Analysis Report SHIPPING DOCUMENT.exe

Overview

General Information

Sample Name: SHIPPING DOCUMENT.exe
Analysis ID: 404217
MD5: 25e847b9631bc2fe8d87fe4278fa142e
SHA1: 641756a84fdce68e101a53cfa6809b68190b7ad7
SHA256: 70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.knighttechinca.com/dxe/"], "decoy": ["sardarfarm.com", "959tremont.com", "privat-livecam.net", "ansel-homebakery.com", "joysupermarket.com", "peninsulamatchmakers.net", "northsytyle.com", "radioconexaoubermusic.com", "relocatingrealtor.com", "desyrnan.com", "onlinehoortoestel.online", "enpointe.online", "rvvikings.com", "paulpoirier.com", "shitarpa.net", "kerneis.net", "rokitreach.com", "essentiallygaia.com", "prestiged.net", "fuerzaagavera.com", "soukid.com", "moderndatingcoach.com", "mentalfreedom.guru", "bullishsoftware.com", "sectorulb.com", "outletyana.com", "fptplaybox.website", "artinmemory.com", "buyruon.com", "ljd.xyz", "mondaysmatters.com", "spiritsoundart.net", "ixiangzu.com", "lacompagniadelfardello.com", "bnctly.com", "sarasvati-yoga.com", "0055game.com", "lagrangewildliferemoval.com", "umlausa.com", "chaytel.com", "kkkc5.com", "union-green.com", "philreid4cc.com", "theanimehat.com", "redlightlegal.com", "myaustraliarewards.com", "barkinlot.com", "mujahidservice.online", "nugeneraonline.com", "sopplugin.com", "makemyroom.design", "ferienschweden.com", "fps2020dkasphotoop.com", "stylezbykay.com", "royalpropertiesgurugram.com", "birzulova.com", "cosmicmtn.com", "kissanime.press", "poweringprogress.today", "omsamedic.com", "drunkpoetsociety.com", "hostbison.com", "asapdecor.com", "houseofsisson.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nszA951.tmp\2x6gdfzk.dll ReversingLabs: Detection: 17%
Multi AV Scanner detection for submitted file
Source: SHIPPING DOCUMENT.exe Virustotal: Detection: 34% Perma Link
Source: SHIPPING DOCUMENT.exe ReversingLabs: Detection: 44%
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: SHIPPING DOCUMENT.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SHIPPING DOCUMENT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SHIPPING DOCUMENT.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: SHIPPING DOCUMENT.exe, 00000001.00000002.700415930.000000000080A000.00000004.00000020.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000002.926748711.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: netstat.pdb source: SHIPPING DOCUMENT.exe, 00000001.00000002.700415930.000000000080A000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbUGP source: SHIPPING DOCUMENT.exe, 00000000.00000003.656956738.0000000003270000.00000004.00000001.sdmp, SHIPPING DOCUMENT.exe, 00000001.00000002.700435688.0000000000AA0000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.916653689.00000000039BF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SHIPPING DOCUMENT.exe, NETSTAT.EXE
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000002.926748711.0000000005A00000.00000002.00000001.sdmp
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_004059F0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_0040659C FindFirstFileA,FindClose, 0_2_0040659C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_004027A1 FindFirstFileA, 0_2_004027A1

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.220.41.208:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.220.41.208:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.220.41.208:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.knighttechinca.com/dxe/
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=WjDhBMZGXEFchLZ7o6W3JT2VhJsjwIpQ+RcXbs0zm7DaFFVtu5gSyYsWe3hhttt0VKfM&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.barkinlot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=sFVJxLIQKAVd+Y7XtG7gnaG34PPCpjG6GFyGl+6CuFNb0W3+mUMXX+9XGZNJldEnuWZ9&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.buyruon.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=RbAtrmEWvlHFDlwUmkIgxTv6ob9YXkoV/NFTjoChCyM+ucvF9ABfViB5xXwNeUqJEtMU&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.fuerzaagavera.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=sOnMPkACxZJCHwFpI01WJHJoP6Rqh5hpLBOGFt1I8eGpOjOkLkuqJ1zaMIEMMNEsyDxC&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.union-green.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 64.190.62.111 64.190.62.111
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=WjDhBMZGXEFchLZ7o6W3JT2VhJsjwIpQ+RcXbs0zm7DaFFVtu5gSyYsWe3hhttt0VKfM&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.barkinlot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=sFVJxLIQKAVd+Y7XtG7gnaG34PPCpjG6GFyGl+6CuFNb0W3+mUMXX+9XGZNJldEnuWZ9&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.buyruon.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=RbAtrmEWvlHFDlwUmkIgxTv6ob9YXkoV/NFTjoChCyM+ucvF9ABfViB5xXwNeUqJEtMU&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.fuerzaagavera.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dxe/?k0GxOl=sOnMPkACxZJCHwFpI01WJHJoP6Rqh5hpLBOGFt1I8eGpOjOkLkuqJ1zaMIEMMNEsyDxC&NX1TzP=t8UH-PXh7J HTTP/1.1Host: www.union-green.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.barkinlot.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SHIPPING DOCUMENT.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SHIPPING DOCUMENT.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000002.917278405.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: NETSTAT.EXE, 00000008.00000002.917087722.00000000042BF000.00000004.00000001.sdmp String found in binary or memory: http://www.yabovip1288.com
Source: explorer.exe, 00000004.00000000.682293181.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: NETSTAT.EXE, 00000008.00000002.917087722.00000000042BF000.00000004.00000001.sdmp String found in binary or memory: https://hm.baidu.com/hm.js?2f7ed51008e649f38c9a7a932b01f7d5
Source: NETSTAT.EXE, 00000008.00000002.917087722.00000000042BF000.00000004.00000001.sdmp String found in binary or memory: https://sedo.com/search/details/?partnerid=324561&language=it&domain=fuerzaagavera.com&origin=sales_

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040548D

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Executable has a suspicious name (potential lure to open the executable)
Source: SHIPPING DOCUMENT.exe Static file information: Suspicious name
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: SHIPPING DOCUMENT.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419D60 NtCreateFile, 1_2_00419D60
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419E10 NtReadFile, 1_2_00419E10
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419E90 NtClose, 1_2_00419E90
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419F40 NtAllocateVirtualMemory, 1_2_00419F40
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419D5A NtCreateFile, 1_2_00419D5A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419E0A NtReadFile, 1_2_00419E0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419E8A NtClose, 1_2_00419E8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00419F3A NtAllocateVirtualMemory, 1_2_00419F3A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B098F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_00B098F0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00B09860
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09840 NtDelayExecution,LdrInitializeThunk, 1_2_00B09840
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B099A0 NtCreateSection,LdrInitializeThunk, 1_2_00B099A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_00B09910
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09A20 NtResumeThread,LdrInitializeThunk, 1_2_00B09A20
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_00B09A00
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09A50 NtCreateFile,LdrInitializeThunk, 1_2_00B09A50
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B095D0 NtClose,LdrInitializeThunk, 1_2_00B095D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09540 NtReadFile,LdrInitializeThunk, 1_2_00B09540
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B096E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00B096E0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00B09660
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B097A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_00B097A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09780 NtMapViewOfSection,LdrInitializeThunk, 1_2_00B09780
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09710 NtQueryInformationToken,LdrInitializeThunk, 1_2_00B09710
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B098A0 NtWriteVirtualMemory, 1_2_00B098A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09820 NtEnumerateKey, 1_2_00B09820
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0B040 NtSuspendThread, 1_2_00B0B040
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B099D0 NtCreateProcessEx, 1_2_00B099D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09950 NtQueueApcThread, 1_2_00B09950
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09A80 NtOpenDirectoryObject, 1_2_00B09A80
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09A10 NtQuerySection, 1_2_00B09A10
