Play interactive tour

Edit tour

Analysis Report PRODUCT INQUIRY FROM PAKISTAN.exe

Overview

General Information

Sample Name:	PRODUCT INQUIRY FROM PAKISTAN.exe
Analysis ID:	412582
MD5:	6efee5c2282e20bafb495451512c5ca7
SHA1:	72d3a5bac34e50b19f4df7ae42f37a950e099e5c
SHA256:	860b99eb4a09674fe70d72bb997b2cf38bfc62eb2794a13d623048d5f5b422d2
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Moves itself to temp directory

PE file contains section with special chars

PE file has nameless sections

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

PRODUCT INQUIRY FROM PAKISTAN.exe (PID: 5448 cmdline: 'C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe' MD5: 6EFEE5C2282E20BAFB495451512C5CA7)

PRODUCT INQUIRY FROM PAKISTAN.exe (PID: 5388 cmdline: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe MD5: 6EFEE5C2282E20BAFB495451512C5CA7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "staffs@globaloffs-site.comyLxCDRZ2smtp.globaloffs-site.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "staffs@globaloffs-site.comyLxCDRZ2smtp.globaloffs-site.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Show sources

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Joe Sandbox ML: detected

Source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_02301718
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_023016D1
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_04946F14
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	0_2_0494A948

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49745 -> 208.91.199.224:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49747 -> 208.91.199.224:587

Source: global traffic

TCP traffic: 192.168.2.7:49745 -> 208.91.199.224:587

Source: Joe Sandbox View

IP Address: 208.91.199.224 208.91.199.224

Source: global traffic

TCP traffic: 192.168.2.7:49745 -> 208.91.199.224:587

Source: unknown

DNS traffic detected: queries for: smtp.globaloffs-site.com

Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	String found in binary or memory: http://JNlaBk.com
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260056773.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/1
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlc
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509320661.0000000003196000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.globaloffs-site.com
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509320661.0000000003196000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509013136.0000000003173000.00000004.00000001.sdmp	String found in binary or memory: https://EYpwltTomgBW7.com
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Code function: 4_2_01402298 SetWindowsHookExW 0000000D,00000000,?,?

4_2_01402298

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bD0CA83C3u002dCCA5u002d4062u002d9A1Bu002dC29FC48DF1CFu007d/u00306410806u002d82E0u002d47FAu002d9891u002dEAFE176D2EB8.cs

Large array initialization: .cctor: array initializer size 12004

PE file contains section with special chars

Show sources

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: section name: tOdw-f5

PE file has nameless sections

Show sources

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02303690	0_2_02303690
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_0230B288	0_2_0230B288
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02309FD0	0_2_02309FD0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02302CC0	0_2_02302CC0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02300538	0_2_02300538
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02302520	0_2_02302520
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02304578	0_2_02304578
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02304A08	0_2_02304A08
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_0230A2A8	0_2_0230A2A8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02303680	0_2_02303680
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_023066C0	0_2_023066C0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02306B50	0_2_02306B50
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02305431	0_2_02305431
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02306010	0_2_02306010
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02302478	0_2_02302478
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02305440	0_2_02305440
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_0230A8B0	0_2_0230A8B0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02302CB2	0_2_02302CB2
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02307898	0_2_02307898
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02304489	0_2_02304489
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_023068F8	0_2_023068F8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_023068E8	0_2_023068E8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02306D30	0_2_02306D30
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02306D20	0_2_02306D20
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_0230052A	0_2_0230052A
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02303158	0_2_02303158
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02301948	0_2_02301948
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02303149	0_2_02303149
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04949261	0_2_04949261
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04945628	0_2_04945628
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04948030	0_2_04948030
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D59C70	0_2_04D59C70
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D57DDF	0_2_04D57DDF
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55560	0_2_04D55560
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55E68	0_2_04D55E68
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D50054	0_2_04D50054
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D589D0	0_2_04D589D0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55948	0_2_04D55948
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5D298	0_2_04D5D298
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D59260	0_2_04D59260
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55230	0_2_04D55230
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D533B0	0_2_04D533B0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5CC80	0_2_04D5CC80
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5CC70	0_2_04D5CC70
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55551	0_2_04D55551
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5CE91	0_2_04D5CE91
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5CEA0	0_2_04D5CEA0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D57E51	0_2_04D57E51
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55E5B	0_2_04D55E5B
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5C630	0_2_04D5C630
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5C621	0_2_04D5C621
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D55768	0_2_04D55768
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5D098	0_2_04D5D098
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D5D0A8	0_2_04D5D0A8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04D589BB	0_2_04D589BB
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE51B2	4_2_00BE51B2
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012BC768	4_2_012BC768
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012B5B90	4_2_012B5B90
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012BDA80	4_2_012BDA80
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012B1ECC	4_2_012B1ECC
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012BA70E	4_2_012BA70E
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012BA770	4_2_012BA770
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_012B82D0	4_2_012B82D0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_0140D100	4_2_0140D100
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_0140C118	4_2_0140C118
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_014016E8	4_2_014016E8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_014B5DC0	4_2_014B5DC0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_014B64F8	4_2_014B64F8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_014B57C8	4_2_014B57C8

Source: PRODUCT INQUIRY FROM PAKISTAN.exe	Binary or memory string: OriginalFilename vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameJHVjKDQvYAZPEyzIeFpCtBkAAvzUHgJsmkgBHOT.exe4 vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000000.236066521.00000000000D4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSecuritySafeCriticalAttribute.exeF vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.263702136.0000000004D40000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.263578015.0000000004B60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe	Binary or memory string: OriginalFilename vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.504490816.00000000013C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.504513606.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.502045027.0000000000BE4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSecuritySafeCriticalAttribute.exeF vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.502149730.0000000000F88000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.503860354.00000000012C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameJHVjKDQvYAZPEyzIeFpCtBkAAvzUHgJsmkgBHOT.exe4 vs PRODUCT INQUIRY FROM PAKISTAN.exe
Source: PRODUCT INQUIRY FROM PAKISTAN.exe	Binary or memory string: OriginalFilenameSecuritySafeCriticalAttribute.exeF vs PRODUCT INQUIRY FROM PAKISTAN.exe

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: Section: tOdw-f5 ZLIB complexity 1.00031854085

Source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@4/1

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRODUCT INQUIRY FROM PAKISTAN.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

File read: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe 'C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe'
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process created: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process created: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PRODUCT INQUIRY FROM PAKISTAN.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Unpacked PE file: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.10000.0.unpack tOdw-f5:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: PRODUCT INQUIRY FROM PAKISTAN.exe	Static PE information: section name: tOdw-f5
Source: PRODUCT INQUIRY FROM PAKISTAN.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_000BFFC1 push eax; retf	0_2_000BFFC8
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_02308615 push eax; retf	0_2_02308617
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_0230861F push eax; retf	0_2_02308621
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 0_2_04949E98 push 9C0234C3h; ret	0_2_04949EA1
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE76B0 push cs; retf	4_2_00BE76F0
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7A9A push ss; retf	4_2_00BE7A9E
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7698 push cs; retf	4_2_00BE76AE
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7BF6 push ds; retf	4_2_00BE7BFA
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE73E6 push cs; retf	4_2_00BE7672
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7BE4 push ds; retf	4_2_00BE7BF4
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7BD2 push ds; retf	4_2_00BE7BD6
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_00BE7662 push cs; retf	4_2_00BE7672
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Code function: 4_2_014BB5E7 push edi; retn 0000h	4_2_014BB5E9

Source: initial sample

Static PE information: section name: tOdw-f5 entropy: 7.99978655824

Hooking and other Techniques for Hiding and Protection:

Moves itself to temp directory

Show sources

Source: c:\users\user\desktop\product inquiry from pakistan.exe

File moved: C:\Users\user\AppData\Local\Temp\tmpG454.tmp

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Window / User API: threadDelayed 5021			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Window / User API: threadDelayed 4757			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe TID: 6008	Thread sleep time: -102666s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe TID: 5836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe TID: 5820	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe TID: 5836	Thread sleep count: 5021 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe TID: 5836	Thread sleep count: 4757 > 30	Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Thread delayed: delay time: 102666	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.512303470.0000000006CE0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Code function: 0_2_02301718 CheckRemoteDebuggerPresent,

0_2_02301718

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Code function: 4_2_012B8D68 LdrInitializeThunk,

4_2_012B8D68

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Memory written: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Process created: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Jump to behavior

Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505018943.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505018943.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505018943.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505018943.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448, type: MEMORY
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448, type: MEMORY
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.35d0eb0.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	System Information Discovery114	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	Input Capture21	Query Registry1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Credentials in Registry1	Security Software Discovery321	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing13	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading11	LSA Secrets	Virtualization/Sandbox Evasion141	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion141	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PRODUCT INQUIRY FROM PAKISTAN.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
PRODUCT INQUIRY FROM PAKISTAN.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.PRODUCT INQUIRY FROM PAKISTAN.exe.10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
4.2.PRODUCT INQUIRY FROM PAKISTAN.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://JNlaBk.com	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Virustotal		Browse
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://EYpwltTomgBW7.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://smtp.globaloffs-site.com	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.html	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.htmlc	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/report/reporter_index.php?name=	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/1	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://servermanager.miixit.org/downloads/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.199.224	true	false		high
smtp.globaloffs-site.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://JNlaBk.com	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://EYpwltTomgBW7.com	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509013136.0000000003173000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509320661.0000000003196000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://smtp.globaloffs-site.com	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.509320661.0000000003196000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/index_ru.html	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/index_ru.htmlc	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/report/reporter_index.php?name=	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/1	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260056773.0000000002970000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, PRODUCT INQUIRY FROM PAKISTAN.exe, 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp	false		high
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/downloads/	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=	PRODUCT INQUIRY FROM PAKISTAN.exe, 00000000.00000003.248868610.0000000002DFB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.199.224	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412582
Start date:	12.05.2021
Start time:	19:43:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PRODUCT INQUIRY FROM PAKISTAN.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@4/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.4% (good quality ratio 0.7%) Quality average: 30.2% Quality standard deviation: 36.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 121 Number of non-executed functions: 28
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 92.122.145.220, 52.255.188.83, 13.88.21.125, 184.30.24.56, 20.82.209.183, 92.122.213.194, 92.122.213.247, 2.20.142.209, 2.20.143.16, 20.50.102.62, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:44:14	API Interceptor	760x Sleep call for process: PRODUCT INQUIRY FROM PAKISTAN.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.199.224	SecuriteInfo.com.Malware.AI.4228845530.13946.exe	Get hash	malicious	Browse
	PDF.9066721066.exe	Get hash	malicious	Browse
	Payment Advice Note from 10.05.2021 to 608760.exe	Get hash	malicious	Browse
	Quotation..exe	Get hash	malicious	Browse
	Quotation.exe	Get hash	malicious	Browse
	QUOTATION ORDER.exe	Get hash	malicious	Browse
	Request Sample products.exe	Get hash	malicious	Browse
	Quotation RFQ8116300.exe	Get hash	malicious	Browse
	New Enquiry 200567.exe	Get hash	malicious	Browse
	7UKtv01ZdPSbdAD.exe	Get hash	malicious	Browse
	Order Confirmation.exe	Get hash	malicious	Browse
	Swift Copy.xlsx	Get hash	malicious	Browse
	LM Approved Invoices 06052021.doc	Get hash	malicious	Browse
	ADVICE84857584489393.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	1STyZQU31dWqcMq.exe	Get hash	malicious	Browse
	1g1NLI6i33.exe	Get hash	malicious	Browse
	PO.xlsx	Get hash	malicious	Browse
	Purchase Orde.pdf.exe	Get hash	malicious	Browse
	LM Approved Invoice-03-05-2021.doc	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	tLes2JdtRw.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Malware.AI.4228845530.13946.exe	Get hash	malicious	Browse	208.91.199.224
	presupuesto.xlsx	Get hash	malicious	Browse	208.91.199.225
	shipping docs and BL_pdf.exe	Get hash	malicious	Browse	208.91.198.143
	PDF.9066721066.exe	Get hash	malicious	Browse	208.91.199.224
	Payment Advice Note from 10.05.2021 to 608760.exe	Get hash	malicious	Browse	208.91.199.224
	RFQ-20283H.exe	Get hash	malicious	Browse	208.91.198.143
	BTC-2021.exe	Get hash	malicious	Browse	208.91.199.225
	Copia de pago.exe	Get hash	malicious	Browse	208.91.199.225
	NEW PI#001890576.exe	Get hash	malicious	Browse	208.91.199.223
	PO 4500379537.exe	Get hash	malicious	Browse	208.91.199.225
	B5Cg5YZIzp.exe	Get hash	malicious	Browse	208.91.199.223
	PO 2345566 hisob-faktura.exe	Get hash	malicious	Browse	208.91.198.143
	Quotation..exe	Get hash	malicious	Browse	208.91.199.223
	RFQ-Quotation..exe	Get hash	malicious	Browse	208.91.198.143
	Quotation.exe	Get hash	malicious	Browse	208.91.199.224
	QUOTATION ORDER.exe	Get hash	malicious	Browse	208.91.199.224
	purchase order.exe	Get hash	malicious	Browse	208.91.199.223
	RFQ_SGCCUP_24 590 34 532 -11052021.exe	Get hash	malicious	Browse	208.91.198.143
	Request Sample products.exe	Get hash	malicious	Browse	208.91.198.143

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	tLes2JdtRw.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Malware.AI.4228845530.13946.exe	Get hash	malicious	Browse	208.91.199.224
	Letter of Demand.doc	Get hash	malicious	Browse	103.21.59.173
	7b4NmGxyY2.exe	Get hash	malicious	Browse	162.215.241.145
	catalog-1908475637.xls	Get hash	malicious	Browse	199.79.62.12
	catalog-1908475637.xls	Get hash	malicious	Browse	199.79.62.12
	INV74321.exe	Get hash	malicious	Browse	119.18.54.126
	NAVTECO_R1_10_05_2021,pdf.exe	Get hash	malicious	Browse	116.206.104.92
	#10052021.exe	Get hash	malicious	Browse	116.206.104.66
	shipping docs and BL_pdf.exe	Get hash	malicious	Browse	208.91.198.143
	PDF.9066721066.exe	Get hash	malicious	Browse	208.91.199.224
	Payment Advice Note from 10.05.2021 to 608760.exe	Get hash	malicious	Browse	208.91.199.224
	551f47ac_by_Libranalysis.xlsm	Get hash	malicious	Browse	162.222.225.153
	551f47ac_by_Libranalysis.xlsm	Get hash	malicious	Browse	162.222.225.153
	export of document 555091.xlsm	Get hash	malicious	Browse	103.21.58.29
	RFQ-20283H.exe	Get hash	malicious	Browse	208.91.198.143
	BTC-2021.exe	Get hash	malicious	Browse	208.91.199.225
	invoice 85046.xlsm	Get hash	malicious	Browse	103.21.58.29
	copy of invoice 4347.xlsm	Get hash	malicious	Browse	103.21.58.29
	Copia de pago.exe	Get hash	malicious	Browse	208.91.199.225

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRODUCT INQUIRY FROM PAKISTAN.exe.log Download File
Process:	C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:ML9E4Ks2f84jE4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MxHKXfvjHKx1qHiYHKhQnoPtHoxHhAHR
MD5:	8198C64CE0786EABD4C792E7E6FC30E5
SHA1:	71E1676126F4616B18C751A0A775B2D64944A15A
SHA-256:	C58018934011086A883D1D56B21F6C1916B1CD83206ADD1865C9BDD29DADCBC4
SHA-512:	EE293C0F88A12AB10041F66DDFAE89BC11AB3B3AAD8604F1A418ABE43DF0980245C3B7F8FEB709AEE8E9474841A280E073EC063045EA39948E853AA6B4EC0FB0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\aosh5sba.k5f\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.966739726233845
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PRODUCT INQUIRY FROM PAKISTAN.exe
File size:	852992
MD5:	6efee5c2282e20bafb495451512c5ca7
SHA1:	72d3a5bac34e50b19f4df7ae42f37a950e099e5c
SHA256:	860b99eb4a09674fe70d72bb997b2cf38bfc62eb2794a13d623048d5f5b422d2
SHA512:	939f453caaad2cce39923fbd8e087f0d68db727ef2c16dbbd18ab33d9b58d9d1ca45f75e513d45efaa1dada6c7c2d3fa6a94b35b57fa62db52cb31cca7eeb3f0
SSDEEP:	12288:pyO2UHJZ/6hAkXkyKLPPjAY5Ii/4mTX46632n05ZhYq/zYLmvk4FcXac0usx+zFt:NHJohAukyKLPLAxmSYqr5bZuyGSEV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..`..............P......>.......`...@... ....@.. ....................................@................................

