Play interactive tour

Edit tour

Analysis Report ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Overview

General Information

Sample Name:	ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
Analysis ID:	403997
MD5:	5777362ea00ed2dd6c40121450291e7d
SHA1:	4cbdfa68ef829f9709ee74bb883985d8a18c4048
SHA256:	f6f23db6c1ecdf6b5766a22434e7a9c24585ecf94cf8a784f1a15640d0f0ba45
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

DLL reload attack detected

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Startup

System is w10x64

ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe (PID: 4744 cmdline: 'C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe' MD5: 5777362EA00ED2DD6C40121450291E7D)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1hJRfPD7mATt1zd_Z0FIM8Q9qnryDNQsL"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x110c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x110c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1hJRfPD7mATt1zd_Z0FIM8Q9qnryDNQsL"}

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1hJRfPD7mATt1zd_Z0FIM8Q9qnryDNQsL

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B54FB9 NtProtectVirtualMemory,	0_2_02B54FB9
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B525DA NtAllocateVirtualMemory,	0_2_02B525DA
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B52786 NtAllocateVirtualMemory,	0_2_02B52786
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B52781 NtAllocateVirtualMemory,	0_2_02B52781

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Binary or memory string: OriginalFilenamePHILAD.exe vs ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal80.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

File created: C:\Users\user\AppData\Local\Temp\~DF6274FC7E47975599.TMP

Jump to behavior

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, type: MEMORY

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Module Loaded: Original DLL: "C:\USERS\user\DESKTOP\ACS ROUTE reload: AIRCRAFT COND. REQ INFORMATION & DOC00710020210501154406 PDF.EXE"

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	RDTSC instruction interceptor: First address: 0000000002B54D0E second address: 0000000002B54D0E instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp bh, bh 0x0000000f cmp dword ptr [ebx], 9090C350h 0x00000015 jne 00007F0481024659h 0x00000017 cmp edx, dword ptr [ebx] 0x00000019 jne 00007F048102464Bh 0x0000001b cmp byte ptr [ebx], FFFFFFE8h 0x0000001e jne 00007F04810246B3h 0x00000020 fnop 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007F0481024664h 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007F048102455Ch 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	RDTSC instruction interceptor: First address: 0000000002B5243D second address: 0000000002B5243D instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F04803CB82Ah 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 cmp ax, cx 0x00000024 cmp ecx, 00000000h 0x00000027 jne 00007F04803CB80Bh 0x00000029 push ecx 0x0000002a test ebx, edx 0x0000002c cmp dx, cx 0x0000002f call 00007F04803CB84Bh 0x00000034 call 00007F04803CB83Ah 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Code function: 0_2_02B514AA rdtsc

0_2_02B514AA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Code function: 0_2_02B514AA rdtsc

0_2_02B514AA

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B51240 mov eax, dword ptr fs:[00000030h]	0_2_02B51240
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B5424A mov eax, dword ptr fs:[00000030h]	0_2_02B5424A
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B523A3 mov eax, dword ptr fs:[00000030h]	0_2_02B523A3
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B545A8 mov eax, dword ptr fs:[00000030h]	0_2_02B545A8
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B54B81 mov eax, dword ptr fs:[00000030h]	0_2_02B54B81
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B5171E mov eax, dword ptr fs:[00000030h]	0_2_02B5171E
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B51718 mov eax, dword ptr fs:[00000030h]	0_2_02B51718
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Code function: 0_2_02B54B5D mov eax, dword ptr fs:[00000030h]	0_2_02B54B5D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe, 00000000.00000002.1286359625.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection1	Process Injection1	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Application Layer Protocol1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	DLL Side-Loading1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	System Information Discovery111	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	403997
Start date:	04.05.2021
Start time:	16:05:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 9
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.777529017205276
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
File size:	98304
MD5:	5777362ea00ed2dd6c40121450291e7d
SHA1:	4cbdfa68ef829f9709ee74bb883985d8a18c4048
SHA256:	f6f23db6c1ecdf6b5766a22434e7a9c24585ecf94cf8a784f1a15640d0f0ba45
SHA512:	b040be11572cb05338212e73492d475211f24c79be94486ada0a5d4438d436bd24e92479d001531dcb6f56045a6901ab5526c72b9dee968e24f8e4a0380d4014
SSDEEP:	1536:OR02SmQFaUvIZddDGaz24YxUzAoma3vx:OnrsaXdZG1409ovJ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L......W.................P... ......\|........`....@................