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0A3B0 NtGetContextThread, 1_2_00B0A3B0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09B00 NtSetValueKey, 1_2_00B09B00
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B095F0 NtQueryInformationFile, 1_2_00B095F0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0AD30 NtSetContextThread, 1_2_00B0AD30
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09520 NtWaitForSingleObject, 1_2_00B09520
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09560 NtWriteFile, 1_2_00B09560
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B096D0 NtCreateKey, 1_2_00B096D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09610 NtEnumerateValueKey, 1_2_00B09610
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09670 NtQueryInformationProcess, 1_2_00B09670
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09650 NtQueryValueKey, 1_2_00B09650
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09FE0 NtCreateMutant, 1_2_00B09FE0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09730 NtQueryVirtualMemory, 1_2_00B09730
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0A710 NtOpenProcessToken, 1_2_00B0A710
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09770 NtSetInformationFile, 1_2_00B09770
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0A770 NtOpenThread, 1_2_00B0A770
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B09760 NtOpenProcess, 1_2_00B09760
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_00419D60 NtCreateFile, 1_1_00419D60
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_00419E10 NtReadFile, 1_1_00419E10
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_00419E90 NtClose, 1_1_00419E90
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_00419F40 NtAllocateVirtualMemory, 1_1_00419F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909780 NtMapViewOfSection,LdrInitializeThunk, 8_2_03909780
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909FE0 NtCreateMutant,LdrInitializeThunk, 8_2_03909FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909710 NtQueryInformationToken,LdrInitializeThunk, 8_2_03909710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039096D0 NtCreateKey,LdrInitializeThunk, 8_2_039096D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039096E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_039096E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909650 NtQueryValueKey,LdrInitializeThunk, 8_2_03909650
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909A50 NtCreateFile,LdrInitializeThunk, 8_2_03909A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909660 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_03909660
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039099A0 NtCreateSection,LdrInitializeThunk, 8_2_039099A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039095D0 NtClose,LdrInitializeThunk, 8_2_039095D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_03909910
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909540 NtReadFile,LdrInitializeThunk, 8_2_03909540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909840 NtDelayExecution,LdrInitializeThunk, 8_2_03909840
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_03909860
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390A3B0 NtGetContextThread, 8_2_0390A3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039097A0 NtUnmapViewOfSection, 8_2_039097A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390A710 NtOpenProcessToken, 8_2_0390A710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909B00 NtSetValueKey, 8_2_03909B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909730 NtQueryVirtualMemory, 8_2_03909730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909770 NtSetInformationFile, 8_2_03909770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390A770 NtOpenThread, 8_2_0390A770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909760 NtOpenProcess, 8_2_03909760
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909A80 NtOpenDirectoryObject, 8_2_03909A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909610 NtEnumerateValueKey, 8_2_03909610
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909A10 NtQuerySection, 8_2_03909A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909A00 NtProtectVirtualMemory, 8_2_03909A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909A20 NtResumeThread, 8_2_03909A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909670 NtQueryInformationProcess, 8_2_03909670
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039099D0 NtCreateProcessEx, 8_2_039099D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039095F0 NtQueryInformationFile, 8_2_039095F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390AD30 NtSetContextThread, 8_2_0390AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909520 NtWaitForSingleObject, 8_2_03909520
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909950 NtQueueApcThread, 8_2_03909950
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909560 NtWriteFile, 8_2_03909560
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039098A0 NtWriteVirtualMemory, 8_2_039098A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039098F0 NtReadVirtualMemory, 8_2_039098F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03909820 NtEnumerateKey, 8_2_03909820
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390B040 NtSuspendThread, 8_2_0390B040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9E90 NtClose, 8_2_02DD9E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9E10 NtReadFile, 8_2_02DD9E10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9F40 NtAllocateVirtualMemory, 8_2_02DD9F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9D60 NtCreateFile, 8_2_02DD9D60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9E8A NtClose, 8_2_02DD9E8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9E0A NtReadFile, 8_2_02DD9E0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9F3A NtAllocateVirtualMemory, 8_2_02DD9F3A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DD9D5A NtCreateFile, 8_2_02DD9D5A
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461
Detected potential crypto function
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_00406925 0_2_00406925
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041E1FC 1_2_0041E1FC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041D260 1_2_0041D260
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041DA2A 1_2_0041DA2A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041BDC4 1_2_0041BDC4
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00409E40 1_2_00409E40
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00409E3C 1_2_00409E3C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041D6DF 1_2_0041D6DF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041DFA3 1_2_0041DFA3
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B920A8 1_2_00B920A8
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADB090 1_2_00ADB090
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81002 1_2_00B81002
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACF900 1_2_00ACF900
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B922AE 1_2_00B922AE
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFEBB0 1_2_00AFEBB0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8DBD2 1_2_00B8DBD2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B92B28 1_2_00B92B28
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD841F 1_2_00AD841F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2581 1_2_00AF2581
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADD5E0 1_2_00ADD5E0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC0D20 1_2_00AC0D20
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B92D07 1_2_00B92D07
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B91D55 1_2_00B91D55
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B92EF7 1_2_00B92EF7
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE6E30 1_2_00AE6E30
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B91FF1 1_2_00B91FF1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_00401030 1_1_00401030
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_0041E1FC 1_1_0041E1FC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_0041D260 1_1_0041D260
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_1_0041DA2A 1_1_0041DA2A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FEBB0 8_2_038FEBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398DBD2 8_2_0398DBD2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03991FF1 8_2_03991FF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03992B28 8_2_03992B28
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039922AE 8_2_039922AE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03992EF7 8_2_03992EF7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E6E30 8_2_038E6E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2581 8_2_038F2581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DD5E0 8_2_038DD5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CF900 8_2_038CF900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03992D07 8_2_03992D07