File Icon


Icon Hash:	f2d2e9fcc4ead362

Static PE Info

General
Entrypoint:	0x4d600a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609B854F [Wed May 12 07:35:43 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004D6000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc4914	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd0000	0x34e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd6000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0xc4000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
tOdw-f5	0x2000	0xc0430	0xc0600	False	1.00031854085	data	7.99978655824	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.text	0xc4000	0xbf48	0xc000	False	0.444864908854	data	5.99523807789	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xd0000	0x34e8	0x3600	False	0.361834490741	data	5.25644950333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0xd6000	0x10	0x200	False	0.044921875	data	0.142635768149	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xd0130	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0xd26d8	0x14	data
RT_VERSION	0xd26ec	0x394	data
RT_MANIFEST	0xd2a80	0xa65	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2013
Assembly Version	3.0.0.0
InternalName	SecuritySafeCriticalAttribute.exe
FileVersion	3.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	ServerManager_Core
ProductVersion	3.0.0.0
FileDescription	ServerManager_Core
OriginalFilename	SecuritySafeCriticalAttribute.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-19:45:56.368072	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49745	587	192.168.2.7	208.91.199.224
05/12/21-19:45:59.211267	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49747	587	192.168.2.7	208.91.199.224

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 19:45:54.595738888 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:54.761893988 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:54.766186953 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:55.346564054 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:55.352231979 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:55.516464949 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:55.516491890 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:55.518551111 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:55.686163902 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:55.692404032 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:55.858733892 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:55.860264063 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.025664091 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.026678085 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.197799921 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.198604107 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.363210917 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.368072033 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.368257046 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.368385077 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.368483067 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:56.532382011 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.532553911 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.588491917 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:56.735131025 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:57.486198902 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:57.651779890 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:57.651809931 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:57.651875019 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:57.657607079 CEST	49745	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:57.821738958 CEST	587	49745	208.91.199.224	192.168.2.7
May 12, 2021 19:45:57.860732079 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.025146008 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.025234938 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.197154999 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.197532892 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.362965107 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.362986088 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.363831043 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.529488087 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.534030914 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.700325966 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.700753927 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:58.866141081 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:58.866465092 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.039623022 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.040100098 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.204902887 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.211168051 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211266994 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211455107 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211469889 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211596012 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211663961 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211725950 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.211798906 CEST	49747	587	192.168.2.7	208.91.199.224
May 12, 2021 19:45:59.375585079 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.375674963 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.375775099 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.375838995 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.415575027 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.431745052 CEST	587	49747	208.91.199.224	192.168.2.7
May 12, 2021 19:45:59.485426903 CEST	49747	587	192.168.2.7	208.91.199.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 19:43:59.224813938 CEST	56590	53	192.168.2.7	8.8.8.8
May 12, 2021 19:43:59.285340071 CEST	53	56590	8.8.8.8	192.168.2.7
May 12, 2021 19:43:59.564558983 CEST	60501	53	192.168.2.7	8.8.8.8
May 12, 2021 19:43:59.616162062 CEST	53	60501	8.8.8.8	192.168.2.7
May 12, 2021 19:44:00.457453966 CEST	53775	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:00.511548042 CEST	53	53775	8.8.8.8	192.168.2.7
May 12, 2021 19:44:01.631833076 CEST	51837	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:01.683595896 CEST	53	51837	8.8.8.8	192.168.2.7
May 12, 2021 19:44:02.895919085 CEST	55411	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:02.944668055 CEST	53	55411	8.8.8.8	192.168.2.7
May 12, 2021 19:44:05.173396111 CEST	63668	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:05.222266912 CEST	53	63668	8.8.8.8	192.168.2.7
May 12, 2021 19:44:06.644130945 CEST	54640	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:06.692852020 CEST	53	54640	8.8.8.8	192.168.2.7
May 12, 2021 19:44:08.096457958 CEST	58739	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:08.148211956 CEST	53	58739	8.8.8.8	192.168.2.7
May 12, 2021 19:44:10.672255039 CEST	60338	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:10.721375942 CEST	53	60338	8.8.8.8	192.168.2.7
May 12, 2021 19:44:13.107789040 CEST	58717	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:13.157049894 CEST	53	58717	8.8.8.8	192.168.2.7
May 12, 2021 19:44:14.273667097 CEST	59762	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:14.325664043 CEST	53	59762	8.8.8.8	192.168.2.7
May 12, 2021 19:44:15.160633087 CEST	54329	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:15.209743977 CEST	53	54329	8.8.8.8	192.168.2.7
May 12, 2021 19:44:16.304476023 CEST	58052	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:16.365219116 CEST	53	58052	8.8.8.8	192.168.2.7
May 12, 2021 19:44:17.525924921 CEST	54008	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:17.583611965 CEST	53	54008	8.8.8.8	192.168.2.7
May 12, 2021 19:44:18.953445911 CEST	59451	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:19.002532005 CEST	53	59451	8.8.8.8	192.168.2.7
May 12, 2021 19:44:19.919316053 CEST	52914	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:19.968133926 CEST	53	52914	8.8.8.8	192.168.2.7
May 12, 2021 19:44:20.332041979 CEST	64569	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:20.390768051 CEST	53	64569	8.8.8.8	192.168.2.7
May 12, 2021 19:44:21.694616079 CEST	52816	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:21.743330002 CEST	53	52816	8.8.8.8	192.168.2.7
May 12, 2021 19:44:22.995572090 CEST	50781	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:23.044259071 CEST	53	50781	8.8.8.8	192.168.2.7
May 12, 2021 19:44:25.013695002 CEST	54230	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:25.074450970 CEST	53	54230	8.8.8.8	192.168.2.7
May 12, 2021 19:44:26.464652061 CEST	54911	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:26.513268948 CEST	53	54911	8.8.8.8	192.168.2.7
May 12, 2021 19:44:34.585084915 CEST	49958	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:34.650090933 CEST	53	49958	8.8.8.8	192.168.2.7
May 12, 2021 19:44:45.167170048 CEST	50860	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:45.224750042 CEST	53	50860	8.8.8.8	192.168.2.7
May 12, 2021 19:44:53.968266010 CEST	50452	53	192.168.2.7	8.8.8.8
May 12, 2021 19:44:54.034739017 CEST	53	50452	8.8.8.8	192.168.2.7
May 12, 2021 19:45:14.893815041 CEST	59730	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:14.969223022 CEST	53	59730	8.8.8.8	192.168.2.7
May 12, 2021 19:45:19.726541996 CEST	59310	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:19.790828943 CEST	53	59310	8.8.8.8	192.168.2.7
May 12, 2021 19:45:36.072041035 CEST	51919	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:36.267502069 CEST	53	51919	8.8.8.8	192.168.2.7
May 12, 2021 19:45:36.831161976 CEST	64296	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:36.892123938 CEST	53	64296	8.8.8.8	192.168.2.7
May 12, 2021 19:45:37.475807905 CEST	56680	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:37.581991911 CEST	53	56680	8.8.8.8	192.168.2.7
May 12, 2021 19:45:37.726138115 CEST	58820	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:37.788824081 CEST	53	58820	8.8.8.8	192.168.2.7
May 12, 2021 19:45:38.029793978 CEST	60983	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:38.089878082 CEST	53	60983	8.8.8.8	192.168.2.7
May 12, 2021 19:45:38.643950939 CEST	49247	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:38.706350088 CEST	53	49247	8.8.8.8	192.168.2.7
May 12, 2021 19:45:39.245731115 CEST	52286	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:39.305742979 CEST	53	52286	8.8.8.8	192.168.2.7
May 12, 2021 19:45:39.816066980 CEST	56064	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:39.873152018 CEST	53	56064	8.8.8.8	192.168.2.7
May 12, 2021 19:45:40.806899071 CEST	63744	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:40.860469103 CEST	53	63744	8.8.8.8	192.168.2.7
May 12, 2021 19:45:41.667094946 CEST	61457	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:41.728502035 CEST	53	61457	8.8.8.8	192.168.2.7
May 12, 2021 19:45:42.235435009 CEST	58367	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:42.389705896 CEST	53	58367	8.8.8.8	192.168.2.7
May 12, 2021 19:45:53.653337002 CEST	60599	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:53.710711002 CEST	53	60599	8.8.8.8	192.168.2.7
May 12, 2021 19:45:54.308971882 CEST	59571	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:54.498368979 CEST	53	59571	8.8.8.8	192.168.2.7
May 12, 2021 19:45:54.513879061 CEST	52689	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:54.575346947 CEST	53	52689	8.8.8.8	192.168.2.7
May 12, 2021 19:45:55.724800110 CEST	50290	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:55.799751043 CEST	53	50290	8.8.8.8	192.168.2.7
May 12, 2021 19:45:57.703577995 CEST	60427	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:57.763330936 CEST	53	60427	8.8.8.8	192.168.2.7
May 12, 2021 19:45:57.801608086 CEST	56209	53	192.168.2.7	8.8.8.8
May 12, 2021 19:45:57.858694077 CEST	53	56209	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 19:45:54.308971882 CEST	192.168.2.7	8.8.8.8	0xd480	Standard query (0)	smtp.globaloffs-site.com	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.513879061 CEST	192.168.2.7	8.8.8.8	0x8a60	Standard query (0)	smtp.globaloffs-site.com	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.703577995 CEST	192.168.2.7	8.8.8.8	0x1d54	Standard query (0)	smtp.globaloffs-site.com	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.801608086 CEST	192.168.2.7	8.8.8.8	0x9e07	Standard query (0)	smtp.globaloffs-site.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 19:45:54.498368979 CEST	8.8.8.8	192.168.2.7	0xd480	No error (0)	smtp.globaloffs-site.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 19:45:54.498368979 CEST	8.8.8.8	192.168.2.7	0xd480	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.498368979 CEST	8.8.8.8	192.168.2.7	0xd480	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.498368979 CEST	8.8.8.8	192.168.2.7	0xd480	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.498368979 CEST	8.8.8.8	192.168.2.7	0xd480	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.575346947 CEST	8.8.8.8	192.168.2.7	0x8a60	No error (0)	smtp.globaloffs-site.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 19:45:54.575346947 CEST	8.8.8.8	192.168.2.7	0x8a60	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.575346947 CEST	8.8.8.8	192.168.2.7	0x8a60	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.575346947 CEST	8.8.8.8	192.168.2.7	0x8a60	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
May 12, 2021 19:45:54.575346947 CEST	8.8.8.8	192.168.2.7	0x8a60	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.763330936 CEST	8.8.8.8	192.168.2.7	0x1d54	No error (0)	smtp.globaloffs-site.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 19:45:57.763330936 CEST	8.8.8.8	192.168.2.7	0x1d54	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.763330936 CEST	8.8.8.8	192.168.2.7	0x1d54	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.763330936 CEST	8.8.8.8	192.168.2.7	0x1d54	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.763330936 CEST	8.8.8.8	192.168.2.7	0x1d54	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.858694077 CEST	8.8.8.8	192.168.2.7	0x9e07	No error (0)	smtp.globaloffs-site.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 19:45:57.858694077 CEST	8.8.8.8	192.168.2.7	0x9e07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.858694077 CEST	8.8.8.8	192.168.2.7	0x9e07	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.858694077 CEST	8.8.8.8	192.168.2.7	0x9e07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
May 12, 2021 19:45:57.858694077 CEST	8.8.8.8	192.168.2.7	0x9e07	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 12, 2021 19:45:55.346564054 CEST	587	49745	208.91.199.224	192.168.2.7	220 us2.outbound.mailhostbox.com ESMTP Postfix
May 12, 2021 19:45:55.352231979 CEST	49745	587	192.168.2.7	208.91.199.224	EHLO 347688
May 12, 2021 19:45:55.516491890 CEST	587	49745	208.91.199.224	192.168.2.7	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
May 12, 2021 19:45:55.518551111 CEST	49745	587	192.168.2.7	208.91.199.224	AUTH login c3RhZmZzQGdsb2JhbG9mZnMtc2l0ZS5jb20=
May 12, 2021 19:45:55.686163902 CEST	587	49745	208.91.199.224	192.168.2.7	334 UGFzc3dvcmQ6
May 12, 2021 19:45:55.858733892 CEST	587	49745	208.91.199.224	192.168.2.7	235 2.7.0 Authentication successful
May 12, 2021 19:45:55.860264063 CEST	49745	587	192.168.2.7	208.91.199.224	MAIL FROM:<staffs@globaloffs-site.com>
May 12, 2021 19:45:56.025664091 CEST	587	49745	208.91.199.224	192.168.2.7	250 2.1.0 Ok
May 12, 2021 19:45:56.026678085 CEST	49745	587	192.168.2.7	208.91.199.224	RCPT TO:<staffs@globaloffs-site.com>
May 12, 2021 19:45:56.197799921 CEST	587	49745	208.91.199.224	192.168.2.7	250 2.1.5 Ok
May 12, 2021 19:45:56.198604107 CEST	49745	587	192.168.2.7	208.91.199.224	DATA
May 12, 2021 19:45:56.363210917 CEST	587	49745	208.91.199.224	192.168.2.7	354 End data with <CR><LF>.<CR><LF>
May 12, 2021 19:45:56.368483067 CEST	49745	587	192.168.2.7	208.91.199.224	.
May 12, 2021 19:45:56.588491917 CEST	587	49745	208.91.199.224	192.168.2.7	250 2.0.0 Ok: queued as 203341C1AF1
May 12, 2021 19:45:57.486198902 CEST	49745	587	192.168.2.7	208.91.199.224	QUIT
May 12, 2021 19:45:57.651779890 CEST	587	49745	208.91.199.224	192.168.2.7	221 2.0.0 Bye
May 12, 2021 19:45:58.197154999 CEST	587	49747	208.91.199.224	192.168.2.7	220 us2.outbound.mailhostbox.com ESMTP Postfix
May 12, 2021 19:45:58.197532892 CEST	49747	587	192.168.2.7	208.91.199.224	EHLO 347688
May 12, 2021 19:45:58.362986088 CEST	587	49747	208.91.199.224	192.168.2.7	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
May 12, 2021 19:45:58.363831043 CEST	49747	587	192.168.2.7	208.91.199.224	AUTH login c3RhZmZzQGdsb2JhbG9mZnMtc2l0ZS5jb20=
May 12, 2021 19:45:58.529488087 CEST	587	49747	208.91.199.224	192.168.2.7	334 UGFzc3dvcmQ6
May 12, 2021 19:45:58.700325966 CEST	587	49747	208.91.199.224	192.168.2.7	235 2.7.0 Authentication successful
May 12, 2021 19:45:58.700753927 CEST	49747	587	192.168.2.7	208.91.199.224	MAIL FROM:<staffs@globaloffs-site.com>
May 12, 2021 19:45:58.866141081 CEST	587	49747	208.91.199.224	192.168.2.7	250 2.1.0 Ok
May 12, 2021 19:45:58.866465092 CEST	49747	587	192.168.2.7	208.91.199.224	RCPT TO:<staffs@globaloffs-site.com>
May 12, 2021 19:45:59.039623022 CEST	587	49747	208.91.199.224	192.168.2.7	250 2.1.5 Ok
May 12, 2021 19:45:59.040100098 CEST	49747	587	192.168.2.7	208.91.199.224	DATA
May 12, 2021 19:45:59.204902887 CEST	587	49747	208.91.199.224	192.168.2.7	354 End data with <CR><LF>.<CR><LF>
May 12, 2021 19:45:59.211798906 CEST	49747	587	192.168.2.7	208.91.199.224	.
May 12, 2021 19:45:59.431745052 CEST	587	49747	208.91.199.224	192.168.2.7	250 2.0.0 Ok: queued as EDB881C2A04

