functions
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B54FB9 NtProtectVirtualMemory, 0_2_02B54FB9
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B525DA NtAllocateVirtualMemory, 0_2_02B525DA
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B52786 NtAllocateVirtualMemory, 0_2_02B52786
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B52781 NtAllocateVirtualMemory, 0_2_02B52781
PE file contains executable resources (Code or Archives)
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Sample file is different than original file name gathered from version info
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Binary or memory string: OriginalFilenamePHILAD.exe vs ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
Uses 32bit PE files
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: classification engine Classification label: mal80.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe File created: C:\Users\user\AppData\Local\Temp\~DF6274FC7E47975599.TMP Jump to behavior
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, type: MEMORY

Hooking and other Techniques for Hiding and Protection:

barindex
DLL reload attack detected
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Module Loaded: Original DLL: "C:\USERS\user\DESKTOP\ACS ROUTE reload: AIRCRAFT COND. REQ INFORMATION & DOC00710020210501154406 PDF.EXE"
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe RDTSC instruction interceptor: First address: 0000000002B54D0E second address: 0000000002B54D0E instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp bh, bh 0x0000000f cmp dword ptr [ebx], 9090C350h 0x00000015 jne 00007F0481024659h 0x00000017 cmp edx, dword ptr [ebx] 0x00000019 jne 00007F048102464Bh 0x0000001b cmp byte ptr [ebx], FFFFFFE8h 0x0000001e jne 00007F04810246B3h 0x00000020 fnop 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007F0481024664h 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007F048102455Ch 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe RDTSC instruction interceptor: First address: 0000000002B5243D second address: 0000000002B5243D instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F04803CB82Ah 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 cmp ax, cx 0x00000024 cmp ecx, 00000000h 0x00000027 jne 00007F04803CB80Bh 0x00000029 push ecx 0x0000002a test ebx, edx 0x0000002c cmp dx, cx 0x0000002f call 00007F04803CB84Bh 0x00000034 call 00007F04803CB83Ah 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B514AA rdtsc 0_2_02B514AA
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B514AA rdtsc 0_2_02B514AA
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B51240 mov eax, dword ptr fs:[00000030h] 0_2_02B51240
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B5424A mov eax, dword ptr fs:[00000030h] 0_2_02B5424A
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B523A3 mov eax, dword ptr fs:[00000030h] 0_2_02B523A3
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B545A8 mov eax, dword ptr fs:[00000030h] 0_2_02B545A8
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B54B81 mov eax, dword ptr fs:[00000030h] 0_2_02B54B81
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B5171E mov eax, dword ptr fs:[00000030h] 0_2_02B5171E
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B51718 mov eax, dword ptr fs:[00000030h] 0_2_02B51718
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Code function: 0_2_02B54B5D mov eax, dword ptr fs:[00000030h] 0_2_02B54B5D
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Progman
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 403997 Sample: ACS route, aircraft cond. r... Startdate: 04/05/2021 Architecture: WINDOWS Score: 80 7 Found malware configuration 2->7 9 Malicious sample detected (through community Yara rule) 2->9 11 DLL reload attack detected 2->11 13 3 other signatures 2->13 5 ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe 1 2->5         started        process3
No contacted IP infos