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C0D20 8_2_038C0D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03991D55 8_2_03991D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DB090 8_2_038DB090
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039920A8 8_2_039920A8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D841F 8_2_038D841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981002 8_2_03981002
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDE1FC 8_2_02DDE1FC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DC9E40 8_2_02DC9E40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DC9E3C 8_2_02DC9E3C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DC2FB0 8_2_02DC2FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDDFA3 8_2_02DDDFA3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDBDC4 8_2_02DDBDC4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DC2D90 8_2_02DC2D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 038CB150 appears 35 times
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: String function: 00ACB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: SHIPPING DOCUMENT.exe, 00000000.00000003.653383612.000000000338F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOCUMENT.exe
Source: SHIPPING DOCUMENT.exe, 00000001.00000002.700777505.0000000000D4F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOCUMENT.exe
Source: SHIPPING DOCUMENT.exe, 00000001.00000002.700415930.000000000080A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamenetstat.exej% vs SHIPPING DOCUMENT.exe
Uses 32bit PE files
Source: SHIPPING DOCUMENT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/4@4/5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_0040473E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar, 0_2_0040216B
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe File created: C:\Users\user\AppData\Local\Temp\nseA920.tmp Jump to behavior
Source: SHIPPING DOCUMENT.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SHIPPING DOCUMENT.exe Virustotal: Detection: 34%
Source: SHIPPING DOCUMENT.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe File read: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe'
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process created: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autofmt.exe C:\Windows\SysWOW64\autofmt.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process created: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe' Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe' Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: SHIPPING DOCUMENT.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: SHIPPING DOCUMENT.exe, 00000001.00000002.700415930.000000000080A000.00000004.00000020.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000002.926748711.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: netstat.pdb source: SHIPPING DOCUMENT.exe, 00000001.00000002.700415930.000000000080A000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbUGP source: SHIPPING DOCUMENT.exe, 00000000.00000003.656956738.0000000003270000.00000004.00000001.sdmp, SHIPPING DOCUMENT.exe, 00000001.00000002.700435688.0000000000AA0000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.916653689.00000000039BF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SHIPPING DOCUMENT.exe, NETSTAT.EXE
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000002.926748711.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Unpacked PE file: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041E560 push ss; ret 1_2_0041E569
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041CEB5 push eax; ret 1_2_0041CF08
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041CF6C push eax; ret 1_2_0041CF72
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041CF02 push eax; ret 1_2_0041CF08
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0041CF0B push eax; ret 1_2_0041CF72
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B1D0D1 push ecx; ret 1_2_00B1D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0391D0D1 push ecx; ret 8_2_0391D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDCEB5 push eax; ret 8_2_02DDCF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDCF6C push eax; ret 8_2_02DDCF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDCF0B push eax; ret 8_2_02DDCF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDCF02 push eax; ret 8_2_02DDCF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_02DDE560 push ss; ret 8_2_02DDE569

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe File created: C:\Users\user\AppData\Local\Temp\nszA951.tmp\2x6gdfzk.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xE6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000002DC98E4 second address: 0000000002DC98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000002DC9B5E second address: 0000000002DC9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 5192 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5192 Thread sleep time: -76000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 6944 Thread sleep time: -70000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_004059F0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_0040659C FindFirstFileA,FindClose, 0_2_0040659C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_004027A1 FindFirstFileA, 0_2_004027A1
Source: explorer.exe, 00000004.00000000.675794110.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.680284032.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.926975780.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.680284032.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.924340020.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000000.675794110.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.680444387.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000000.675794110.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.680488183.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000000.675794110.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_0040ACD0 LdrLoadDll, 1_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_10001000 mov eax, dword ptr fs:[00000030h] 0_2_10001000
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_022B182F mov eax, dword ptr fs:[00000030h] 0_2_022B182F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_022B1617 mov eax, dword ptr fs:[00000030h] 0_2_022B1617
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF20A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF20A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFF0BF mov ecx, dword ptr fs:[00000030h] 1_2_00AFF0BF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFF0BF mov eax, dword ptr fs:[00000030h] 1_2_00AFF0BF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFF0BF mov eax, dword ptr fs:[00000030h] 1_2_00AFF0BF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B090AF mov eax, dword ptr fs:[00000030h] 1_2_00B090AF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9080 mov eax, dword ptr fs:[00000030h] 1_2_00AC9080
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B43884 mov eax, dword ptr fs:[00000030h] 1_2_00B43884
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B43884 mov eax, dword ptr fs:[00000030h] 1_2_00B43884
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC58EC mov eax, dword ptr fs:[00000030h] 1_2_00AC58EC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B5B8D0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF002D mov eax, dword ptr fs:[00000030h] 1_2_00AF002D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF002D mov eax, dword ptr fs:[00000030h] 1_2_00AF002D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF002D mov eax, dword ptr fs:[00000030h] 1_2_00AF002D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF002D mov eax, dword ptr fs:[00000030h] 1_2_00AF002D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF002D mov eax, dword ptr fs:[00000030h] 1_2_00AF002D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADB02A mov eax, dword ptr fs:[00000030h] 1_2_00ADB02A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADB02A mov eax, dword ptr fs:[00000030h] 1_2_00ADB02A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADB02A mov eax, dword ptr fs:[00000030h] 1_2_00ADB02A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADB02A mov eax, dword ptr fs:[00000030h] 1_2_00ADB02A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47016 mov eax, dword ptr fs:[00000030h] 1_2_00B47016
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47016 mov eax, dword ptr fs:[00000030h] 1_2_00B47016
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47016 mov eax, dword ptr fs:[00000030h] 1_2_00B47016
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B94015 mov eax, dword ptr fs:[00000030h] 1_2_00B94015
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B94015 mov eax, dword ptr fs:[00000030h] 1_2_00B94015
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B82073 mov eax, dword ptr fs:[00000030h] 1_2_00B82073