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448 Parent PID: 5788

General

Start time:	19:44:05
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe'
Imagebase:	0x10000
File size:	852992 bytes
MD5 hash:	6EFEE5C2282E20BAFB495451512C5CA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.258281166.00000000024B3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.260813801.00000000034B5000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388 Parent PID: 5448

General

Start time:	19:44:15
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PRODUCT INQUIRY FROM PAKISTAN.exe
Imagebase:	0xb20000
File size:	852992 bytes
MD5 hash:	6EFEE5C2282E20BAFB495451512C5CA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.505405709.0000000002EC1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.500732572.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5448 Parent PID: 5788 PRODUCT INQUIRY FROM PAKISTAN.exeCOMMON

Executed Functions

Function 02304578, Relevance: 4.0, Strings: 3, Instructions: 296COMMON

Download Yara Rule

Strings

4, xrefs: 023046DF
4, xrefs: 023046E6
N(, xrefs: 02304739

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: 4$4$N(
API String ID: 0-3614575797
Opcode ID: e2aa64bb3c1334536484f6ec85e908106f10ad218d8bc388e2f7a433dde93770
Instruction ID: 8bef4fcf7281c47497fad2f472105d1a8963d570cae2b7b8ca19a8b8afa2071b
Opcode Fuzzy Hash: e2aa64bb3c1334536484f6ec85e908106f10ad218d8bc388e2f7a433dde93770
Instruction Fuzzy Hash: 4ED16BB0E0020ADFCB14CF95D5908AEFBB2FF89304F109555D615AB295E734EA92CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0230B288, Relevance: 4.0, Strings: 3, Instructions: 272COMMON

Download Yara Rule

Strings

jnW, xrefs: 0230B3C2
x?l, xrefs: 0230B3F9
x?l, xrefs: 0230B2CA

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: x?l$x?l$jnW
API String ID: 0-135392413
Opcode ID: 5e006910bbfcc555187835821fdbdfdee51b0f6463521158244037ebcfc2ce48
Instruction ID: afe7b10b49f42cbd03eedb45bfc681e0a3b4df1097c848f1b900ccf14437ba52
Opcode Fuzzy Hash: 5e006910bbfcc555187835821fdbdfdee51b0f6463521158244037ebcfc2ce48
Instruction Fuzzy Hash: 78C14470E15218CFCB14DFA5C990AADFBB6BF89308F108969C01ABB795DB349941CF25

Uniqueness

Uniqueness Score: -1.00%

Function 02309FD0, Relevance: 3.9, Strings: 3, Instructions: 175COMMON

Download Yara Rule

Strings

,uk, xrefs: 0230A09A
,uk, xrefs: 0230A19B
x?l, xrefs: 0230A150

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: ,uk$,uk$x?l
API String ID: 0-2129282098
Opcode ID: 03fa7e2eae0688790c4fb6e34f67f99ab1e374c43f15745688119c1c3e1461ce
Instruction ID: 0a9552b15a8f1aaca3ee42845b6574a181215414018d0ab2f10b031eb2a740d8
Opcode Fuzzy Hash: 03fa7e2eae0688790c4fb6e34f67f99ab1e374c43f15745688119c1c3e1461ce
Instruction Fuzzy Hash: 437102B0D05308DFCB08DFA5E5A0A9EBBB6FF89304F208529D506AB754DB349A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04D55230, Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

$,Dl, xrefs: 04D55332
u7@-, xrefs: 04D554F8

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: $,Dl$u7@-
API String ID: 0-2761758556
Opcode ID: eac19d6400948f8a056688274bcc4a7a5396eeed3c3819c4e2f295f7157406c0
Instruction ID: 3da6c391fab52c13e4eb285c1c4dd501ec4c8ceb8b29eed9e2f5006a7ba45320
Opcode Fuzzy Hash: eac19d6400948f8a056688274bcc4a7a5396eeed3c3819c4e2f295f7157406c0
Instruction Fuzzy Hash: 5191E674E04218DFCB49CFA5D99499DFBB2FF89314F10846AD415AB364DB34A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02304489, Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

N(, xrefs: 02304739

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: N(
API String ID: 0-3198409031
Opcode ID: 2a7df1fd0c6ffecb3ba3d47ba689d14e1fd588b54aa305f0c62f16dd25cb96b1
Instruction ID: 37babbd1df8b4393463a40218aab894566eb224c5e425b1f10308a6c602d74c6
Opcode Fuzzy Hash: 2a7df1fd0c6ffecb3ba3d47ba689d14e1fd588b54aa305f0c62f16dd25cb96b1
Instruction Fuzzy Hash: 02F1A070D04286CFCB05CFA9C4904AEFFB2FF8A314B159596C641AB257D7349A82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023016D1, Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 023017B4

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 96a249c0ebeb7c3d53bc080e5f817137ad365965ff0020442ea348468015a69c
Instruction ID: 27d17dfa7321ebcefba9e0c09f6fa6869311cbb19680a9e0488a98ff74b23fb4
Opcode Fuzzy Hash: 96a249c0ebeb7c3d53bc080e5f817137ad365965ff0020442ea348468015a69c
Instruction Fuzzy Hash: 87411574C082988FDB01CFA9D494AEEFFF4AF4A314F14809AE454BB252D334AA45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02301718, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 023017B4

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6089b6d61481bb62ad7c14380ad0dfdaff8ed4749c8abc570267c0e7236d2ac1
Instruction ID: 6d4a7ba209db9ed45a4205b21e85282f5dc9e99cd36a9d4ce8c46c5ca5758fe3
Opcode Fuzzy Hash: 6089b6d61481bb62ad7c14380ad0dfdaff8ed4749c8abc570267c0e7236d2ac1
Instruction Fuzzy Hash: 5441BBB9D05258DFCB00CFA9D484AEEFBF4AB09314F14906AE454B7250D778AA85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02302478, Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

\89A, xrefs: 02302666

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: \89A
API String ID: 0-2243438482
Opcode ID: 4197fd4b5c1e05e0c1274ebdf9a27e3531511514578390ed2c94fe5283115c7f
Instruction ID: f8eb703c667885f7e1a676e9b694f35cc4bedaaca561faedd1cb7f281798561f
Opcode Fuzzy Hash: 4197fd4b5c1e05e0c1274ebdf9a27e3531511514578390ed2c94fe5283115c7f
Instruction Fuzzy Hash: 97B14870E052898FCB06CFB9C4A56DEFFB2AF8A310F1480AAD445AF256D7309945CF25

Uniqueness

Uniqueness Score: -1.00%

Function 04D589BB, Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

@nD, xrefs: 04D58AFB

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: @nD
API String ID: 0-3507113750
Opcode ID: 67e1d4287901774c5ce3f91af62ebc694c9b4f795ba66bacfe3cbf8b379201e5
Instruction ID: 0ea53fc5bf939dfa9d9d6d7a73d0b4b37f21a937297a6470da4002d09f261f29
Opcode Fuzzy Hash: 67e1d4287901774c5ce3f91af62ebc694c9b4f795ba66bacfe3cbf8b379201e5
Instruction Fuzzy Hash: F091C474E002198FDB18DFA9C4846DDFBB2FF89300F14942AD915BB264DB359951CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04D589D0, Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

@nD, xrefs: 04D58AFB

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: @nD
API String ID: 0-3507113750
Opcode ID: bb31e02672fdc03edae076a4f8132efae413e821fec999a5bc28586d0609f0db
Instruction ID: 3176e0f19c64d083f9e262110afdc2e5094e148536b9260637354cf660fc5cbb
Opcode Fuzzy Hash: bb31e02672fdc03edae076a4f8132efae413e821fec999a5bc28586d0609f0db
Instruction Fuzzy Hash: 5291C474E00219CFCB18DFA5C58469DFBB2FF89300F14942AE919AB364DB35A951CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02302520, Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

\89A, xrefs: 02302666

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: \89A
API String ID: 0-2243438482
Opcode ID: 2eb44d157abd51648c200ef18db2b72a7688be8e4843f775777dba17a09ee2c5
Instruction ID: eaa96aea5235c7b080e7ea917dfdcbd71e3219f6975e12618fba050958a3002c
Opcode Fuzzy Hash: 2eb44d157abd51648c200ef18db2b72a7688be8e4843f775777dba17a09ee2c5
Instruction Fuzzy Hash: AB81E574E102188FCB18CFE5C995A9EFBB6EF89300F24942AD815BB355D7349941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04D59260, Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

EQ, xrefs: 04D592DD

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: EQ
API String ID: 0-4127074823
Opcode ID: e80f2df7aa8a91b1840f56a95ceb1ab6581eea4e67dc335b2a7d6d6264f980f2
Instruction ID: a043522f430aaacf1b780dd306152ccf5e07807c628a9ab0f968ab25eeb11edb
Opcode Fuzzy Hash: e80f2df7aa8a91b1840f56a95ceb1ab6581eea4e67dc335b2a7d6d6264f980f2
Instruction Fuzzy Hash: 325139B4E05209CFDB08CFA6D5509AEFBF2EF89300F14D46AD415A7264E7349A02CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02300538, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

<, xrefs: 0230064E

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 297d47448e1fc2a73697b6058186999e74417875ad9be5ff8023f53331ecc78c
Instruction ID: 8a9bccda72972f649ba7a1a6df75f4606a688d16161b5aea493d1b1050079fb6
Opcode Fuzzy Hash: 297d47448e1fc2a73697b6058186999e74417875ad9be5ff8023f53331ecc78c
Instruction Fuzzy Hash: 37519575E006188FDB58CFAAC9506DDFBF2BF89304F14C1AAD518AB265EB305A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0230052A, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

<, xrefs: 0230064E

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 28db8fd94ae4b6e8c8d2385f116190abe4d338a6b831bb22d8cd97bd8483380b
Instruction ID: f99c4c7cb85593bcd93b3871a28dfcdd485774569078af5d7503392f09c53a93
Opcode Fuzzy Hash: 28db8fd94ae4b6e8c8d2385f116190abe4d338a6b831bb22d8cd97bd8483380b
Instruction Fuzzy Hash: 27519875E046188FDB58CFAAC9506DDFBF2BF89304F14C1AAD518AB265EB305A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04D533B0, Relevance: .9, Instructions: 880COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5767d45fa503823b4071f1e2e6c4f9db8e37d7b1ea1211c5b63370d84eca2965
Instruction ID: 5eb0fc36164622d933f00ae230db188f2760e772d55bc67309ac287c26c62c5b
Opcode Fuzzy Hash: 5767d45fa503823b4071f1e2e6c4f9db8e37d7b1ea1211c5b63370d84eca2965
Instruction Fuzzy Hash: B8825871A00249DFCF15CF68C588AAABBF2BF88344F15855AEC15EB2A1DB35F941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04D55768, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afec5241ceb8889354944855b6b123d5b2822a968de6378eac6367d76c4edcf8
Instruction ID: bd69b51e335635969b5ecf27d45f5661ab4a0006392d349025d393bc8adc3f70
Opcode Fuzzy Hash: afec5241ceb8889354944855b6b123d5b2822a968de6378eac6367d76c4edcf8
Instruction Fuzzy Hash: 2002B071E012199FCF15CFA5D9506ADFBF2BF85314F10C469D909AB368EB34AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04D50054, Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b38fd48f789248765382857a735b75d93acca62d665c6e64d537d3835e59da
Instruction ID: a643799201039db3a0e355711e314c87ef4aae88b9fcb091a6754a9e88380c99
Opcode Fuzzy Hash: d0b38fd48f789248765382857a735b75d93acca62d665c6e64d537d3835e59da
Instruction Fuzzy Hash: 5EE12931A001198FDF15CFA9D984AADBBF2FF88344F158169E815AB271DB30ED42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04949261, Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8402240229b0240922ef5469c423eafa5ed90254e552882023563a1c594ed095
Instruction ID: 57418c556c1a149bcea613ad93f2d4d71a2c02a021c069ff7351eaa551437b89
Opcode Fuzzy Hash: 8402240229b0240922ef5469c423eafa5ed90254e552882023563a1c594ed095
Instruction Fuzzy Hash: 67C178B0A043159FCB14EF78D4849AEBBF2FF89218B04892AD546EB751DB34FD018B90

Uniqueness

Uniqueness Score: -1.00%

Function 04D55E68, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5baa0ed279bb5ef0b11c798f6f35e4f891b469252dec490001884304a2e06945
Instruction ID: 3f6f9078df44c31a6a3b30d401f24aa3f5f6672dbb02f88173c7e459ea3259a9
Opcode Fuzzy Hash: 5baa0ed279bb5ef0b11c798f6f35e4f891b469252dec490001884304a2e06945
Instruction Fuzzy Hash: D3C16874E052199BCF04CFA9D58059EFBF2AF89310F64D129C818BB369EB34A9418F65