File Icon


Icon Hash:	b074cecec891b2e4

Static PE Info

General
Entrypoint:	0x40157c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5711B91D [Sat Apr 16 04:01:33 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	631ffe9ad0b821781f48149fabda62f6

Entrypoint Preview

Instruction
push 0040CA8Ch
call 00007F0480BA7975h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov dh, 80h
leave
leave
retf
salc
clc
dec edi
call far 49E6h : 708BCD81h
fild word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+edx*2+72h], bl
outsd
push 00000065h
outsb
popad
outsb
jnc 00007F0480BA7983h
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
sub byte ptr [esi+0B9DFADDh], ah
sal edx, 1
dec ecx
stosb
sub eax, 8D5E5938h
jnle 00007F0480BA79F7h
aad 85h
and cl, ch
mov ecx, AA4E556Bh
test eax, 87B2E630h
or dword ptr [edx], esp
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov dh, B3h
add byte ptr [eax], al
push esp
add al, byte ptr [eax]
add byte ptr [eax], al
or dword ptr [eax], eax
jbe 00007F0480BA79EBh
outsb
imul esp, dword ptr [ebp+74h], 73h
jc 00007F0480BA79E3h
add byte ptr [6B000901h], cl
outsd
push 0000006Fh
insd
jc 00007983h
sbb dword ptr [ecx], eax
add byte ptr [edx+00h], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14ed4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x5a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x10c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14350	0x15000	False	0.341331845238	data	5.21336422112	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0xad4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x5a4	0x1000	False	0.182861328125	data	1.71064501623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x173bc	0x1e8	data
RT_GROUP_ICON	0x173a8	0x14	data
RT_VERSION	0x170f0	0x2b8	COM executable for DOS	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	PHILAD
FileVersion	1.00
CompanyName	Mummys Technology
Comments	Mummys Technology
ProductName	Mummys Technology
ProductVersion	1.00
FileDescription	Mummys Technology
OriginalFilename	PHILAD.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe PID: 4744 Parent PID: 5584

General

Start time:	16:06:39
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	5777362EA00ED2DD6C40121450291E7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Author: Joe Security Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000000.204937287.000000000040C000.00000020.00020000.sdmp, Author: Florian Roth Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000002.1285251776.000000000040C000.00000020.00020000.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe PID: 4744 Parent PID: 5584 ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exeCOMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20%
Total number of Nodes:	942
Total number of Limit Nodes:	4

Executed Functions

Function 02B525DA, Relevance: 1.7, APIs: 1, Instructions: 152
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02B528CB

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 399f7699cf36733d005ec124c2e6e395befdbf9a491652bfce04e9cf8dca7bc0
Instruction ID: 0bb28b5095a0b7eca5e9e7864e1344b46edaff8d831aa892abebe23bb5a144aa
Opcode Fuzzy Hash: 399f7699cf36733d005ec124c2e6e395befdbf9a491652bfce04e9cf8dca7bc0
Instruction Fuzzy Hash: 5D41CC716813669FEB31AF349C913DE3BA6EF05360F0042ADEEC59F290D3318582CA41

Uniqueness

Uniqueness Score: -1.00%

Function 02B52786, Relevance: 1.6, APIs: 1, Instructions: 141
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02B528CB

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e7644686d25694e0bbdff18bd1e17de2b8e08f955ce6c00e09d6bb5038ab35c3
Instruction ID: 1832fcd17aeb31cfbfe20d54b845970bafc56de6886436d51ffa468d2f77478e
Opcode Fuzzy Hash: e7644686d25694e0bbdff18bd1e17de2b8e08f955ce6c00e09d6bb5038ab35c3
Instruction Fuzzy Hash: C04129B1EE2652ABC7157F7DCD847C8A7B0DB122F8F501E489C84C60DDFA32854189C2

Uniqueness

Uniqueness Score: -1.00%

Function 02B52781, Relevance: 1.6, APIs: 1, Instructions: 105
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02B528CB

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: a675018ef2b27f9688b9228763929cb7c5e2636616a8a975fb7a57613f676909
Instruction ID: eae198876a59c10779c909ad912a418912579ecae81b72883d73874be4a1ec4a
Opcode Fuzzy Hash: a675018ef2b27f9688b9228763929cb7c5e2636616a8a975fb7a57613f676909
Instruction Fuzzy Hash: 3731047168135A8FEF319E29CD953EA37A5FF19394F00022CDECC9F2A1D77186428A45

Uniqueness

Uniqueness Score: -1.00%

Function 02B54FB9, Relevance: 1.5, APIs: 1, Instructions: 13
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,02B54C66,00000040,02B51BD3,00000000,00000000,00000000,00000000,?,00000000,00000000,02B50C17), ref: 02B54FD2

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B51240, Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]b\%, xrefs: 02B516FE

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID: ]b\%
API String ID: 0-242929970
Opcode ID: ff6632604b554e41972b65d5ad00e6b0585ec8c6f22492fc699b3914cc6e6638
Instruction ID: c6d70464c2822850f6a07c1894e1ba35764e416186846e06f7e71bf82ac1f939
Opcode Fuzzy Hash: ff6632604b554e41972b65d5ad00e6b0585ec8c6f22492fc699b3914cc6e6638
Instruction Fuzzy Hash: 2EC1F371B40612AFE7158F6CCC80BD5B7A5FF09350F588269EC9D9B341DB74A894CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02B514AA, Relevance: 1.4, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]b\%, xrefs: 02B516FE