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B91074 mov eax, dword ptr fs:[00000030h] 1_2_00B91074
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE0050 mov eax, dword ptr fs:[00000030h] 1_2_00AE0050
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE0050 mov eax, dword ptr fs:[00000030h] 1_2_00AE0050
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B451BE mov eax, dword ptr fs:[00000030h] 1_2_00B451BE
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B451BE mov eax, dword ptr fs:[00000030h] 1_2_00B451BE
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B451BE mov eax, dword ptr fs:[00000030h] 1_2_00B451BE
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B451BE mov eax, dword ptr fs:[00000030h] 1_2_00B451BE
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF61A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF61A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF61A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF61A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B469A6 mov eax, dword ptr fs:[00000030h] 1_2_00B469A6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA185 mov eax, dword ptr fs:[00000030h] 1_2_00AFA185
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEC182 mov eax, dword ptr fs:[00000030h] 1_2_00AEC182
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2990 mov eax, dword ptr fs:[00000030h] 1_2_00AF2990
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00ACB1E1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00ACB1E1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00ACB1E1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B541E8 mov eax, dword ptr fs:[00000030h] 1_2_00B541E8
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 mov eax, dword ptr fs:[00000030h] 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 mov eax, dword ptr fs:[00000030h] 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 mov eax, dword ptr fs:[00000030h] 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 mov eax, dword ptr fs:[00000030h] 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE4120 mov ecx, dword ptr fs:[00000030h] 1_2_00AE4120
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF513A mov eax, dword ptr fs:[00000030h] 1_2_00AF513A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF513A mov eax, dword ptr fs:[00000030h] 1_2_00AF513A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9100 mov eax, dword ptr fs:[00000030h] 1_2_00AC9100
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9100 mov eax, dword ptr fs:[00000030h] 1_2_00AC9100
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9100 mov eax, dword ptr fs:[00000030h] 1_2_00AC9100
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACC962 mov eax, dword ptr fs:[00000030h] 1_2_00ACC962
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACB171 mov eax, dword ptr fs:[00000030h] 1_2_00ACB171
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACB171 mov eax, dword ptr fs:[00000030h] 1_2_00ACB171
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEB944 mov eax, dword ptr fs:[00000030h] 1_2_00AEB944
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEB944 mov eax, dword ptr fs:[00000030h] 1_2_00AEB944
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AC52A5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AC52A5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AC52A5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AC52A5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AC52A5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADAAB0 mov eax, dword ptr fs:[00000030h] 1_2_00ADAAB0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADAAB0 mov eax, dword ptr fs:[00000030h] 1_2_00ADAAB0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFFAB0 mov eax, dword ptr fs:[00000030h] 1_2_00AFFAB0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFD294 mov eax, dword ptr fs:[00000030h] 1_2_00AFD294
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFD294 mov eax, dword ptr fs:[00000030h] 1_2_00AFD294
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2AE4 mov eax, dword ptr fs:[00000030h] 1_2_00AF2AE4
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2ACB mov eax, dword ptr fs:[00000030h] 1_2_00AF2ACB
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B04A2C mov eax, dword ptr fs:[00000030h] 1_2_00B04A2C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B04A2C mov eax, dword ptr fs:[00000030h] 1_2_00B04A2C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD8A0A mov eax, dword ptr fs:[00000030h] 1_2_00AD8A0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE3A1C mov eax, dword ptr fs:[00000030h] 1_2_00AE3A1C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACAA16 mov eax, dword ptr fs:[00000030h] 1_2_00ACAA16
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACAA16 mov eax, dword ptr fs:[00000030h] 1_2_00ACAA16
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC5210 mov eax, dword ptr fs:[00000030h] 1_2_00AC5210
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC5210 mov ecx, dword ptr fs:[00000030h] 1_2_00AC5210
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC5210 mov eax, dword ptr fs:[00000030h] 1_2_00AC5210
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC5210 mov eax, dword ptr fs:[00000030h] 1_2_00AC5210
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B0927A mov eax, dword ptr fs:[00000030h] 1_2_00B0927A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B7B260 mov eax, dword ptr fs:[00000030h] 1_2_00B7B260
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B7B260 mov eax, dword ptr fs:[00000030h] 1_2_00B7B260
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98A62 mov eax, dword ptr fs:[00000030h] 1_2_00B98A62
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B54257 mov eax, dword ptr fs:[00000030h] 1_2_00B54257
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9240 mov eax, dword ptr fs:[00000030h] 1_2_00AC9240
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9240 mov eax, dword ptr fs:[00000030h] 1_2_00AC9240
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9240 mov eax, dword ptr fs:[00000030h] 1_2_00AC9240
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC9240 mov eax, dword ptr fs:[00000030h] 1_2_00AC9240
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8EA55 mov eax, dword ptr fs:[00000030h] 1_2_00B8EA55
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4BAD mov eax, dword ptr fs:[00000030h] 1_2_00AF4BAD
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4BAD mov eax, dword ptr fs:[00000030h] 1_2_00AF4BAD
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4BAD mov eax, dword ptr fs:[00000030h] 1_2_00AF4BAD
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B95BA5 mov eax, dword ptr fs:[00000030h] 1_2_00B95BA5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD1B8F mov eax, dword ptr fs:[00000030h] 1_2_00AD1B8F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD1B8F mov eax, dword ptr fs:[00000030h] 1_2_00AD1B8F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8138A mov eax, dword ptr fs:[00000030h] 1_2_00B8138A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B7D380 mov ecx, dword ptr fs:[00000030h] 1_2_00B7D380
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2397 mov eax, dword ptr fs:[00000030h] 1_2_00AF2397
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFB390 mov eax, dword ptr fs:[00000030h] 1_2_00AFB390
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEDBE9 mov eax, dword ptr fs:[00000030h] 1_2_00AEDBE9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF03E2 mov eax, dword ptr fs:[00000030h] 1_2_00AF03E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B453CA mov eax, dword ptr fs:[00000030h] 1_2_00B453CA
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B453CA mov eax, dword ptr fs:[00000030h] 1_2_00B453CA
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8131B mov eax, dword ptr fs:[00000030h] 1_2_00B8131B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACDB60 mov ecx, dword ptr fs:[00000030h] 1_2_00ACDB60
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF3B7A mov eax, dword ptr fs:[00000030h] 1_2_00AF3B7A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF3B7A mov eax, dword ptr fs:[00000030h] 1_2_00AF3B7A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98B58 mov eax, dword ptr fs:[00000030h] 1_2_00B98B58
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACDB40 mov eax, dword ptr fs:[00000030h] 1_2_00ACDB40
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACF358 mov eax, dword ptr fs:[00000030h] 1_2_00ACF358
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD849B mov eax, dword ptr fs:[00000030h] 1_2_00AD849B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B814FB mov eax, dword ptr fs:[00000030h] 1_2_00B814FB