Uniqueness

Uniqueness Score: -1.00%

Function 04D55E5B, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d718b2f28d1bceaf5e9575d8a25c0b6d47b4daa0e2ab76163800c8b0bf8bbe
Instruction ID: 8521216e9a439518ecaa9f2a7b4b56b927f45b0f2ce685ace9d477494f8a8fa2
Opcode Fuzzy Hash: e4d718b2f28d1bceaf5e9575d8a25c0b6d47b4daa0e2ab76163800c8b0bf8bbe
Instruction Fuzzy Hash: 31C16A74E042199FCF04CFA9D58459EFBF2AF89310F54D02AC818BB269EB34E9418F65

Uniqueness

Uniqueness Score: -1.00%

Function 04D55948, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0c950d9c7b138ef7b363eb2c69010dfbcad24f24dd7196b362ffe8b6e6d34d
Instruction ID: 9e8ef6624791ec164c06f09fc6b6fe78d030c70a77d7dfe2c0ebb6e12be8de96
Opcode Fuzzy Hash: bb0c950d9c7b138ef7b363eb2c69010dfbcad24f24dd7196b362ffe8b6e6d34d
Instruction Fuzzy Hash: 0DC15A71E05259DBCF15CFA5D95569EFBB2BF85314F10C46AC849AB228EB34AA02CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04D55560, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07d7c95e504647a6209a6636932999a84cf773a36cd87c583bc01b50c42c5b2
Instruction ID: e627225074723b59cfae37258db48a30644a4c2e6562dc121401bc944da501ae
Opcode Fuzzy Hash: c07d7c95e504647a6209a6636932999a84cf773a36cd87c583bc01b50c42c5b2
Instruction Fuzzy Hash: 5A513B74E05209DFCB08CFA5E5555AEBBB2FF89300F208429D805B7364EB359A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04D55551, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18771e6c131eeea589d2ca8e76ea433a2f9fda1ae3ddb1eb1c3974b6cdd14783
Instruction ID: f331ea684127607fdee2626b1194c4023a44c8e4056c5ce78dcbf16d6c79c78d
Opcode Fuzzy Hash: 18771e6c131eeea589d2ca8e76ea433a2f9fda1ae3ddb1eb1c3974b6cdd14783
Instruction Fuzzy Hash: AA513B74E05209DFCB09CFA9D5545AEBBB2FF89300F208429D905B7364EB359A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02302CB2, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be5dc068860ae037a0188a27b38e326e68d670315c4d0a8864169110661b570
Instruction ID: d5b12385603936e7ed97837fa735bc1924072ab28719b0edd9b47a4912a93b72
Opcode Fuzzy Hash: 4be5dc068860ae037a0188a27b38e326e68d670315c4d0a8864169110661b570
Instruction Fuzzy Hash: 0F515F70D046098FDB08CFAAD5946AEFBF2FF89310F14D06AD415A7295E7344A41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02302CC0, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bda60c401384afd539aedd299dc2531239ebb5817dc4a487c2dddbb528eaff
Instruction ID: aa51bb5b89fc898d698eb05e73b8ea86f02c9e59fbabb272b4978e97883a5ef7
Opcode Fuzzy Hash: c0bda60c401384afd539aedd299dc2531239ebb5817dc4a487c2dddbb528eaff
Instruction Fuzzy Hash: 735129B0E046198FDB08CFAAD5946AEFBF2FF89300F14D02AD419A7265E7344A41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04D57DDF, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047204e4cfd42373b8faf40eb43311d903ceda25426e1ae12334131184770905
Instruction ID: 6f5703bd35a48eefc3a220d5e0dec6b51b7d2441710a8009ca61b9b3befbc461
Opcode Fuzzy Hash: 047204e4cfd42373b8faf40eb43311d903ceda25426e1ae12334131184770905
Instruction Fuzzy Hash: 00414C71E046188FEB58DFA6D850A9DBBF3EFC9204F14C0AAD408AB265DB305D45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04D59C70, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7d44cb9c8247dfd64fe4d6cf9004fe96b13e763a6bcef55fe099983f6787da
Instruction ID: 9df6cff01424a381333cb8b0c27edba109ddcb1877ef33cdc53b840da5b349a8
Opcode Fuzzy Hash: ba7d44cb9c8247dfd64fe4d6cf9004fe96b13e763a6bcef55fe099983f6787da
Instruction Fuzzy Hash: BA412971E01618CBDB08CFA6D9546DEBBB2EFC9310F14C06AD809AB368DB359946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02303690, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9978acbfa514556a20eaf330a1ed297dfca564769702c688220b88158e39bf
Instruction ID: f9fbed0005d1ecd8e74c3ec9cd0967deb10ffeaae9d8885641c0213c7f659c85
Opcode Fuzzy Hash: 6a9978acbfa514556a20eaf330a1ed297dfca564769702c688220b88158e39bf
Instruction Fuzzy Hash: 423128B1E006188BDB18CFAAD8847DEBBB7AFC8314F14C16AD509A7258DB351A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04D5D298, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf80b5239eea3082ff8a888e86ed295858af8c15f987843847b7d78e5160873
Instruction ID: 8a3895a4fc6742138df2a65ad0d49cd7cf0126b2fe023d607748295702ad8505
Opcode Fuzzy Hash: ecf80b5239eea3082ff8a888e86ed295858af8c15f987843847b7d78e5160873
Instruction Fuzzy Hash: D4212F71E056188BEB48CF6BD84069EFBF7FFC9200F04C1BAC808A6224DB3419468F51

Uniqueness

Uniqueness Score: -1.00%

Function 04D57E51, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8373317f3a642fba8cd490490142e2591f1a071ae3467a8f73f02d71ff85a2e0
Instruction ID: 234479281a8ddd17d3abf360929303a4ec0c5c1421b8a0245dc82ce1ca1479bd
Opcode Fuzzy Hash: 8373317f3a642fba8cd490490142e2591f1a071ae3467a8f73f02d71ff85a2e0
Instruction Fuzzy Hash: F221CE71E056189FEB18DFABD840A9EFBF3AFC9200F14C0BAD508A6254DB3449458F51

Uniqueness

Uniqueness Score: -1.00%

Function 02303680, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ade027348ba3a0e977b35bdf19542f21b3d64e6d70f413d71890a9907a80dd2
Instruction ID: 30dea08f7954fa20d14f56512ad38e8f079b0bbae451731fdece2c2824c10b4d
Opcode Fuzzy Hash: 3ade027348ba3a0e977b35bdf19542f21b3d64e6d70f413d71890a9907a80dd2
Instruction Fuzzy Hash: 0621FBB0E046588BDB19CFAAC9543DEBFF3AFC9304F14C1AAD4046A259DB751949CF50

Uniqueness

Uniqueness Score: -1.00%

Function 049427E9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04942858
GetCurrentThread.KERNEL32 ref: 04942895
GetCurrentProcess.KERNEL32 ref: 049428D2
GetCurrentThreadId.KERNEL32 ref: 0494292B

Strings

8\n, xrefs: 04942957

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: 8\n
API String ID: 2063062207-1765618493
Opcode ID: 531fa4d9e2d8f8a33075b7537f3e878ecaa218858fe986c307dd1740a9f70c26
Instruction ID: 546abd880608422b567263e1c8a2fcce9b70af2aa04e919ed2a0711f891b39dc
Opcode Fuzzy Hash: 531fa4d9e2d8f8a33075b7537f3e878ecaa218858fe986c307dd1740a9f70c26
Instruction Fuzzy Hash: D35145B0D04349CFDB10CFA9C948BEEBBF4AB88314F2084A9E059A7390D7746945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 049427F8, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04942858
GetCurrentThread.KERNEL32 ref: 04942895
GetCurrentProcess.KERNEL32 ref: 049428D2
GetCurrentThreadId.KERNEL32 ref: 0494292B

Strings

8\n, xrefs: 04942957

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: 8\n
API String ID: 2063062207-1765618493
Opcode ID: 5ad3d403ec2fe94d396fb146e34be6bb47576328d2661eaed10a6b98bca60227
Instruction ID: fb1621d0850b09d82c0abe76ebdadabe3cef1812bb017afbde8ef3b2d5019b98
Opcode Fuzzy Hash: 5ad3d403ec2fe94d396fb146e34be6bb47576328d2661eaed10a6b98bca60227
Instruction Fuzzy Hash: 4C5144B0D04349CFDB10CFA9D948BAEBBF4BB88314F208469E019A7350D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 023003C8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(?), ref: 0230B8B2

Strings

`Gk, xrefs: 023003C8

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: DebugOutputString
String ID: `Gk
API String ID: 1166629820-3536745248
Opcode ID: 0be21c9d84c77654793d7f5418d6fba1ca2ec0c7382b07f8b86c04fd1c2ffde2
Instruction ID: 28f2f2795fbb6e108a347c196fa192d4772391b26b3222076f086e9853afd364
Opcode Fuzzy Hash: 0be21c9d84c77654793d7f5418d6fba1ca2ec0c7382b07f8b86c04fd1c2ffde2
Instruction Fuzzy Hash: 2E31BCB4D04258DFCB14CFA9D584ADEFBF5AB49314F14806AE814B7360D774A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04D54D98, Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

&rE, xrefs: 04D54EEE
,uk, xrefs: 04D54EAE

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: &rE$,uk
API String ID: 0-2129474894
Opcode ID: 396212ed578df618ef325a4a957b4c81cdfeffadb6b7f858b5929ee5c2d3dda5
Instruction ID: fb18ed74a3516a8a15a37ca25255519e8d46a4a76d1b5a04113eadc4f31d1f92
Opcode Fuzzy Hash: 396212ed578df618ef325a4a957b4c81cdfeffadb6b7f858b5929ee5c2d3dda5
Instruction Fuzzy Hash: 93419F71E042099FDF04CFA5D9846AEBBB2FF89314F10C06AD905AB365DB34A942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04D54DEB, Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

&rE, xrefs: 04D54EEE
,uk, xrefs: 04D54EAE

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: &rE$,uk
API String ID: 0-2129474894
Opcode ID: 9598066dfbd9a1f204c4f80d8d1a52804d29b61f3fbc4a5c5a89c1647f6b401c
Instruction ID: 23c6f6f191feedbfa0dd93c84f4abb911dcddfeb0f88d71441d0fae18983b8d1
Opcode Fuzzy Hash: 9598066dfbd9a1f204c4f80d8d1a52804d29b61f3fbc4a5c5a89c1647f6b401c
Instruction Fuzzy Hash: 29313675E042088FDF04DFA5D9446EEFBB2FB88300F14C06AD506A73A5DB389A528F51

Uniqueness

Uniqueness Score: -1.00%

Function 0494D530, Relevance: 1.8, APIs: 1, Instructions: 316COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0494F6D1

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 58a2a04be76cca3255ae5982055cf54d509ad02068ee56efcbfb081722523ef9
Instruction ID: 3b9066ac847846d71ecf8cf2441bfb3e4f98bc5fa9858e9e6618fb0549df7a8a
Opcode Fuzzy Hash: 58a2a04be76cca3255ae5982055cf54d509ad02068ee56efcbfb081722523ef9
Instruction Fuzzy Hash: EAC16875E003198FDB15DFA4C890ADEBBB6FF89304F1481AAD409AB261EB30AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04D51FB1, Relevance: 1.7, Strings: 1, Instructions: 489COMMON

Download Yara Rule

Strings

x?l, xrefs: 04D523F4

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID: x?l
API String ID: 0-1752844993
Opcode ID: 57c5b4e53c10fa4d71ff155d6baaab351f69c6ed238e0a191fcb6d9f2d995aa1
Instruction ID: 82cf66e6bcd2120a58ad74affd1504a6e8d8df5a6700f9d0674aed1e4514d2e2
Opcode Fuzzy Hash: 57c5b4e53c10fa4d71ff155d6baaab351f69c6ed238e0a191fcb6d9f2d995aa1
Instruction Fuzzy Hash: 43F161303041058FEF259A69D454B3E36EABF45704F1940EAE952CF7B1DE29EC4A8F52

Uniqueness

Uniqueness Score: -1.00%

Function 04947848, Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 04947ACA

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0dddbfdbf5d96a79d097691c37f9b59b0e1a1181836f83fc4bdc1ed240cabf48
Instruction ID: 49550dd0264d26aa658f0b0013684928e17bc02bba5c67484b31104cb2d1f46b
Opcode Fuzzy Hash: 0dddbfdbf5d96a79d097691c37f9b59b0e1a1181836f83fc4bdc1ed240cabf48
Instruction Fuzzy Hash: B59135B0A007099FDB24CFA9D484A9ABBF5BF89304F04896AD446E7B50D734E945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04949A6C, Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 04949C39

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bd436093796f882e288635989a495131d15a5ebe3103255f29f0f277f65b7d94
Instruction ID: c7a6bb71c4e992ad0820bb48239375d153693f79c6361373d0d7d5fd31e456c8
Opcode Fuzzy Hash: bd436093796f882e288635989a495131d15a5ebe3103255f29f0f277f65b7d94
Instruction Fuzzy Hash: 2F718AB4D04218DFDF20CFA9D984BDEBBF1BB49314F1491AAE808A7211D770AA85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04949A78, Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 04949C39

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 04b21aa4c28c651e46566ae8c7aca6c91271d05cf646c0bb30ad662969a7577e
Instruction ID: 1e3e6b027a6d6464209c5ab3769b71b0047b04e0a8918c875d874a5a72c582b1
Opcode Fuzzy Hash: 04b21aa4c28c651e46566ae8c7aca6c91271d05cf646c0bb30ad662969a7577e
Instruction Fuzzy Hash: 887188B4D04218DFDF20CFA9D984BDEBBF1BB49304F1491AAE808A7211D770AA85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0494F5D6, Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0494F6D1

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: aebc8635016d186e256b48f1751439998222306079ceeaacb8a5825ab9aa665f
Instruction ID: 1f9a781954d34e7f85f9bff3a0afef5ee2c2ab49ceb3912fef0beb422bb026f3
Opcode Fuzzy Hash: aebc8635016d186e256b48f1751439998222306079ceeaacb8a5825ab9aa665f
Instruction Fuzzy Hash: 55510471D042298FDB20CFA4C984BDEBBB5AF89304F1180AAD509BB251DB756A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0494D564, Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0494F6D1

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 979b0431e64b8458f03dcbe29af34b6351aa9d019f3fa4ac2f65b4821a6976e5
Instruction ID: 38d8cddd4c05d9c0b80442ad32e4ca0fbfee2feaf72c143921a5478e0602a241
Opcode Fuzzy Hash: 979b0431e64b8458f03dcbe29af34b6351aa9d019f3fa4ac2f65b4821a6976e5
Instruction Fuzzy Hash: 0651D371D0422C8FDB64CFA4C944BDEBBB5AF89304F1180AAD509BB250DB756E89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04942A18, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04942AEB