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID: ]b\%
API String ID: 0-242929970
Opcode ID: de48f65cde0c1425678f286ea6866e5fb248543b46b458ffdc1e3db9472d326a
Instruction ID: 7cb20a949ffc227eabf66bd6e5333063646e293a092625b09030e1e005ff751c
Opcode Fuzzy Hash: de48f65cde0c1425678f286ea6866e5fb248543b46b458ffdc1e3db9472d326a
Instruction Fuzzy Hash: B941CF71710621AFE7298F6CD880BD5B7E1FF09314F1942A9EC9A8B241D770A4A0CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02B54B5D, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 069f4125af3b150a609e6c6b47cb1ea172f89d7226d52e4e6ec6ef7567a849a6
Instruction ID: 6a155339f536daed87011f1021d5f7e91822cb11eaadca69a5f026fd0de81adb
Opcode Fuzzy Hash: 069f4125af3b150a609e6c6b47cb1ea172f89d7226d52e4e6ec6ef7567a849a6
Instruction Fuzzy Hash: 1681B7309043529EDF25CF6888D8759BBA1DF52220F8982D9DD964F2DAD374C4C2CB22

Uniqueness

Uniqueness Score: -1.00%

Function 02B54B81, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 992cdabfe074e8bb68658b779f49b5baab664c6c60b6c1b42ab53a5a97053b44
Instruction ID: 34f476d9497621b073e0428b692e6b7bb7edd4d89e4a4b49cee76cb710bbe284
Opcode Fuzzy Hash: 992cdabfe074e8bb68658b779f49b5baab664c6c60b6c1b42ab53a5a97053b44
Instruction Fuzzy Hash: 816106A0D957919EC715BF7CC884B44BBB0DB132B4F559AC8DC81CE1EEE7328482C692

Uniqueness

Uniqueness Score: -1.00%

Function 02B5171E, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f047778c2409c10ab79fd327a4547c3d0678de00af208ce4fc75a3aaffc1b8b
Instruction ID: 16303ca88d724b1523f0651ac1f31beed65577b7cd2e9a5a962c4bf3d9420c2d
Opcode Fuzzy Hash: 7f047778c2409c10ab79fd327a4547c3d0678de00af208ce4fc75a3aaffc1b8b
Instruction Fuzzy Hash: 1231A7717516129FE7699A2CCC41FD5B3A5FF16360F294264ECA8D7381CB24E8458F90

Uniqueness

Uniqueness Score: -1.00%

Function 02B51718, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca404faf1a08457176fefff12d32de86b736ee4eac6ef069ee2b43422a6da2e
Instruction ID: bf32405052fb8ac15f5caad7d563469e828c85288fd4d7a1fead454b911b175e
Opcode Fuzzy Hash: 4ca404faf1a08457176fefff12d32de86b736ee4eac6ef069ee2b43422a6da2e
Instruction Fuzzy Hash: 0E21A671751612AFEB689A2CCC51FD573A9FF163A0F194268ACACE7340CB24E8458F90

Uniqueness

Uniqueness Score: -1.00%

Function 02B545A8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3bed536e9d5b9729bd0f4ef7681b47f2a9b0a224c9cb6dcbcd2edbfe610167
Instruction ID: 8be8d4d28b360f48250783d035e5fd59914487399f7c8c15a77143dc5f22217b
Opcode Fuzzy Hash: 8c3bed536e9d5b9729bd0f4ef7681b47f2a9b0a224c9cb6dcbcd2edbfe610167
Instruction Fuzzy Hash: A00121743126119FD316CE08C5D0FA673A3EF5A3A0F14C2E9ED098F792C324D880C610

Uniqueness

Uniqueness Score: -1.00%

Function 02B523A3, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 02B5424A, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290771999.0000000002B50000.00000040.00000001.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_ACS route, aircraft cond.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9e4579068190dac8ef8ac1960053ed5fd427d736587ae53f358c09f68e7aaf
Instruction ID: cce9544411941f64f0f767466af53e2866201443a72ef878ed7f567b35b338c0
Opcode Fuzzy Hash: 3f9e4579068190dac8ef8ac1960053ed5fd427d736587ae53f358c09f68e7aaf
Instruction Fuzzy Hash: F3B00135762A80DFCE96CF19D694F80B3B4FB59B90F4299D5E8119BB22D368E901CA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe PID: 4744 Parent PID: 5584

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exe PID: 4744 Parent PID: 5584 ACS route, aircraft cond. req information & doc00710020210501154406 PDF.exeCOMMON

Execution Graph

Function 02B525DA, Relevance: 1.7, APIs: 1, Instructions: 152
memorynativeCOMMON

Function 02B52786, Relevance: 1.6, APIs: 1, Instructions: 141
memorynativeCOMMON

Function 02B52781, Relevance: 1.6, APIs: 1, Instructions: 105
memorynativeCOMMON

Function 02B54FB9, Relevance: 1.5, APIs: 1, Instructions: 13
nativeCOMMON

Function 02B51240, Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Function 02B514AA, Relevance: 1.4, Strings: 1, Instructions: 116
COMMON