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46CF0 mov eax, dword ptr fs:[00000030h] 1_2_00B46CF0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46CF0 mov eax, dword ptr fs:[00000030h] 1_2_00B46CF0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46CF0 mov eax, dword ptr fs:[00000030h] 1_2_00B46CF0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98CD6 mov eax, dword ptr fs:[00000030h] 1_2_00B98CD6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFBC2C mov eax, dword ptr fs:[00000030h] 1_2_00AFBC2C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B9740D mov eax, dword ptr fs:[00000030h] 1_2_00B9740D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B9740D mov eax, dword ptr fs:[00000030h] 1_2_00B9740D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B9740D mov eax, dword ptr fs:[00000030h] 1_2_00B9740D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81C06 mov eax, dword ptr fs:[00000030h] 1_2_00B81C06
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46C0A mov eax, dword ptr fs:[00000030h] 1_2_00B46C0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46C0A mov eax, dword ptr fs:[00000030h] 1_2_00B46C0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46C0A mov eax, dword ptr fs:[00000030h] 1_2_00B46C0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46C0A mov eax, dword ptr fs:[00000030h] 1_2_00B46C0A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE746D mov eax, dword ptr fs:[00000030h] 1_2_00AE746D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA44B mov eax, dword ptr fs:[00000030h] 1_2_00AFA44B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5C450 mov eax, dword ptr fs:[00000030h] 1_2_00B5C450
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5C450 mov eax, dword ptr fs:[00000030h] 1_2_00B5C450
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF35A1 mov eax, dword ptr fs:[00000030h] 1_2_00AF35A1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B905AC mov eax, dword ptr fs:[00000030h] 1_2_00B905AC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B905AC mov eax, dword ptr fs:[00000030h] 1_2_00B905AC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF1DB5 mov eax, dword ptr fs:[00000030h] 1_2_00AF1DB5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF1DB5 mov eax, dword ptr fs:[00000030h] 1_2_00AF1DB5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF1DB5 mov eax, dword ptr fs:[00000030h] 1_2_00AF1DB5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC2D8A mov eax, dword ptr fs:[00000030h] 1_2_00AC2D8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC2D8A mov eax, dword ptr fs:[00000030h] 1_2_00AC2D8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC2D8A mov eax, dword ptr fs:[00000030h] 1_2_00AC2D8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC2D8A mov eax, dword ptr fs:[00000030h] 1_2_00AC2D8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC2D8A mov eax, dword ptr fs:[00000030h] 1_2_00AC2D8A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2581 mov eax, dword ptr fs:[00000030h] 1_2_00AF2581
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2581 mov eax, dword ptr fs:[00000030h] 1_2_00AF2581
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2581 mov eax, dword ptr fs:[00000030h] 1_2_00AF2581
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF2581 mov eax, dword ptr fs:[00000030h] 1_2_00AF2581
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFFD9B mov eax, dword ptr fs:[00000030h] 1_2_00AFFD9B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFFD9B mov eax, dword ptr fs:[00000030h] 1_2_00AFFD9B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B78DF1 mov eax, dword ptr fs:[00000030h] 1_2_00B78DF1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADD5E0 mov eax, dword ptr fs:[00000030h] 1_2_00ADD5E0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADD5E0 mov eax, dword ptr fs:[00000030h] 1_2_00ADD5E0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00B8FDE2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00B8FDE2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00B8FDE2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00B8FDE2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov eax, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov eax, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov eax, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov ecx, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov eax, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B46DC9 mov eax, dword ptr fs:[00000030h] 1_2_00B46DC9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8E539 mov eax, dword ptr fs:[00000030h] 1_2_00B8E539
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B4A537 mov eax, dword ptr fs:[00000030h] 1_2_00B4A537
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98D34 mov eax, dword ptr fs:[00000030h] 1_2_00B98D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4D3B mov eax, dword ptr fs:[00000030h] 1_2_00AF4D3B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4D3B mov eax, dword ptr fs:[00000030h] 1_2_00AF4D3B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF4D3B mov eax, dword ptr fs:[00000030h] 1_2_00AF4D3B
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD3D34 mov eax, dword ptr fs:[00000030h] 1_2_00AD3D34
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACAD30 mov eax, dword ptr fs:[00000030h] 1_2_00ACAD30
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEC577 mov eax, dword ptr fs:[00000030h] 1_2_00AEC577
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEC577 mov eax, dword ptr fs:[00000030h] 1_2_00AEC577
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B03D43 mov eax, dword ptr fs:[00000030h] 1_2_00B03D43
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B43540 mov eax, dword ptr fs:[00000030h] 1_2_00B43540
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AE7D50 mov eax, dword ptr fs:[00000030h] 1_2_00AE7D50
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B446A7 mov eax, dword ptr fs:[00000030h] 1_2_00B446A7
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B90EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B90EA5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B90EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B90EA5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B90EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B90EA5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5FE87 mov eax, dword ptr fs:[00000030h] 1_2_00B5FE87
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF16E0 mov ecx, dword ptr fs:[00000030h] 1_2_00AF16E0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD76E2 mov eax, dword ptr fs:[00000030h] 1_2_00AD76E2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF36CC mov eax, dword ptr fs:[00000030h] 1_2_00AF36CC
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98ED6 mov eax, dword ptr fs:[00000030h] 1_2_00B98ED6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B7FEC0 mov eax, dword ptr fs:[00000030h] 1_2_00B7FEC0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B08EC7 mov eax, dword ptr fs:[00000030h] 1_2_00B08EC7
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B7FE3F mov eax, dword ptr fs:[00000030h] 1_2_00B7FE3F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACE620 mov eax, dword ptr fs:[00000030h] 1_2_00ACE620
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACC600 mov eax, dword ptr fs:[00000030h] 1_2_00ACC600
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACC600 mov eax, dword ptr fs:[00000030h] 1_2_00ACC600
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ACC600 mov eax, dword ptr fs:[00000030h] 1_2_00ACC600
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AF8E00 mov eax, dword ptr fs:[00000030h] 1_2_00AF8E00
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B81608 mov eax, dword ptr fs:[00000030h] 1_2_00B81608
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA61C mov eax, dword ptr fs:[00000030h] 1_2_00AFA61C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA61C mov eax, dword ptr fs:[00000030h] 1_2_00AFA61C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD766D mov eax, dword ptr fs:[00000030h] 1_2_00AD766D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEAE73 mov eax, dword ptr fs:[00000030h] 1_2_00AEAE73
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEAE73 mov eax, dword ptr fs:[00000030h] 1_2_00AEAE73
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEAE73 mov eax, dword ptr fs:[00000030h] 1_2_00AEAE73
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEAE73 mov eax, dword ptr fs:[00000030h] 1_2_00AEAE73
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEAE73 mov eax, dword ptr fs:[00000030h] 1_2_00AEAE73
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD7E41 mov eax, dword ptr fs:[00000030h] 1_2_00AD7E41
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8AE44 mov eax, dword ptr fs:[00000030h] 1_2_00B8AE44
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B8AE44 mov eax, dword ptr fs:[00000030h] 1_2_00B8AE44
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47794 mov eax, dword ptr fs:[00000030h] 1_2_00B47794
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47794 mov eax, dword ptr fs:[00000030h] 1_2_00B47794
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B47794 mov eax, dword ptr fs:[00000030h] 1_2_00B47794
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AD8794 mov eax, dword ptr fs:[00000030h] 1_2_00AD8794