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0aa66014d109b0eeb83b595bba763ec798516340a5c550cc11b5013849e52104
Instruction ID: 92952758e375276316cdd2b086801f129d3093204618faf24c0b51d84bc3d734
Opcode Fuzzy Hash: 0aa66014d109b0eeb83b595bba763ec798516340a5c550cc11b5013849e52104
Instruction Fuzzy Hash: 764176B9D042589FCF00CFA9D984ADEBBF4BB49310F14946AE818BB310E335A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04942A20, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04942AEB

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4c7083c3fd09cb58b0c9e9896f81baccab9525e1c6deff19d837c81e015b2a4c
Instruction ID: c6ff57a47e3db0d4e11b3cc3bfe2f628ccf4f8f48ef16a4f9c11d2e3185974b7
Opcode Fuzzy Hash: 4c7083c3fd09cb58b0c9e9896f81baccab9525e1c6deff19d837c81e015b2a4c
Instruction Fuzzy Hash: DA4165B9D042589FCF00CFA9D984ADEBBF5BB49310F14906AE918BB310D335A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04946D40, Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 04947DF2

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1b36debe1b88144e99204b880e04ca3663cc0b9127be9e1e5c85854b55a9e655
Instruction ID: 000b72b7a39418e805a3c86bed67bd2e322e3202b7ea65a898a239d716730a5b
Opcode Fuzzy Hash: 1b36debe1b88144e99204b880e04ca3663cc0b9127be9e1e5c85854b55a9e655
Instruction Fuzzy Hash: AA41A7B4D04258DFCF10CFA9D884AAEFBF1BB48310F14906AE814BB210D334A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04947D40, Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 04947DF2

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0359f19816cf629eab475df1d01c1dd738a3796c269eebbece692439606d55a8
Instruction ID: 63424067011386e515ff46f106ed7ae55889389c13226503b024b59963aa56a4
Opcode Fuzzy Hash: 0359f19816cf629eab475df1d01c1dd738a3796c269eebbece692439606d55a8
Instruction Fuzzy Hash: 4C41A8B4D042589FCF10CFA9D884ADEFBF1BB49310F14906AE814BB210D334A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0494AAD4, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0494C421

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6e4797e79ab9e6acc94e69c6b7dd9a88fd20705e9b1490b3c51f7110f24d8c2d
Instruction ID: b2636779ff2c008181039639a338b4e443a31222f7f7fe4f7a99b9518653db59
Opcode Fuzzy Hash: 6e4797e79ab9e6acc94e69c6b7dd9a88fd20705e9b1490b3c51f7110f24d8c2d
Instruction Fuzzy Hash: B34107B8A04305DFDB14CF99C488BAABBF5FB88314F15C859D519A7325D374A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02301838, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 023018DF

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6bd56d65fc6df49f192c37e1ff843905063b7b05b0e8a424c207cad185e5fc9e
Instruction ID: 741268ae90d44630089bf10735deb4cd270d78a920155b20fb8e6c6017de13bb
Opcode Fuzzy Hash: 6bd56d65fc6df49f192c37e1ff843905063b7b05b0e8a424c207cad185e5fc9e
Instruction Fuzzy Hash: 1C3199B9D042589FCF10CFA9D984AEEFBF0BB59310F14902AE814B7250D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02309EC0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02309F67

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f79f9af424c63fff68acadeb1d94dd3cbd5a80ceb9ed0ed2d32d9e6253663a4a
Instruction ID: 867a74b4f21c1ae94c1ec125fdb162a9a9fc7752736dfc680fcfc8a11769032a
Opcode Fuzzy Hash: f79f9af424c63fff68acadeb1d94dd3cbd5a80ceb9ed0ed2d32d9e6253663a4a
Instruction Fuzzy Hash: 473197B9D04258DFCF10CFA9E984AEEFBB4BB49310F14902AE814B7250D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 023003E1, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(?), ref: 0230B8B2

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 099712f85f99ae068c7b653a5b49d3de9c5a19196671df5a48506774f92a002f
Instruction ID: 5f9bc2a96a53b490a8218b45c7f9a86221f1b009f124804370f6c426d10e1b6a
Opcode Fuzzy Hash: 099712f85f99ae068c7b653a5b49d3de9c5a19196671df5a48506774f92a002f
Instruction Fuzzy Hash: FB31EBB4D04248DFCB14CFA9D584AEEFBF5AB48314F14802AE814B7360D730A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04947A38, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 04947ACA

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1642ff305da1f86a9fb99f175616b2dee97844993e3aa06ee174e7aa3c0f7bcd
Instruction ID: 540889aa9cc9a093354b4498486520d9653875bb11842b808b851bbfb7c0d490
Opcode Fuzzy Hash: 1642ff305da1f86a9fb99f175616b2dee97844993e3aa06ee174e7aa3c0f7bcd
Instruction Fuzzy Hash: 6831CAB8D042099FCB10CFA9D884ADEFBF5AB48314F14806AE818B7350D374A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04D513B8, Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ab21e259bd893e6d4802f7e8877be5ddd15f52247d0d5a4579681824797ce0
Instruction ID: 6367ff26ca7a38c4d525f812ed0b7949801fcfa4f9be31c15f1a4825e9a92e9f
Opcode Fuzzy Hash: 57ab21e259bd893e6d4802f7e8877be5ddd15f52247d0d5a4579681824797ce0
Instruction Fuzzy Hash: 96522E34A0421C9FEF64DBA4C850F9EB7B2AF85304F1180ADD6066B365DF35AE419FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04D54238, Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1736019931eeda9f495dc8f6c1ed3cc32cbdcd51cd8f580bba39503f94b5247e
Instruction ID: e2c026d1dccebbe34aeb7dadea26e2d03885b6a79282cda61f5edee04c7b69a6
Opcode Fuzzy Hash: 1736019931eeda9f495dc8f6c1ed3cc32cbdcd51cd8f580bba39503f94b5247e
Instruction Fuzzy Hash: 64122C75B001149FCB14DF68D588AADBBF2FF89314B168069E915AB3B1CB34EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04D50618, Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76110e8c18459765b159da534675b262c335291a4aeb5ab61408653d6246445
Instruction ID: d7076643432e328a4f6948d07f4a50ef15b80329b9f656df3fb563d6a00588cf
Opcode Fuzzy Hash: c76110e8c18459765b159da534675b262c335291a4aeb5ab61408653d6246445
Instruction Fuzzy Hash: 14122430A002198FDF25DF69D584AAEBBF2BF48314F158569E949EB2A1DB30FD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04D50BF8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7bf25a1ae11375baba51a8f5c0c45abf8eac9db9dee08f5ea02819797f887aa
Instruction ID: fd8aee075e621de213327bc92be6bdcef070ddf862cc9932f50ce85eabf403c2
Opcode Fuzzy Hash: f7bf25a1ae11375baba51a8f5c0c45abf8eac9db9dee08f5ea02819797f887aa
Instruction Fuzzy Hash: CB71E2347406458FCF16DF28C888AAA7BE6BF49340B1940AAE806DB771EB74FC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04D5362B, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781a6da949fd4a8a86ec9db84ca642e87b8eabaf2b58f87233d3aaad9861482a
Instruction ID: 0d1e1583ec9fa5cde7a286a94d3ce808d76dae11879afbb74695916ba9a1dbf1
Opcode Fuzzy Hash: 781a6da949fd4a8a86ec9db84ca642e87b8eabaf2b58f87233d3aaad9861482a
Instruction Fuzzy Hash: 80419C35A04249DFCF15CFA4C844A9EBBB2BF49390F00815AEC15AB2A1DB35F914DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04D50E90, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ed2182cb97660fa1dcb1360e6314fcb38453218df878ca2a70ff5ba253c611
Instruction ID: 31cc7fff62ef564aa41c16b8c728442269f03aa62fa2f891bffd367467368391
Opcode Fuzzy Hash: 47ed2182cb97660fa1dcb1360e6314fcb38453218df878ca2a70ff5ba253c611
Instruction Fuzzy Hash: 7B2192313043158FDF161B359994A7A3B96EF85B08B18C47AED42CB7B5DF29DC029742

Uniqueness

Uniqueness Score: -1.00%

Function 04D59479, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649ce79425c0fa12c23212b856f33944058c2a8a3df675db6bf1a274a7195bac
Instruction ID: 6000fe77a9d2a7b1a62efc755e8259ed6aa4bbed7c86b660710c18fd1f09651d
Opcode Fuzzy Hash: 649ce79425c0fa12c23212b856f33944058c2a8a3df675db6bf1a274a7195bac
Instruction Fuzzy Hash: CE31F8B4E04219DFCB44CFA9C5815AEBBF2FB88300F1085AAD815A7724D7789A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04D50EA0, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbca510b8ccc1bb9102b7d7ed1dfd0a283919f09185d32e7c254ec124d16084c
Instruction ID: 8bcdadfa1f342c60940cc2bed5e9a9a88d7c3df711583c4ac45fb7b67aae0ef2
Opcode Fuzzy Hash: fbca510b8ccc1bb9102b7d7ed1dfd0a283919f09185d32e7c254ec124d16084c
Instruction Fuzzy Hash: 6D2150313043198BDF161A259994A7A369BEFC4B18F18C43AED02CF7B4EF29DC429781

Uniqueness

Uniqueness Score: -1.00%

Function 04D59488, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e4158545edccdc90bf8fdd88a281479e1d2642871fefde2f20b65fdede3ee5
Instruction ID: e78b03cb61463ffc6e1a029674a4725c995775e99f875b51fa57cddd40b9f616
Opcode Fuzzy Hash: 60e4158545edccdc90bf8fdd88a281479e1d2642871fefde2f20b65fdede3ee5
Instruction Fuzzy Hash: 6231DAB4E04219DFCB44CFA9C5905AEFBF2FB88300F5095AAD819A7714D778AA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04D57C43, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e276bccc22c642744403f32b98e0e20cd128c88c2ef92987239c2eb28354b8c
Instruction ID: 6585bfee0e98949b355b72152ac7cc0151c1358dfe1fdcbe63d018296f2b65e4
Opcode Fuzzy Hash: 0e276bccc22c642744403f32b98e0e20cd128c88c2ef92987239c2eb28354b8c
Instruction Fuzzy Hash: 4B11EF303482102BFB2826311C6AB7F2A57EBC5794F248439F606AE7D0CE78AC034399

Uniqueness

Uniqueness Score: -1.00%

Function 04D595B1, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658380d015d3084153675fbb03ca06680634188db7002cf8aaf668a62b8387a5
Instruction ID: cf8052dbe0e44ba29b1942dafe39ccc7fbdd0070f4792a306a0d355dcdf2c721
Opcode Fuzzy Hash: 658380d015d3084153675fbb03ca06680634188db7002cf8aaf668a62b8387a5
Instruction Fuzzy Hash: AE31E8B0E05219DFCB44CFA9C59099EBBF2FB89310F1594A6C418A7325E7349A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04D5B169, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e29bdcb2288ac76a2b8cd6ddafd240c43cbcfd3966625e7768e1b26f74d2848
Instruction ID: bec2b009260dea612a506cf3dbc692ef60bf75f1b3827f34fd051deff5c9a0f0
Opcode Fuzzy Hash: 5e29bdcb2288ac76a2b8cd6ddafd240c43cbcfd3966625e7768e1b26f74d2848
Instruction Fuzzy Hash: 65310B70E05209DFCB84DFA5D5459AEBBF1FF89340F25C4AAD844AB225EB34AA01DF50

Uniqueness

Uniqueness Score: -1.00%

Function 04D52590, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173d3f9459605ba484f3c67c6e06a48ab5a3482bf9388191577cd4a36552112c
Instruction ID: 2001bff86f8f1ef8ded72a07e61fd9129f0922c78c627efb217fe9e6cf2ad7ad
Opcode Fuzzy Hash: 173d3f9459605ba484f3c67c6e06a48ab5a3482bf9388191577cd4a36552112c
Instruction Fuzzy Hash: 52212A70A002199BDF14DFA5E954BAEBBB5BF44704F104069E901BB3A0EF75A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04D52689, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8294fd6290cc23e4f7922b1ad43868d6d7279f2eb4ba19dcb2ca1f82bc6127
Instruction ID: 56d7ab860198d71dd09bf4bb6ee1f61102b4e1c21cbe661a4327f744b2d07d94
Opcode Fuzzy Hash: 4b8294fd6290cc23e4f7922b1ad43868d6d7279f2eb4ba19dcb2ca1f82bc6127
Instruction Fuzzy Hash: D8217770A012489FDF04DFA5D550AEEBBB2BF49300F248069E911B6260DB34AA49CF20

Uniqueness

Uniqueness Score: -1.00%

Function 04D5B288, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998bf21c03fcafc8610a9cb611c0973d6aba61d17e76022ca426aee6a44a8b17
Instruction ID: ff7f637259e43192a01f6f2b9ce792ebaa75d5b743732ae3bb2ce53e2b3ec116
Opcode Fuzzy Hash: 998bf21c03fcafc8610a9cb611c0973d6aba61d17e76022ca426aee6a44a8b17
Instruction Fuzzy Hash: 3D11F934E04218DFDB44DFA9D554A5EFBF2EF89200F15C4AAD819A7365DB30EA00DB51

Uniqueness

Uniqueness Score: -1.00%

Function 04D55180, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bd8c835f8273e0041a5d8bbf3d04b7b6b105ef70b264c0048aed473d448ca3
Instruction ID: 6c7de131ecc34f2c09dbb60eb1a7c4efd8bedc254d4dde7954771633317ce5ed
Opcode Fuzzy Hash: 61bd8c835f8273e0041a5d8bbf3d04b7b6b105ef70b264c0048aed473d448ca3
Instruction Fuzzy Hash: DD117370E05208EFCB48DF64E5505AEBBF2FB89314F10D465D805A7258EB309A01DB00

Uniqueness

Uniqueness Score: -1.00%

Function 04D53F08, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508f547c17780a62008a246026fbb5ed88c0b8dd2766a603a25235cdd01e4c6a
Instruction ID: 5256c9d3aa6605a2757a72cdc09db330180cd7556d3b8aeb499ea0ae3bfa05a4
Opcode Fuzzy Hash: 508f547c17780a62008a246026fbb5ed88c0b8dd2766a603a25235cdd01e4c6a
Instruction Fuzzy Hash: 8BF06D313046159B8B159A2E9884A2EB6EEFFC8B91715407AFD19CB371DE70EC028690

Uniqueness

Uniqueness Score: -1.00%

Function 04D5A2B2, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7bbe01f0330e19ad66a2819d3ba3d21b54b16fb1ed5f998df8b23e331ac1f5
Instruction ID: df92e407217da87e9a86fcf96f135d6610fa60829b37695555459d6e402a78e2
Opcode Fuzzy Hash: cf7bbe01f0330e19ad66a2819d3ba3d21b54b16fb1ed5f998df8b23e331ac1f5
Instruction Fuzzy Hash: BB01D674A02298CFCB61CF64C994B9DBBB1FB49301F6040DAD849AB355DB359E85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 04D57E0F, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dad0ed9e2199e34136f2fbf30a20e1e7e4acca66815c138ec026619c5c593b
Instruction ID: efaa44ad8c8e7bb0f31b0f0ef093b350724676528d8cf2b38432878770b5d860
Opcode Fuzzy Hash: 33dad0ed9e2199e34136f2fbf30a20e1e7e4acca66815c138ec026619c5c593b
Instruction Fuzzy Hash: BAE08C70016200DFD700AFB0F96D2C83FB8EB06366F0145A6D849C2216EB390C07D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 04D58636, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1400713fd935d731bcccc3ab6e0c645fd29ebd5c0575decedf4b3cdb8d02969c
Instruction ID: 064405fc2bec738a34d9efffd45d1b41539197dc12bd38a28e507046f3c74e07
Opcode Fuzzy Hash: 1400713fd935d731bcccc3ab6e0c645fd29ebd5c0575decedf4b3cdb8d02969c
Instruction Fuzzy Hash: 3BF01770E012288BDB54DF99895078DFAB3BB8A200F10C1AAD008A7354E6305E81CF01

Uniqueness

Uniqueness Score: -1.00%

Function 04D51E20, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: a59531b2756026bbef6e9e15f36740f7b43a44f3ddc1806d352ed306ac2cc47e
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: C4C01233A4C1282AAA25108EBC40AABAA8CD3C13B4A210137F95C83200AC42AC8101A4

Uniqueness

Uniqueness Score: -1.00%

Function 04D5A752, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7d08e8c63de56219c1949285d252975d368ce7f33a6cd34c5a4250ba6858f0
Instruction ID: 9265613e68b3dd1b1ea621e1fb9436b3fa8e7a11c6a62f912d5c99b5e04293df
Opcode Fuzzy Hash: 4d7d08e8c63de56219c1949285d252975d368ce7f33a6cd34c5a4250ba6858f0
Instruction Fuzzy Hash: 3BE0C9B4A4521ACFCB64CF68C940A9DB7B1BF48300F2041AAD929A7754E7319A81DF40

Uniqueness

Uniqueness Score: -1.00%

Function 04D57E20, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7316fd003096231d57d81af856c0168b720b4e5ef1322d1b52744aab816fd8
Instruction ID: 805bd72768a02c8aa19e82526680d5505a6edad91a71e8d46f00785f40e0f865
Opcode Fuzzy Hash: ef7316fd003096231d57d81af856c0168b720b4e5ef1322d1b52744aab816fd8
Instruction Fuzzy Hash: 41D09E34515214DFC704AFB4F91C61D7BA8F705356F1141A9D849C2215DF751C04C6B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02305440, Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

mPk4, xrefs: 0230565A
"5, xrefs: 023054F6

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: mPk4$"5
API String ID: 0-3415938282
Opcode ID: 5e8fb5e497fcdbf16696583ef39f41cc32d843e05b95a2af5247b7cd30038298
Instruction ID: b088d66f6f2ed840216ed08c7e2893dc6c62a6efc2325640da0e785418468862
Opcode Fuzzy Hash: 5e8fb5e497fcdbf16696583ef39f41cc32d843e05b95a2af5247b7cd30038298
Instruction Fuzzy Hash: 7A810E70E152099FCB48CFA9D49089EFBF2FF88310F54D56AE419AB265D730AA41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02305431, Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

mPk4, xrefs: 0230565A
"5, xrefs: 023054F6

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: mPk4$"5
API String ID: 0-3415938282
Opcode ID: 2488245654ecff4432fe2cb90a88746a2761690d9492a5c7922ad7c5d37c93b3
Instruction ID: 87e84ebc577437c7576b88ac871981bd1370ad172802bb6cf9a04a655ea7b031
Opcode Fuzzy Hash: 2488245654ecff4432fe2cb90a88746a2761690d9492a5c7922ad7c5d37c93b3
Instruction Fuzzy Hash: 78810F34E152099FCB48CFA9D49489EFBF2FF88310F54C56AE419AB265D730AA41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02303158, Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

hhD, xrefs: 02303373

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: hhD
API String ID: 0-2632166695
Opcode ID: 3481fa692206ec8d9e1c3167a18b0b40948184b350b869f81dacd460ee9d4f10
Instruction ID: 80b2fc79732f2ddc5570099a4124c85ae2e0e97b9778e7f6700440524840ed0d
Opcode Fuzzy Hash: 3481fa692206ec8d9e1c3167a18b0b40948184b350b869f81dacd460ee9d4f10
Instruction Fuzzy Hash: 85614CB4E1420ADFCB08CF99D4909AEFBB1FF88350F14956AD415A7355D734AA42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02303149, Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

hhD, xrefs: 02303373

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: hhD
API String ID: 0-2632166695
Opcode ID: c339d8a26ef2d008c248f96ff65c7f32ee16ec63e3705befc34b7338c778149c
Instruction ID: 81c74d475fa002a1e901f1193e2a8485b34b65c8ff786a3491f1a2bc167b3e02
Opcode Fuzzy Hash: c339d8a26ef2d008c248f96ff65c7f32ee16ec63e3705befc34b7338c778149c
Instruction Fuzzy Hash: 54614FB4E1420ADFCB08CFA9D4909AEFBB1FF89310F1495AAD415A7355D7349A42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 023068F8, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

W~e, xrefs: 02306952

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: W~e
API String ID: 0-238959554
Opcode ID: de0ff13d791deda01d996c44e87d251972dc59eb643c17d94e5cdee7866b7fa5
Instruction ID: 38d1a02b0c60b37f10ca89277a79724ad6137254cfd3bbba1866eef908880238
Opcode Fuzzy Hash: de0ff13d791deda01d996c44e87d251972dc59eb643c17d94e5cdee7866b7fa5
Instruction Fuzzy Hash: 306104B4E1421ADBCB08CFAAC5919DEBBF6FB88210F24902AD415B7655D7309A41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 023068E8, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

W~e, xrefs: 02306952

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID: W~e
API String ID: 0-238959554
Opcode ID: 3a6ef731aaf24227b95e22147b8160d556469e2cd92976281162f67d5dd27f00
Instruction ID: 149a194a35e8f8ef7656a21fe687e5560165a3586b6916745dc078bb6a0472ca
Opcode Fuzzy Hash: 3a6ef731aaf24227b95e22147b8160d556469e2cd92976281162f67d5dd27f00
Instruction Fuzzy Hash: B8611474E0420A8FCB08CFAAC5919DEFBF6FF88210F24946AD405B7659D3309A41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04948030, Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f0668c75cbd8e65e6757450be29ec55305ea6dd3b6d89e5953d06269868a44
Instruction ID: b221729fd31380e5bb970775888e6de9b6e18c2e2abcaf72b443867218ec6cfb
Opcode Fuzzy Hash: 37f0668c75cbd8e65e6757450be29ec55305ea6dd3b6d89e5953d06269868a44
Instruction Fuzzy Hash: A15237B0D80B06CFD710CFA8F88C5997BB1FB85318F608A19D5615F291D3B965AACF48

Uniqueness

Uniqueness Score: -1.00%

Function 04945628, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa6e247f6b5ce852971c117cf8c633037bbfa74127fb801675bd8b6d0015ba6
Instruction ID: f8e78dd31da3761c8771324c8727759b147ae186c58b4ca6d6595b2a55417fc8
Opcode Fuzzy Hash: 6fa6e247f6b5ce852971c117cf8c633037bbfa74127fb801675bd8b6d0015ba6
Instruction Fuzzy Hash: 7AA18F72E102198FCF05DFB5C84499EBBB6FFC9304B1585BAE905BB221EB35A915CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0230A2A8, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05723add78699ab3bbd96789600aef2fc64032044e1c3988be21af65581a3872
Instruction ID: c90793236ddcf3957ddc5a4fbfe8f8b7539525af0c045d8b4c5c7b5dcaffec6b
Opcode Fuzzy Hash: 05723add78699ab3bbd96789600aef2fc64032044e1c3988be21af65581a3872
Instruction Fuzzy Hash: 38A15974E042298BCB14CFA9D9906ADFBF2BF89304F24C16AD919AB356D7309941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02306010, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b97487068b4b1d29b821b6f0c1fcfba20ed231ff3bd36cfeec0a0da16f7f0a
Instruction ID: 89e744a796b24543c8a36a80c5a0889febe05c38556c1b03a2a547eae4b42862
Opcode Fuzzy Hash: f0b97487068b4b1d29b821b6f0c1fcfba20ed231ff3bd36cfeec0a0da16f7f0a
Instruction Fuzzy Hash: EE714AB0D0421ACFCB04CF99C5919AEFBBAFF48310F148516D415AB356D734AA92CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04D5C630, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11a70266696addcbc75d2b432431e74cce6dd39413757e554c801a245295dbc
Instruction ID: ef1391acb6aca0f3f399e23bbd66631a4983785a4a77b8556cd8bfeaae6a2d6d
Opcode Fuzzy Hash: c11a70266696addcbc75d2b432431e74cce6dd39413757e554c801a245295dbc
Instruction Fuzzy Hash: 7771F3B4E1421ACFCB04CF9AD5848AEFBB2FF49610F15955AD814A7324DB30AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04D5C621, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3502a20c9f83234cfe1a2dfd89b3c75d7ac6682763f16b64afcb79a3df3a04f
Instruction ID: 16378f808b8f04fe5cc9b4648857e77e7b712bcb8cd5c4eca902b171ca53abac
Opcode Fuzzy Hash: c3502a20c9f83234cfe1a2dfd89b3c75d7ac6682763f16b64afcb79a3df3a04f
Instruction Fuzzy Hash: 52610274E1420ACFCB04CF99D5848AEFBB2FF49710F159856D814A7324DB34AA82CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04D5CE91, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61304b739fd90ad59ad51e9109493cb664db34858d7a40ef0618e3479af8279b
Instruction ID: 3424a218f23e38d741c91743ca98dd8bd58b59d5751276f2dbe0681ef4f5a63f
Opcode Fuzzy Hash: 61304b739fd90ad59ad51e9109493cb664db34858d7a40ef0618e3479af8279b
Instruction Fuzzy Hash: 0051E375E15209CFDF04CFA9D5849DEFBF2FF88210F14942AD816B7224E734AA468B64

Uniqueness

Uniqueness Score: -1.00%

Function 04D5CEA0, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8e7ad2d7a71cddccddc0450f625274ee02b5faf622cd1993517991c9838de
Instruction ID: d4dc1bc0a404a778543ae5ec1fe25ee828f5a1fb417311970477bb819e7d4e16
Opcode Fuzzy Hash: 7fb8e7ad2d7a71cddccddc0450f625274ee02b5faf622cd1993517991c9838de
Instruction Fuzzy Hash: 4251E374E152099FCF04CFA9D5849DEFBF2BF89210F14942AD816B7324E734AA428F64

Uniqueness

Uniqueness Score: -1.00%

Function 04D5D098, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fd5e2ed3c7593bc5aa89b1ae7387a493d7fb905110744e92dc16e266e98b0a
Instruction ID: 87caee2880ffb980f96a0ad5367715ed4e6bb03ab8a012bb96385239240369fa
Opcode Fuzzy Hash: a2fd5e2ed3c7593bc5aa89b1ae7387a493d7fb905110744e92dc16e266e98b0a
Instruction Fuzzy Hash: AE410D71E0520A9FDF04CFA9D5815EEFBF2FF98310F24D466C905A7214E734AA428BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02307898, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128799639f8cccc1309fd14e78dc4dc5a31e61f04a0eb7ee081884da75d0a989
Instruction ID: a062f56ad87606f116831119f9c5e371c37ca62704b153dc3723fcdcea68ec60
Opcode Fuzzy Hash: 128799639f8cccc1309fd14e78dc4dc5a31e61f04a0eb7ee081884da75d0a989
Instruction Fuzzy Hash: 64514AB1E056188BDB58CF6BCD4479AFBF3AFC8300F14C1BA950CA6265DB305A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 04D5D0A8, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7855f043d312614103bf20657b1a1755ce0fd3de34512ff5f3c5f1cdc993d1bd
Instruction ID: 004138f64a26280af0f5cb2bc8634b2003d7a5e92ef56fe3aeea6ab64cd7f387
Opcode Fuzzy Hash: 7855f043d312614103bf20657b1a1755ce0fd3de34512ff5f3c5f1cdc993d1bd
Instruction Fuzzy Hash: 7541C770E0560A9FDF04CFA9D5415AEFBB2BB88300F24D46AC905A7254E734AA418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 023066C0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8bcf09b6c480f941b36b64f06779e285fe458ce7b8e1346eff5e4dadfa1380
Instruction ID: c4f7d7f2779e07fd57af17d943ef400edcec63cb8f91eea4143b322a8944d1f5
Opcode Fuzzy Hash: bc8bcf09b6c480f941b36b64f06779e285fe458ce7b8e1346eff5e4dadfa1380
Instruction Fuzzy Hash: 2D412A70D0561ADFDB08CFAAC5911AEFBF6BF88300F24D42AC515A7249E3349651CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04D5CC70, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13254982d0a5b2584b060c260af6d24b8b8079876b9b4b3e860be209a14880a8
Instruction ID: 83a4e05ac2fea3e4bcc7690b09415f3fa94643403be1624db96f0fba48b11171
Opcode Fuzzy Hash: 13254982d0a5b2584b060c260af6d24b8b8079876b9b4b3e860be209a14880a8
Instruction Fuzzy Hash: 9041E870E1520A8FCB44CFAAC5805AEFBF2FF88300F24C46AC915A7214E734AA418F94

Uniqueness

Uniqueness Score: -1.00%

Function 02304A08, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca8d10918c8a117ecaf175e7d94ccc777559847433675b2c262be0e6c53b4ca
Instruction ID: 9bb8451959ad1ff6eef66fef9a2553eabbda0e711bf644329ef79eb1a55043ef
Opcode Fuzzy Hash: 3ca8d10918c8a117ecaf175e7d94ccc777559847433675b2c262be0e6c53b4ca
Instruction Fuzzy Hash: 52415670E152198FCB04CFAAC9805EEFBF1BF89310F14956AD514BB365D3349A42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02306B50, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572af641c926efe60657f187b898e679b19eb351fb099f9cf0a3c0b320f86da2
Instruction ID: b9cbba8f2a26028031b2d37286060cd3aab34d9ac1011cf5af3812262941e184
Opcode Fuzzy Hash: 572af641c926efe60657f187b898e679b19eb351fb099f9cf0a3c0b320f86da2
Instruction Fuzzy Hash: A2410AB0E0520A8BCB08CFAAC5915AEFBF6FF88310F24D569C405B7259D7349A51CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04D5CC80, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263724129.0000000004D50000.00000040.00000001.sdmp, Offset: 04D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8617f5b821c0f5ec6ca4327a824d3c15c761ab20f1516ceec75f5ca62e108684
Instruction ID: bfca54cdbed3e024110a645d82f30f99727cc39b8696cb9c4bd750e8b642faca
Opcode Fuzzy Hash: 8617f5b821c0f5ec6ca4327a824d3c15c761ab20f1516ceec75f5ca62e108684
Instruction Fuzzy Hash: 5A41C870E1560A9BCF44CFAAC5805AEFBF2FF88740F24D46AC915A7214E734AA419F94