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B037F5 mov eax, dword ptr fs:[00000030h] 1_2_00B037F5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC4F2E mov eax, dword ptr fs:[00000030h] 1_2_00AC4F2E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AC4F2E mov eax, dword ptr fs:[00000030h] 1_2_00AC4F2E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFE730 mov eax, dword ptr fs:[00000030h] 1_2_00AFE730
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA70E mov eax, dword ptr fs:[00000030h] 1_2_00AFA70E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AFA70E mov eax, dword ptr fs:[00000030h] 1_2_00AFA70E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5FF10 mov eax, dword ptr fs:[00000030h] 1_2_00B5FF10
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B5FF10 mov eax, dword ptr fs:[00000030h] 1_2_00B5FF10
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B9070D mov eax, dword ptr fs:[00000030h] 1_2_00B9070D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B9070D mov eax, dword ptr fs:[00000030h] 1_2_00B9070D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00AEF716 mov eax, dword ptr fs:[00000030h] 1_2_00AEF716
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADFF60 mov eax, dword ptr fs:[00000030h] 1_2_00ADFF60
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00B98F6A mov eax, dword ptr fs:[00000030h] 1_2_00B98F6A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 1_2_00ADEF40 mov eax, dword ptr fs:[00000030h] 1_2_00ADEF40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947794 mov eax, dword ptr fs:[00000030h] 8_2_03947794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947794 mov eax, dword ptr fs:[00000030h] 8_2_03947794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947794 mov eax, dword ptr fs:[00000030h] 8_2_03947794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D1B8F mov eax, dword ptr fs:[00000030h] 8_2_038D1B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D1B8F mov eax, dword ptr fs:[00000030h] 8_2_038D1B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398138A mov eax, dword ptr fs:[00000030h] 8_2_0398138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0397D380 mov ecx, dword ptr fs:[00000030h] 8_2_0397D380
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2397 mov eax, dword ptr fs:[00000030h] 8_2_038F2397
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D8794 mov eax, dword ptr fs:[00000030h] 8_2_038D8794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FB390 mov eax, dword ptr fs:[00000030h] 8_2_038FB390
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4BAD mov eax, dword ptr fs:[00000030h] 8_2_038F4BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4BAD mov eax, dword ptr fs:[00000030h] 8_2_038F4BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4BAD mov eax, dword ptr fs:[00000030h] 8_2_038F4BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03995BA5 mov eax, dword ptr fs:[00000030h] 8_2_03995BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039453CA mov eax, dword ptr fs:[00000030h] 8_2_039453CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039453CA mov eax, dword ptr fs:[00000030h] 8_2_039453CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039037F5 mov eax, dword ptr fs:[00000030h] 8_2_039037F5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EDBE9 mov eax, dword ptr fs:[00000030h] 8_2_038EDBE9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F03E2 mov eax, dword ptr fs:[00000030h] 8_2_038F03E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FA70E mov eax, dword ptr fs:[00000030h] 8_2_038FA70E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FA70E mov eax, dword ptr fs:[00000030h] 8_2_038FA70E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398131B mov eax, dword ptr fs:[00000030h] 8_2_0398131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395FF10 mov eax, dword ptr fs:[00000030h] 8_2_0395FF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395FF10 mov eax, dword ptr fs:[00000030h] 8_2_0395FF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0399070D mov eax, dword ptr fs:[00000030h] 8_2_0399070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0399070D mov eax, dword ptr fs:[00000030h] 8_2_0399070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EF716 mov eax, dword ptr fs:[00000030h] 8_2_038EF716
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C4F2E mov eax, dword ptr fs:[00000030h] 8_2_038C4F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C4F2E mov eax, dword ptr fs:[00000030h] 8_2_038C4F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FE730 mov eax, dword ptr fs:[00000030h] 8_2_038FE730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998B58 mov eax, dword ptr fs:[00000030h] 8_2_03998B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CDB40 mov eax, dword ptr fs:[00000030h] 8_2_038CDB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DEF40 mov eax, dword ptr fs:[00000030h] 8_2_038DEF40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CF358 mov eax, dword ptr fs:[00000030h] 8_2_038CF358
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CDB60 mov ecx, dword ptr fs:[00000030h] 8_2_038CDB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DFF60 mov eax, dword ptr fs:[00000030h] 8_2_038DFF60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998F6A mov eax, dword ptr fs:[00000030h] 8_2_03998F6A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F3B7A mov eax, dword ptr fs:[00000030h] 8_2_038F3B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F3B7A mov eax, dword ptr fs:[00000030h] 8_2_038F3B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395FE87 mov eax, dword ptr fs:[00000030h] 8_2_0395FE87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FD294 mov eax, dword ptr fs:[00000030h] 8_2_038FD294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FD294 mov eax, dword ptr fs:[00000030h] 8_2_038FD294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C52A5 mov eax, dword ptr fs:[00000030h] 8_2_038C52A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C52A5 mov eax, dword ptr fs:[00000030h] 8_2_038C52A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C52A5 mov eax, dword ptr fs:[00000030h] 8_2_038C52A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C52A5 mov eax, dword ptr fs:[00000030h] 8_2_038C52A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C52A5 mov eax, dword ptr fs:[00000030h] 8_2_038C52A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039446A7 mov eax, dword ptr fs:[00000030h] 8_2_039446A7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03990EA5 mov eax, dword ptr fs:[00000030h] 8_2_03990EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03990EA5 mov eax, dword ptr fs:[00000030h] 8_2_03990EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03990EA5 mov eax, dword ptr fs:[00000030h] 8_2_03990EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DAAB0 mov eax, dword ptr fs:[00000030h] 8_2_038DAAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DAAB0 mov eax, dword ptr fs:[00000030h] 8_2_038DAAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FFAB0 mov eax, dword ptr fs:[00000030h] 8_2_038FFAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F36CC mov eax, dword ptr fs:[00000030h] 8_2_038F36CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2ACB mov eax, dword ptr fs:[00000030h] 8_2_038F2ACB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998ED6 mov eax, dword ptr fs:[00000030h] 8_2_03998ED6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0397FEC0 mov eax, dword ptr fs:[00000030h] 8_2_0397FEC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03908EC7 mov eax, dword ptr fs:[00000030h] 8_2_03908EC7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2AE4 mov eax, dword ptr fs:[00000030h] 8_2_038F2AE4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F16E0 mov ecx, dword ptr fs:[00000030h] 8_2_038F16E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D76E2 mov eax, dword ptr fs:[00000030h] 8_2_038D76E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D8A0A mov eax, dword ptr fs:[00000030h] 8_2_038D8A0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CC600 mov eax, dword ptr fs:[00000030h] 8_2_038CC600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CC600 mov eax, dword ptr fs:[00000030h] 8_2_038CC600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CC600 mov eax, dword ptr fs:[00000030h] 8_2_038CC600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F8E00 mov eax, dword ptr fs:[00000030h] 8_2_038F8E00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981608 mov eax, dword ptr fs:[00000030h] 8_2_03981608
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E3A1C mov eax, dword ptr fs:[00000030h] 8_2_038E3A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FA61C mov eax, dword ptr fs:[00000030h] 8_2_038FA61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FA61C mov eax, dword ptr fs:[00000030h] 8_2_038FA61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CAA16 mov eax, dword ptr fs:[00000030h] 8_2_038CAA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CAA16 mov eax, dword ptr fs:[00000030h] 8_2_038CAA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C5210 mov eax, dword ptr fs:[00000030h] 8_2_038C5210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C5210 mov ecx, dword ptr fs:[00000030h] 8_2_038C5210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C5210 mov eax, dword ptr fs:[00000030h] 8_2_038C5210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C5210 mov eax, dword ptr fs:[00000030h] 8_2_038C5210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0397FE3F mov eax, dword ptr fs:[00000030h] 8_2_0397FE3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CE620 mov eax, dword ptr fs:[00000030h] 8_2_038CE620
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03904A2C mov eax, dword ptr fs:[00000030h] 8_2_03904A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03904A2C mov eax, dword ptr fs:[00000030h] 8_2_03904A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03954257 mov eax, dword ptr fs:[00000030h] 8_2_03954257
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9240 mov eax, dword ptr fs:[00000030h] 8_2_038C9240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9240 mov eax, dword ptr fs:[00000030h] 8_2_038C9240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9240 mov eax, dword ptr fs:[00000030h] 8_2_038C9240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9240 mov eax, dword ptr fs:[00000030h] 8_2_038C9240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D7E41 mov eax, dword ptr fs:[00000030h] 8_2_038D7E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398EA55 mov eax, dword ptr fs:[00000030h] 8_2_0398EA55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398AE44 mov eax, dword ptr fs:[00000030h] 8_2_0398AE44
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398AE44 mov eax, dword ptr fs:[00000030h] 8_2_0398AE44
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D766D mov eax, dword ptr fs:[00000030h] 8_2_038D766D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0390927A mov eax, dword ptr fs:[00000030h] 8_2_0390927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0397B260 mov eax, dword ptr fs:[00000030h] 8_2_0397B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0397B260 mov eax, dword ptr fs:[00000030h] 8_2_0397B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998A62 mov eax, dword ptr fs:[00000030h] 8_2_03998A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EAE73 mov eax, dword ptr fs:[00000030h] 8_2_038EAE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EAE73 mov eax, dword ptr fs:[00000030h] 8_2_038EAE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EAE73 mov eax, dword ptr fs:[00000030h] 8_2_038EAE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EAE73 mov eax, dword ptr fs:[00000030h] 8_2_038EAE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EAE73 mov eax, dword ptr fs:[00000030h] 8_2_038EAE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C2D8A mov eax, dword ptr fs:[00000030h] 8_2_038C2D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C2D8A mov eax, dword ptr fs:[00000030h] 8_2_038C2D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C2D8A mov eax, dword ptr fs:[00000030h] 8_2_038C2D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C2D8A mov eax, dword ptr fs:[00000030h] 8_2_038C2D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C2D8A mov eax, dword ptr fs:[00000030h] 8_2_038C2D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FA185 mov eax, dword ptr fs:[00000030h] 8_2_038FA185
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EC182 mov eax, dword ptr fs:[00000030h] 8_2_038EC182
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2581 mov eax, dword ptr fs:[00000030h] 8_2_038F2581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2581 mov eax, dword ptr fs:[00000030h] 8_2_038F2581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2581 mov eax, dword ptr fs:[00000030h] 8_2_038F2581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2581 mov eax, dword ptr fs:[00000030h] 8_2_038F2581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FFD9B mov eax, dword ptr fs:[00000030h] 8_2_038FFD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FFD9B mov eax, dword ptr fs:[00000030h] 8_2_038FFD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F2990 mov eax, dword ptr fs:[00000030h] 8_2_038F2990
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039451BE mov eax, dword ptr fs:[00000030h] 8_2_039451BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039451BE mov eax, dword ptr fs:[00000030h] 8_2_039451BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039451BE mov eax, dword ptr fs:[00000030h] 8_2_039451BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039451BE mov eax, dword ptr fs:[00000030h] 8_2_039451BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F35A1 mov eax, dword ptr fs:[00000030h] 8_2_038F35A1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F61A0 mov eax, dword ptr fs:[00000030h] 8_2_038F61A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F61A0 mov eax, dword ptr fs:[00000030h] 8_2_038F61A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039469A6 mov eax, dword ptr fs:[00000030h] 8_2_039469A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039905AC mov eax, dword ptr fs:[00000030h] 8_2_039905AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039905AC mov eax, dword ptr fs:[00000030h] 8_2_039905AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F1DB5 mov eax, dword ptr fs:[00000030h] 8_2_038F1DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F1DB5 mov eax, dword ptr fs:[00000030h] 8_2_038F1DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F1DB5 mov eax, dword ptr fs:[00000030h] 8_2_038F1DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov eax, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov eax, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov eax, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov ecx, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov eax, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946DC9 mov eax, dword ptr fs:[00000030h] 8_2_03946DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03978DF1 mov eax, dword ptr fs:[00000030h] 8_2_03978DF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_038CB1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_038CB1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_038CB1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DD5E0 mov eax, dword ptr fs:[00000030h] 8_2_038DD5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038DD5E0 mov eax, dword ptr fs:[00000030h] 8_2_038DD5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398FDE2 mov eax, dword ptr fs:[00000030h] 8_2_0398FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398FDE2 mov eax, dword ptr fs:[00000030h] 8_2_0398FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398FDE2 mov eax, dword ptr fs:[00000030h] 8_2_0398FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398FDE2 mov eax, dword ptr fs:[00000030h] 8_2_0398FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039541E8 mov eax, dword ptr fs:[00000030h] 8_2_039541E8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9100 mov eax, dword ptr fs:[00000030h] 8_2_038C9100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9100 mov eax, dword ptr fs:[00000030h] 8_2_038C9100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9100 mov eax, dword ptr fs:[00000030h] 8_2_038C9100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0398E539 mov eax, dword ptr fs:[00000030h] 8_2_0398E539
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0394A537 mov eax, dword ptr fs:[00000030h] 8_2_0394A537
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998D34 mov eax, dword ptr fs:[00000030h] 8_2_03998D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 mov eax, dword ptr fs:[00000030h] 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 mov eax, dword ptr fs:[00000030h] 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 mov eax, dword ptr fs:[00000030h] 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 mov eax, dword ptr fs:[00000030h] 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E4120 mov ecx, dword ptr fs:[00000030h] 8_2_038E4120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4D3B mov eax, dword ptr fs:[00000030h] 8_2_038F4D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4D3B mov eax, dword ptr fs:[00000030h] 8_2_038F4D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F4D3B mov eax, dword ptr fs:[00000030h] 8_2_038F4D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F513A mov eax, dword ptr fs:[00000030h] 8_2_038F513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F513A mov eax, dword ptr fs:[00000030h] 8_2_038F513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D3D34 mov eax, dword ptr fs:[00000030h] 8_2_038D3D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CAD30 mov eax, dword ptr fs:[00000030h] 8_2_038CAD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EB944 mov eax, dword ptr fs:[00000030h] 8_2_038EB944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EB944 mov eax, dword ptr fs:[00000030h] 8_2_038EB944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03903D43 mov eax, dword ptr fs:[00000030h] 8_2_03903D43
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03943540 mov eax, dword ptr fs:[00000030h] 8_2_03943540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038E7D50 mov eax, dword ptr fs:[00000030h] 8_2_038E7D50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CC962 mov eax, dword ptr fs:[00000030h] 8_2_038CC962
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EC577 mov eax, dword ptr fs:[00000030h] 8_2_038EC577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038EC577 mov eax, dword ptr fs:[00000030h] 8_2_038EC577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CB171 mov eax, dword ptr fs:[00000030h] 8_2_038CB171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038CB171 mov eax, dword ptr fs:[00000030h] 8_2_038CB171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C9080 mov eax, dword ptr fs:[00000030h] 8_2_038C9080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03943884 mov eax, dword ptr fs:[00000030h] 8_2_03943884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03943884 mov eax, dword ptr fs:[00000030h] 8_2_03943884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038D849B mov eax, dword ptr fs:[00000030h] 8_2_038D849B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038F20A0 mov eax, dword ptr fs:[00000030h] 8_2_038F20A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FF0BF mov ecx, dword ptr fs:[00000030h] 8_2_038FF0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FF0BF mov eax, dword ptr fs:[00000030h] 8_2_038FF0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038FF0BF mov eax, dword ptr fs:[00000030h] 8_2_038FF0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039090AF mov eax, dword ptr fs:[00000030h] 8_2_039090AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov ecx, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0395B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0395B8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03998CD6 mov eax, dword ptr fs:[00000030h] 8_2_03998CD6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_038C58EC mov eax, dword ptr fs:[00000030h] 8_2_038C58EC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_039814FB mov eax, dword ptr fs:[00000030h] 8_2_039814FB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946CF0 mov eax, dword ptr fs:[00000030h] 8_2_03946CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946CF0 mov eax, dword ptr fs:[00000030h] 8_2_03946CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03946CF0 mov eax, dword ptr fs:[00000030h] 8_2_03946CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947016 mov eax, dword ptr fs:[00000030h] 8_2_03947016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947016 mov eax, dword ptr fs:[00000030h] 8_2_03947016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03947016 mov eax, dword ptr fs:[00000030h] 8_2_03947016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03994015 mov eax, dword ptr fs:[00000030h] 8_2_03994015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03994015 mov eax, dword ptr fs:[00000030h] 8_2_03994015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0399740D mov eax, dword ptr fs:[00000030h] 8_2_0399740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0399740D mov eax, dword ptr fs:[00000030h] 8_2_0399740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0399740D mov eax, dword ptr fs:[00000030h] 8_2_0399740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981C06 mov eax, dword ptr fs:[00000030h] 8_2_03981C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981C06 mov eax, dword ptr fs:[00000030h] 8_2_03981C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981C06 mov eax, dword ptr fs:[00000030h] 8_2_03981C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981C06 mov eax, dword ptr fs:[00000030h] 8_2_03981C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_03981C06 mov eax, dword ptr fs:[00000030h] 8_2_03981C06
Enables debug privileges
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_100014EE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_100014EE

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.barkinlot.com
Source: C:\Windows\explorer.exe Domain query: www.buyruon.com
Source: C:\Windows\explorer.exe Network Connect: 107.151.79.234 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.union-green.com
Source: C:\Windows\explorer.exe Network Connect: 154.220.41.208 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.fuerzaagavera.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.62.111 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Section loaded: unknown target: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: D60000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Process created: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe' Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SHIPPING DOCUMENT.exe' Jump to behavior
Source: explorer.exe, 00000004.00000000.662030709.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000002.916246710.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.917173995.0000000004B30000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.916246710.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.917173995.0000000004B30000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.916246710.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.917173995.0000000004B30000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.916246710.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.917173995.0000000004B30000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.680444387.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Desktop\SHIPPING DOCUMENT.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.661322620.00000000023D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700344342.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915966424.0000000003210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700119931.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915737678.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.915997507.0000000003240000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.656834932.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.700254188.00000000005A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SHIPPING DOCUMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.SHIPPING DOCUMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPPING DOCUMENT.exe.23d0000.3.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404217 Sample: SHIPPING DOCUMENT.exe Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 10 other signatures 2->44 10 SHIPPING DOCUMENT.exe 19 2->10         started        process3 file4 30 C:\Users\user\AppData\Local\...\2x6gdfzk.dll, PE32 10->30 dropped 56 Maps a DLL or memory area into another process 10->56 14 SHIPPING DOCUMENT.exe 10->14         started        signatures5 process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 17 explorer.exe 14->17 injected process8 dnsIp9 32 www.barkinlot.com 107.151.79.234, 49754, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK United States 17->32 34 www.union-green.com 154.220.41.208, 49766, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 17->34 36 4 other IPs or domains 17->36 46 System process connects to network (likely due to code injection or exploit) 17->46 48 Uses netstat to query active network connections and open ports 17->48 21 NETSTAT.EXE 17->21         started        24 autofmt.exe 17->24         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 21->50 52 Maps a DLL or memory area into another process 21->52 54 Tries to detect virtualization through RDTSC time measurements 21->54 26 cmd.exe 1 21->26         started        process13 process14 28 conhost.exe 26->28         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
107.151.79.234
 www.barkinlot.com United States
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK true
154.220.41.208
 www.union-green.com Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK true
34.102.136.180
 buyruon.com United States
15169 GOOGLEUS false
64.190.62.111
 www.fuerzaagavera.com United States
11696 NBS11696US true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
www.barkinlot.com 107.151.79.234 true
www.union-green.com 154.220.41.208 true
www.fuerzaagavera.com 64.190.62.111 true
buyruon.com 34.102.136.180 true
www.buyruon.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.union-green.com/dxe/?k0GxOl=sOnMPkACxZJCHwFpI01WJHJoP6Rqh5hpLBOGFt1I8eGpOjOkLkuqJ1zaMIEMMNEsyDxC&NX1TzP=t8UH-PXh7J true
  • Avira URL Cloud: safe
 unknown
www.knighttechinca.com/dxe/ true
  • Avira URL Cloud: safe
 low
http://www.fuerzaagavera.com/dxe/?k0GxOl=RbAtrmEWvlHFDlwUmkIgxTv6ob9YXkoV/NFTjoChCyM+ucvF9ABfViB5xXwNeUqJEtMU&NX1TzP=t8UH-PXh7J true
  • Avira URL Cloud: safe
 unknown
http://www.barkinlot.com/dxe/?k0GxOl=WjDhBMZGXEFchLZ7o6W3JT2VhJsjwIpQ+RcXbs0zm7DaFFVtu5gSyYsWe3hhttt0VKfM&NX1TzP=t8UH-PXh7J true
  • Avira URL Cloud: safe
 unknown
http://www.buyruon.com/dxe/?k0GxOl=sFVJxLIQKAVd+Y7XtG7gnaG34PPCpjG6GFyGl+6CuFNb0W3+mUMXX+9XGZNJldEnuWZ9&NX1TzP=t8UH-PXh7J false
  • Avira URL Cloud: safe
 unknown