Uniqueness

Uniqueness Score: -1.00%

Function 0494A948, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518d2c4f625a766fab878a86b2354790339bab64d5e107b1c59e15ed2ed930c5
Instruction ID: d16bdeeafafd49494bcf6648b42630a49716cd1402fede31ec338d3211f59d7b
Opcode Fuzzy Hash: 518d2c4f625a766fab878a86b2354790339bab64d5e107b1c59e15ed2ed930c5
Instruction Fuzzy Hash: F631BBB4D052589FCB14CFA9E984ADEFBF1BB89310F14902AE804BB350D374A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04946F14, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263332270.0000000004940000.00000040.00000001.sdmp, Offset: 04940000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d57407ac0e32147aafdf03e7a3b966aef729f1101d4c3f3274a18cdcc3e0ca
Instruction ID: 2ff07e349b86c8d40e0056064441fffca9ebcd622dfa7c57b4768ab96a232d03
Opcode Fuzzy Hash: f9d57407ac0e32147aafdf03e7a3b966aef729f1101d4c3f3274a18cdcc3e0ca
Instruction Fuzzy Hash: FC31BBB9D052589FCB10CFA9E984AEEFBF5BB89314F14902AE804B7350D374A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0230A8B0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5049464fcc3f0848ae56d84bbba970ecb7ef741d202b3659998b92313e859f02
Instruction ID: 62888abfe6a81b5c087a8daa53492bfe8616fb7acc935ef00e15d5cde407ffdb
Opcode Fuzzy Hash: 5049464fcc3f0848ae56d84bbba970ecb7ef741d202b3659998b92313e859f02
Instruction Fuzzy Hash: 57313770E152199FDB08CFAAE890A9EFBF7BF88214F14C16AD508A7355D7309A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02301948, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e30613168705b2403db92b8b82349c7b71040c066b328d3fc9e5dac0c180b0
Instruction ID: fd6550933115bc7351f4f03f9fad68ac5a981563aaa932972bb6c7db45434d13
Opcode Fuzzy Hash: a8e30613168705b2403db92b8b82349c7b71040c066b328d3fc9e5dac0c180b0
Instruction Fuzzy Hash: 4A21B671E006189BEB18CFABD854B9EFBF7AFC9200F04C1AAD908A7254DB3059458F61

Uniqueness

Uniqueness Score: -1.00%

Function 02306D30, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bdc7ac944fae5995949b720565888922dc89a035e26ec4ba07004f9324ce24
Instruction ID: 19028b296dc7726933dfc4e33d28f0881174fd681b7e628c547bee7cbdc38c82
Opcode Fuzzy Hash: c6bdc7ac944fae5995949b720565888922dc89a035e26ec4ba07004f9324ce24
Instruction Fuzzy Hash: 39212D71E016189BEB58CFABD94079EFBF3AFC8300F04C07AD508A6264DB301A458F61

Uniqueness

Uniqueness Score: -1.00%

Function 02306D20, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258121727.0000000002300000.00000040.00000001.sdmp, Offset: 02300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a109f790bf1a77b833ce5e945b898512b077810af8c1fd24c3d5622b2c49e04
Instruction ID: f337ad56f1147729debac268a8e481cc779f18148327e24e8e714c6cd88fdbbf
Opcode Fuzzy Hash: 1a109f790bf1a77b833ce5e945b898512b077810af8c1fd24c3d5622b2c49e04
Instruction Fuzzy Hash: 33312D71E056589FEB58CFABC95069EFBF3AFC9300F04C1BAD508AA265DB3049458F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PRODUCT INQUIRY FROM PAKISTAN.exe PID: 5388 Parent PID: 5448 PRODUCT INQUIRY FROM PAKISTAN.exeCOMMON

Executed Functions

Function 012B8D68, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B8DC7

Memory Dump Source

Source File: 00000004.00000002.503796956.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a4857711cd5072ac372359eb60b8fd41c9bc6c8511d2766221e7edc7b2b7c67f
Instruction ID: 5daa32b2abba09949ea3153bbab1a368258184ebb617a41f3ca7f0bc3ab27fc4
Opcode Fuzzy Hash: a4857711cd5072ac372359eb60b8fd41c9bc6c8511d2766221e7edc7b2b7c67f
Instruction Fuzzy Hash: 4151C531B102169FCB44EFB4D884AEEB7B6BF88344B548529D512AB395EF70EC04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01402298, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 014027FB

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ba3a4f8abd676b7c8a6ca0d8044321a5cd1205e53d8bcf5088277e00415e8f09
Instruction ID: 77f59316fd2feb7b5e2c6e5adb896a0db0103c225fa0249bb534e58c040f8496
Opcode Fuzzy Hash: ba3a4f8abd676b7c8a6ca0d8044321a5cd1205e53d8bcf5088277e00415e8f09
Instruction Fuzzy Hash: F52149759042599FCB54CF9AD848BEEFBF4FB88314F10842AE419A7390D7B4A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014B0A70, Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 984libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0AB5
KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Strings

x?l, xrefs: 014B230A

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID: x?l
API String ID: 2638914809-1752844993
Opcode ID: f63d971c2cdcf95dd1a0b00afb6976684cce5f9a31f7948526b07e3c695a1a3f
Instruction ID: 16177b4ec894eac5a1d9b73460247009ec9020790d538eb94b22a7f65a790a8b
Opcode Fuzzy Hash: f63d971c2cdcf95dd1a0b00afb6976684cce5f9a31f7948526b07e3c695a1a3f
Instruction Fuzzy Hash: D4A209B4A04228CFCB64EF20D89469DB7B6BF88305F5085E9D909A7754CF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B0A91, Relevance: 6.6, APIs: 4, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0AB5
KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 431bd3772dbc6736d1abda416ad28390f764e2867045821c96e7ea950f03d957
Instruction ID: 9caffd28bfff66c4b786bd626c07641e7add919253aa5ba969a844b2b394b39f
Opcode Fuzzy Hash: 431bd3772dbc6736d1abda416ad28390f764e2867045821c96e7ea950f03d957
Instruction Fuzzy Hash: EA62F8B4A0422CCFCB65EF20D89469DB7B6BF48205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0AD6, Relevance: 5.1, APIs: 3, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 58517e98e9a26ef57d0c121e996db3df15a2c490c1c0a0cd370697aa30c660dd
Instruction ID: 148a98c0d0087429237889548b164bb96a62a5232118b2f9698f5020feb2f3dd
Opcode Fuzzy Hash: 58517e98e9a26ef57d0c121e996db3df15a2c490c1c0a0cd370697aa30c660dd
Instruction Fuzzy Hash: AD52F9B4A0422CCFCB64EF20D89469DB7B6BF48205F5084EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0B1B, Relevance: 5.1, APIs: 3, Instructions: 621libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: fb1af61e41786b11a6c4fad58176dc172f1fa86161c3e29ac33a7cbecb0e41ce
Instruction ID: bf4ae21e8bd32f2f75bd48371e07e10be178b42b6894aca78afc175ecbe2bf20
Opcode Fuzzy Hash: fb1af61e41786b11a6c4fad58176dc172f1fa86161c3e29ac33a7cbecb0e41ce
Instruction Fuzzy Hash: 0952F9B4A0422CCFCB64EF20D89469DB7B6BF49205F5084EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0B57, Relevance: 5.1, APIs: 3, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5f43c00c4388650e3ee8db2ec92082d2feba9be4737b71b8111af47b6096fc70
Instruction ID: 917060b3e496f23e0ebb88d9cb910b3a2879b4e5d00a48f5edb0a7b377db5ee3
Opcode Fuzzy Hash: 5f43c00c4388650e3ee8db2ec92082d2feba9be4737b71b8111af47b6096fc70
Instruction Fuzzy Hash: FC52F9B4A0422CCFCB64EF20D89469DB7B6BF48205F5085EAD909A3754CF749E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0B9C, Relevance: 5.1, APIs: 3, Instructions: 607libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e9680f479d28bd4c3982a507836597e7160275870940a029f5c6650adedc8322
Instruction ID: 85994f4c9ec2ce7944ee40367227f05f4bb68e1fbc5ffb209e42cd7ab443f2fb
Opcode Fuzzy Hash: e9680f479d28bd4c3982a507836597e7160275870940a029f5c6650adedc8322
Instruction Fuzzy Hash: F052FAB4A0421CCFCB64EF20D89469DB7B6BF48205F5085EAD909A3754CF749E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0BD8, Relevance: 5.1, APIs: 3, Instructions: 602libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b2df229d15f6c6c2727eebfc96c1d9004a16b4a2dbccdc43672fe1001b39196a
Instruction ID: 89824b254ceca094b9f94c245e04fa077b73e9d372fa4dac56fbe207ac39c03a
Opcode Fuzzy Hash: b2df229d15f6c6c2727eebfc96c1d9004a16b4a2dbccdc43672fe1001b39196a
Instruction Fuzzy Hash: 9252FAB4A0421CCFCB64EF20D89469DB7B5BF48205F5085EAD909A3754CF749E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0C1D, Relevance: 5.1, APIs: 3, Instructions: 595libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f71957dcdb515bab0e2e9dcb355d640d8e2dfb90a66215afea23c6164efdc76b
Instruction ID: 16f2548a7c4d6e0c0e278cbca4cdded00fa0c2569b6cca1f298d685145efe1a6
Opcode Fuzzy Hash: f71957dcdb515bab0e2e9dcb355d640d8e2dfb90a66215afea23c6164efdc76b
Instruction Fuzzy Hash: F652FAB4A0421CCFCB64EF20D89469DB7B5BF88205F5085EAD909A3754CF749E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0C62, Relevance: 5.1, APIs: 3, Instructions: 588libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 6ff94f699d88f57dd0f417900edfc37656f2af8bd163de1d839e7df8363cde60
Instruction ID: 764fd206b357ba9aca8f06090931b6d78c5515edacea9fc22c4492be49e423ca
Opcode Fuzzy Hash: 6ff94f699d88f57dd0f417900edfc37656f2af8bd163de1d839e7df8363cde60
Instruction Fuzzy Hash: FF52FAB4A0422CCFCB64EF60D89469DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0CA7, Relevance: 5.1, APIs: 3, Instructions: 581libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: c28fad4c9afc06774ffd4161266e7c98ff47a5b3dd7b362f40d7a8ff42df9901
Instruction ID: 2745252b4419e0d027e15188f64afed39d27e953ec41f3715e302074c74c40da
Opcode Fuzzy Hash: c28fad4c9afc06774ffd4161266e7c98ff47a5b3dd7b362f40d7a8ff42df9901
Instruction Fuzzy Hash: D242FAB4A0421CCFCB64EF60D89469DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0CEC, Relevance: 5.1, APIs: 3, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: de898cd20a7ef73a881ccc1364a7fcb52765d3055af09bf8c47e1a9f1716a51a
Instruction ID: 081fe3d8940a15370ebfb0c859fb0b88a79784626b53f07c29dc3d7f7dfe58d1
Opcode Fuzzy Hash: de898cd20a7ef73a881ccc1364a7fcb52765d3055af09bf8c47e1a9f1716a51a
Instruction Fuzzy Hash: F442EAB4A0421CCFCB64EF60D89469DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0D31, Relevance: 5.1, APIs: 3, Instructions: 565libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ed33eed7ca0bf0881ef1ce0274b2417876e31d0c1c620e9b7a6c3bf9e0d8ffb1
Instruction ID: b3b968c43cf055eaf133644fa9d046e8f8b7e577335f384df42d315da271cb40
Opcode Fuzzy Hash: ed33eed7ca0bf0881ef1ce0274b2417876e31d0c1c620e9b7a6c3bf9e0d8ffb1
Instruction Fuzzy Hash: 3542EAB4A0421CCFCB64EF60D89469DB7B6BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0D6D, Relevance: 5.1, APIs: 3, Instructions: 560libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8234ffdf02dc622c054635dd1a61ca1838c426bceb41aef6df214c85e7bfb244
Instruction ID: f402ac348b2b8ae09957d0b382b3717e314a5389610021caf8824477f5e7d424
Opcode Fuzzy Hash: 8234ffdf02dc622c054635dd1a61ca1838c426bceb41aef6df214c85e7bfb244
Instruction Fuzzy Hash: AC42EAB4A0421CCFCB64EF60D89469DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0DB2, Relevance: 5.1, APIs: 3, Instructions: 553libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B0DD6
KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 4c9b491f77374c8ad0a187293fb35465111e6e184901eaada2e99bd4eec61ede
Instruction ID: 69a82c07ca8fde32d0d07898debe38765d71184cccc26717e54f12a30c08997b
Opcode Fuzzy Hash: 4c9b491f77374c8ad0a187293fb35465111e6e184901eaada2e99bd4eec61ede
Instruction Fuzzy Hash: 7542EAB4A0422CCFCB64EF60D89469DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0DF7, Relevance: 3.5, APIs: 2, Instructions: 546libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9e69b2ccefe566e0b131257bd1d7ebe30684069c182b85a49955813c8debf16a
Instruction ID: d0d5fa55aabe9a008c4d49cc6149ebcba7fb89ac822f4a8f035cecd11f2d61a7
Opcode Fuzzy Hash: 9e69b2ccefe566e0b131257bd1d7ebe30684069c182b85a49955813c8debf16a
Instruction Fuzzy Hash: 6242FAB4A04218CFCB64EF60D89479DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0E3C, Relevance: 3.5, APIs: 2, Instructions: 539libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: c1c1cf51129d2c586087754373514626790ca9d69fe372cd3ff66d7bd219bb0b
Instruction ID: 9b89159382327d5dc618254ca138cf0dbd2bc16d85c401976b7406bafae66a6e
Opcode Fuzzy Hash: c1c1cf51129d2c586087754373514626790ca9d69fe372cd3ff66d7bd219bb0b
Instruction Fuzzy Hash: 2D42FAB4A04218CFCB64EF60D89479DB7B5BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0E81, Relevance: 3.5, APIs: 2, Instructions: 530libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 6b07db7f9fd0fe4a63d5d5aa010bb46931da28aca921511b1b879710ded79e20
Instruction ID: 5adf61e3e09921915db4f6387eabb09d850b943f284bc4d640f02ac2271c8fcf
Opcode Fuzzy Hash: 6b07db7f9fd0fe4a63d5d5aa010bb46931da28aca921511b1b879710ded79e20
Instruction Fuzzy Hash: 5532FAB4A04218CFCB64EF60D89479DB7B6BF88205F5085EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0EBD, Relevance: 3.5, APIs: 2, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 79fd06bd069e62d1ed7145966ba078d8b942be39e952ba56cb1897330eac5552
Instruction ID: 6e3f48b331509d3641a783e39172d2e071f8cbfda85cb7429d14e57d60905c17
Opcode Fuzzy Hash: 79fd06bd069e62d1ed7145966ba078d8b942be39e952ba56cb1897330eac5552
Instruction Fuzzy Hash: 7B320AB4A04219CFCB64EF60D89879DB7B5BF88205F5084EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0F02, Relevance: 3.5, APIs: 2, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: de9191ea092364294cb2cbc28fbbf5a57d42e286d0681d6eba04b07e815bfe9a
Instruction ID: 955c8ec75482c4c634396736fd7a699d0db44fac1327f031ee43ebb860743c61
Opcode Fuzzy Hash: de9191ea092364294cb2cbc28fbbf5a57d42e286d0681d6eba04b07e815bfe9a
Instruction Fuzzy Hash: 35320AB4A04218CFCB64EF60D89879DB7B5BF88205F5085E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0F47, Relevance: 3.5, APIs: 2, Instructions: 511libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: bbdfa996fbe72be49da9ad5b036f31399788d154662e1dfc381aba8a0eb19c67
Instruction ID: 02bb5588331b9e7d62cd931ed8654dae477a7897723754dd5c3e477eb9fe131b
Opcode Fuzzy Hash: bbdfa996fbe72be49da9ad5b036f31399788d154662e1dfc381aba8a0eb19c67
Instruction Fuzzy Hash: 32320AB4A04219CFCB64EF20D89879DB7B5BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0F8C, Relevance: 3.5, APIs: 2, Instructions: 504libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0a47247542f795c232d9b182e0ff3c8e592e236f78c3976d78fdb3c153e26eb2
Instruction ID: 293da73ef8ba601cd0ec9ce27f607f9451997a85873513e08b6c1bb7d7905390
Opcode Fuzzy Hash: 0a47247542f795c232d9b182e0ff3c8e592e236f78c3976d78fdb3c153e26eb2
Instruction Fuzzy Hash: A4320AB4A04218CFCB64EF24D89879DB7B6BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0FE7, Relevance: 3.5, APIs: 2, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: b59ea6bcf7066d8c01a9b4df4fe25de9f5270d664a088d1871ec490bd3c2865b
Instruction ID: 252b3b65b6bfb6b9a85b3bf67cbe9e04250388c873e169d942b1032a167eabff
Opcode Fuzzy Hash: b59ea6bcf7066d8c01a9b4df4fe25de9f5270d664a088d1871ec490bd3c2865b
Instruction Fuzzy Hash: C132FAB4A04219CFCB64EF24D89879DB7B5BF88205F5084EAD909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B102C, Relevance: 3.5, APIs: 2, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 4250483c074d45c5b7d1808ac1e06e98a086b209953914eedbd100c16f7ef0eb
Instruction ID: 138097fc602118840c57f2d46f387e89c29b1f15ebc5547277c90e0ad3909465
Opcode Fuzzy Hash: 4250483c074d45c5b7d1808ac1e06e98a086b209953914eedbd100c16f7ef0eb
Instruction Fuzzy Hash: B4220BB4A04219CFCBA4EF24D89879DB7B5BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B1071, Relevance: 3.5, APIs: 2, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 3aeed94d08ceaa772641e268c5d08e2446b929f2f0a22759f370989d7d4bcdbd
Instruction ID: df7754a511925f66f9c385c4ec861731117f79d7bd0c4542fee89b1e85b8004a
Opcode Fuzzy Hash: 3aeed94d08ceaa772641e268c5d08e2446b929f2f0a22759f370989d7d4bcdbd
Instruction Fuzzy Hash: 53220BB4A04219CFCB64EF24D89879DB7B5BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B10B6, Relevance: 3.5, APIs: 2, Instructions: 472libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: b409d134a99b891105005f70a56ea486893847b3b350310c675305637f8a51f6
Instruction ID: d93621a2b144fc63d2bfd108f1d9c8d52570762aacedd142dc1db2248be3bd57
Opcode Fuzzy Hash: b409d134a99b891105005f70a56ea486893847b3b350310c675305637f8a51f6
Instruction Fuzzy Hash: 44220BB4A04219CFCB64EF24D89879DB7B5BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B10FB, Relevance: 3.5, APIs: 2, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 95e32710bfee90a30f901d4c119623504fd71c278840aad6586718eea2218980
Instruction ID: afd6e80bedc8cc1cce2ce3f823f0f4a2be31d5c7002f8af9efcdaad0e7699e56
Opcode Fuzzy Hash: 95e32710bfee90a30f901d4c119623504fd71c278840aad6586718eea2218980
Instruction Fuzzy Hash: 81220AB4A04229CFCB64EF24D89879DB7B5BF88205F5084E9D909A3754CF349E86CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014B1140, Relevance: 3.5, APIs: 2, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9b0a1bf0fa9393a3ec9507969f1a08818e9e10422378a7607012fc23ec254af0
Instruction ID: c0c1331c00e43416f20167b1d65939b42faad9aa5f47cd7b8dd12bc14c8add11
Opcode Fuzzy Hash: 9b0a1bf0fa9393a3ec9507969f1a08818e9e10422378a7607012fc23ec254af0
Instruction Fuzzy Hash: CD220BB4A04229CFCB64EF24D89879DB7B5BF88205F5084E9D909A3754CF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B1185, Relevance: 3.5, APIs: 2, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: f45e1ecc95f5cc47fd9447fcf808c18af8f0ba51f02254bdae123db3c2e5e9ab
Instruction ID: 1411c866585a21b37a2e7d155dc9937288707effda5426cef62468c7f14a8c52
Opcode Fuzzy Hash: f45e1ecc95f5cc47fd9447fcf808c18af8f0ba51f02254bdae123db3c2e5e9ab
Instruction Fuzzy Hash: A9121AB4A042298FCB64EF34D89879DB7B6BF88205F5084E9D909A3754CF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B11CD, Relevance: 3.4, APIs: 2, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: f4ab5cacdb28df7dad16729bffc0f7447c9f20db06060c4f612d4f969cdc2467
Instruction ID: b11f2405cce8066b9ef00ef7466d28031ae98341b91bbfeb35a0f71c19ce6c8c
Opcode Fuzzy Hash: f4ab5cacdb28df7dad16729bffc0f7447c9f20db06060c4f612d4f969cdc2467
Instruction Fuzzy Hash: C5121BB4A042298FCB64EF34D89879DB7B6BF88205F5084E9D909A3754CF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B1215, Relevance: 3.4, APIs: 2, Instructions: 437libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 611e9c0a655cd165952810d44d93051de51e00583b4f9e7870f8943962995737
Instruction ID: bef70fa381f577bee2710bdfc62084343410ce00675ee7f60a0679e82bef072f
Opcode Fuzzy Hash: 611e9c0a655cd165952810d44d93051de51e00583b4f9e7870f8943962995737
Instruction Fuzzy Hash: DA120BB4A042298FCB64EF34D85879DB7B2BF88205F5084E9D909A3754DF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B125D, Relevance: 3.4, APIs: 2, Instructions: 428libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 014B1278
LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 3cdc76e6b879aef3518facbf1dbd6bccc75acb7768f654538006ce924f4f7477
Instruction ID: ae95b63c48803df50f23e9bd2b55120289c9630e4c53f642587d31db6adaa7d9
Opcode Fuzzy Hash: 3cdc76e6b879aef3518facbf1dbd6bccc75acb7768f654538006ce924f4f7477
Instruction Fuzzy Hash: BF121CB4A042298FCBA4EF30D89879DB7B2BF88205F5084E9D509A3754DF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012B87CF, Relevance: 2.1, APIs: 1, Instructions: 581libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B8DC7

Memory Dump Source

Source File: 00000004.00000002.503796956.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b196b2af0aef2abccad58cba67c1a7a2613fe1146c5b21fb263c8495d07320d3
Instruction ID: 32e6068ac43bfdf7e67af0e6e394dfd3ba131df37aeb3102e67adb2fb2cc9818
Opcode Fuzzy Hash: b196b2af0aef2abccad58cba67c1a7a2613fe1146c5b21fb263c8495d07320d3
Instruction Fuzzy Hash: 4712F370F101068BDF259A7CC4D47EEB7AAEF95390F184826E609EB361DB35DC418B92

Uniqueness

Uniqueness Score: -1.00%

Function 014B12AF, Relevance: 1.9, APIs: 1, Instructions: 419libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eaa9fc5db57c00d1fbebc20c29d90e4ff7ca749540eb11740a82437821290eb0
Instruction ID: e560b699da23a0f73daa456fb9e23584fe52ba175f5dbfc907784ecee13e0e1d
Opcode Fuzzy Hash: eaa9fc5db57c00d1fbebc20c29d90e4ff7ca749540eb11740a82437821290eb0
Instruction Fuzzy Hash: E0122BB4A04229CFCBA4EB30D89879DB7B2BF88205F5084E9D509A3754DF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B12F7, Relevance: 1.9, APIs: 1, Instructions: 412libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 219e39dec761a66886c469d451503e568364050e305ac497222ddd2718f92dd4
Instruction ID: b7956896b1ea321e99208ae4ff23820adec347b53a8d1afc091ec3132c05fa7b
Opcode Fuzzy Hash: 219e39dec761a66886c469d451503e568364050e305ac497222ddd2718f92dd4
Instruction Fuzzy Hash: 97021CB4A04228CFCBA4EB34D89879DB7B2BF88205F5084E9D509A3754DF349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 014B133F, Relevance: 1.9, APIs: 1, Instructions: 405libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db1d50c11a140a5199c843fd46ab9e06f3bdedd7532bcddbda8ce452febab312
Instruction ID: 206b2e934b3bae05292ed8373acbd078db6b0a023ae1b531dff2407e74c0cf92
Opcode Fuzzy Hash: db1d50c11a140a5199c843fd46ab9e06f3bdedd7532bcddbda8ce452febab312
Instruction Fuzzy Hash: CF021CB4A042288FCBA4EF74D89879DB7B2BF88205F5084E9D509A3354DF349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 014B1387, Relevance: 1.9, APIs: 1, Instructions: 396libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a0d2ac8570f3430b9be3c809e90e772cdc05cab2fe74d5ce351010b451f8ec2f
Instruction ID: 40f0afde683ad34e193e1bde433b6dfdf0f800f3e6951c00d57a3ebf4559b9f7
Opcode Fuzzy Hash: a0d2ac8570f3430b9be3c809e90e772cdc05cab2fe74d5ce351010b451f8ec2f
Instruction Fuzzy Hash: DC022DB4A042298FCBA4EF74D89879DB7B2BF88205F5084E9D509A3354DF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014B13C3, Relevance: 1.9, APIs: 1, Instructions: 389libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014B1509

Memory Dump Source

Source File: 00000004.00000002.504682964.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4441e39cee0204d017d2bc255c5bdcb20cd9c41db2ffe32b9e750844a42a9734
Instruction ID: 0c615a6fa7a700b9465dc0ad61a505bd766f814bebdc5363f64751a64a252da0
Opcode Fuzzy Hash: 4441e39cee0204d017d2bc255c5bdcb20cd9c41db2ffe32b9e750844a42a9734
Instruction Fuzzy Hash: CB022EB4A042298FCBA4EF74D85879DB7B2BF88205F5084E9D509A3354DF349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01401308, Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0443ce61d4428bfb4633a97b4e46be314be5ddac152715d96ffeb800d6b9ca46
Instruction ID: 96c6a586e069939b7e5b95394eefea7d6cfcc07dcef3a36e22584d6a8784c8e5
Opcode Fuzzy Hash: 0443ce61d4428bfb4633a97b4e46be314be5ddac152715d96ffeb800d6b9ca46
Instruction Fuzzy Hash: AC411372D083958FCB05DF7AC8442EABFB0EF8A314F1585ABD544A7251DB749841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01402778, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 014027FB

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 05013e5a40ed6abd864d881fff78342a5e458a043f0978b54cc16d2d713d78fb
Instruction ID: 7da0358b846ade306275d571490842f85859a59c9c0f6e1dad7823393d10c706
Opcode Fuzzy Hash: 05013e5a40ed6abd864d881fff78342a5e458a043f0978b54cc16d2d713d78fb
Instruction Fuzzy Hash: 732165759042588FCB10CFAAC848BEEFBF4FB88314F14842AE458A7390C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014013D8, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 01401447

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 35cc47278d79779570af9704383967ceb8f89e419636fd4a577a59c3066377bf
Instruction ID: aa1c2914f4c1e0a81b0d6154f70bd4776968b8902d60ed449f6294ad95c648eb
Opcode Fuzzy Hash: 35cc47278d79779570af9704383967ceb8f89e419636fd4a577a59c3066377bf
Instruction Fuzzy Hash: 641136B1D042599FCB10CF9AC4447DEFBB4AF48324F15816AD514A7240D378A941CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0140E611, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,0140E5F1,00000800), ref: 0140E682

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4fb93d5e64d272023ede7966b2653e5929df3135473a15e7e0b465c2dbf5ec23
Instruction ID: 6f003f85724b1cb35963d664776b6897dc6e97e25942e4ddef79f97772bf63bf
Opcode Fuzzy Hash: 4fb93d5e64d272023ede7966b2653e5929df3135473a15e7e0b465c2dbf5ec23
Instruction Fuzzy Hash: 901106B69043499FDB10CF9AD844ADEBBF4AB88324F14882AD919A7250C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0140DFD8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,0140E5F1,00000800), ref: 0140E682

Memory Dump Source

Source File: 00000004.00000002.504564387.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d7959d99ddd3c86f1f6464d9135dc34ed7f849f7e2fd1788c384b8eb180e275f
Instruction ID: 5b479f0bb825d990a81d4e267ff8b7baf764f77de178811d81aa45cf04e01c6e
Opcode Fuzzy Hash: d7959d99ddd3c86f1f6464d9135dc34ed7f849f7e2fd1788c384b8eb180e275f
Instruction Fuzzy Hash: F91106B69043099FDB10CF9AD844A9EBBF4EB98314F14882AD919B7350C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014CD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.504726466.00000000014CD000.00000040.00000001.sdmp, Offset: 014CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114c979c878b21c1e4f7f3bd8c38ac8a28c42b63601c65899d6bfca8e38da509
Instruction ID: 08576724f4e0bfaeb62992a3fd051f5b9c5e6fe3df91d9f32c191ad272002e6d
Opcode Fuzzy Hash: 114c979c878b21c1e4f7f3bd8c38ac8a28c42b63601c65899d6bfca8e38da509
Instruction Fuzzy Hash: CB2106B9908240DFDB55CF58D8C0B26BB61FB84658F20C57ED9494B356C336D807C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.504726466.00000000014CD000.00000040.00000001.sdmp, Offset: 014CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec0ad4e30ef543b4b15484c7f2934d68ef44de6d9cc34373ba0f6815e0df7d7
Instruction ID: 69cabbccc680812aa0da809263eb46fff2af6ad5763a57c2b97c84f1e246624d
Opcode Fuzzy Hash: cec0ad4e30ef543b4b15484c7f2934d68ef44de6d9cc34373ba0f6815e0df7d7
Instruction Fuzzy Hash: 652183755093C08FCB12CF24D594716BF71EB46214F28C5EFD8458B667C33A980ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PRODUCT INQUIRY FROM PAKISTAN.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre