Windows Analysis Report plan-1637276620.xlsm

Overview

General Information

Sample Name:	plan-1637276620.xlsm
Analysis ID:	438318
MD5:	4d44784f088b8dd2ac0a6cbf2b809eab
SHA1:	7d01c190b2e73c860a9aed904729c6466230bd26
SHA256:	c63e0b01a696a077a5709b8aa4d4d600344fc1ddba624cbd67c6f37f271d97ac
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Found Excel 4.0 Macro with suspicious formulas

Sigma detected: Microsoft Office Product Spawning Windows Shell

Excel documents contains an embedded macro which executes code when the document is opened

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Registers a DLL

Classification

Signatures

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 192.185.21.116:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.50.160.62:443 -> 192.168.2.22:49170 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: ieronymou.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 192.185.21.116:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 192.185.21.116:443

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 103.50.160.62 103.50.160.62

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F9EDFDD2.png

Jump to behavior

Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: ieronymou.com

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.0.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F8008506.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: regsvr32.exe, 00000003.00000002.2143768975.0000000004A37000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121527621.0000000004AE7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: regsvr32.exe, 00000003.00000002.2143768975.0000000004A37000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121527621.0000000004AE7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000003.00000002.2140760788.00000000039B0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2117333468.0000000003A80000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2137234339.0000000001C40000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2116309396.0000000001D00000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000003.00000002.2143768975.0000000004A37000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121527621.0000000004AE7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: regsvr32.exe, 00000003.00000002.2143768975.0000000004A37000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121527621.0000000004AE7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.2140760788.00000000039B0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2117333468.0000000003A80000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: regsvr32.exe, 00000003.00000002.2143768975.0000000004A37000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121527621.0000000004AE7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Source: unknown	HTTPS traffic detected: 192.185.21.116:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.50.160.62:443 -> 192.168.2.22:49170 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. 15 16 Protected View
Source: Screenshot number: 4	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start 19 the decryption of the docum
Source: Screenshot number: 8	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. 15 16 Protected View
Source: Screenshot number: 8	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start 19 the decryption of the docu
Source: Document image extraction number: 0	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet. Protected View This fi
Source: Document image extraction number: 0	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document
Source: Document image extraction number: 1	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. 0 Protected View This
Source: Document image extraction number: 1	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document

Found Excel 4.0 Macro with suspicious formulas

Source: plan-1637276620.xlsm

Initial sample: CALL

Excel documents contains an embedded macro which executes code when the document is opened

Source: workbook.xml

Binary string: 1" sheetId="16" state="hidden" r:id="rId1"/><sheet name="Sheet" sheetId="19" r:id="rId2"/><sheet name="Sheet1" sheetId="4" r:id="rId3"/><sheet name="Sheet2" sheetId="12" r:id="rId4"/><sheet name="Sheet4" sheetId="10" state="hidden" r:id="rId5"/><sheet name="Sheet5" sheetId="11" state="hidden" r:id="rId6"/><sheet name="Sheet6" sheetId="15" state="hidden" r:id="rId7"/><sheet name="Sheet7" sheetId="14" state="hidden" r:id="rId8"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Sheet6!$AJ$9</definedName></definedNames><calcPr calcId="122211"/></workbook>

Source: regsvr32.exe, 00000003.00000002.2142309671.0000000004850000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2121252725.0000000004900000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal64.expl.evad.winXLSM@5/13@2/2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$plan-1637276620.xlsm

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC293.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail2.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail2.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: plan-1637276620.xlsm	Initial sample: OLE zip file path = xl/media/image1.png
Source: plan-1637276620.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation:

Registers a DLL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 2628	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2588	Thread sleep time: -60000s >= -30000s			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.21.116	ieronymou.com	United States		46606	UNIFIEDLAYER-AS-1US	false
103.50.160.62	iliknaturals.com	India		394695	PUBLIC-DOMAIN-REGISTRYUS	false

Contacted Domains

Name	IP	Active
iliknaturals.com	103.50.160.62	true
ieronymou.com	192.185.21.116	true

ID:	438318
Product:	CloudBasic
Start time:	13:26:27
Start date:	22.06.2021
Sample:	plan-1637276620.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	4d44784f088b8dd2ac0a6cbf2b809eab
SHA1:	7d01c190b2e73c860a9aed904729c6466230bd26
SHA256:	c63e0b01a696a077a5709b8aa4d4d600344fc1ddba624cbd67c6f37f271d97ac
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 60080 bytes, 1 file	6045BACCF49E1EBA0E674945311A06E6	379C6234849EECEDE26FAD192C2EE59E0F0221CB	65830A65CB913BEE83258E4AC3E140FAF131E7EB084D39F7020C7ACC825B0A58
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	53783EF032951E1DDF6C108E6D7C55BE	B9F2928787F636BCE4312A0DC2CB987F841DA0EC	4D4EE6853F9C7BFA1D541D625ADBA1568306439929115163B2A4380BD05A7B33
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	45D2A58EE172CB6656E3D63AFDAFAC11	B23953FEE64157846B8155B65799BC81C69E50BF	6DE4A4C23AFFB44601F5498917E3A91CF97095684F29F2EB7779BA52872FC314
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F9EDFDD2.png	PNG image data, 1133 x 589, 8-bit/color RGB, non-interlaced	8296338A43942E3107802E3062AC1270	46E67A586ED8A961AF7FD03140547C1CB2BAC227	BE5F61F2AE8E4C9F9ADBCE5EC33D4C01A331734FFC5818AA8E45CF60456C5ABD
C:\Users\user\AppData\Local\Temp\4ECE0000	data	47C592EB97A153A45E1C51F969D8C787	9095E3626503E6B3F9FD173927A00FDDCB4B7234	F779082667B29A95A2A60C3261C15C09BD80A414898FCFF2B1E7B528C940F8CD
C:\Users\user\AppData\Local\Temp\CabDAC6.tmp	Microsoft Cabinet archive data, 60080 bytes, 1 file	6045BACCF49E1EBA0E674945311A06E6	379C6234849EECEDE26FAD192C2EE59E0F0221CB	65830A65CB913BEE83258E4AC3E140FAF131E7EB084D39F7020C7ACC825B0A58
C:\Users\user\AppData\Local\Temp\TarDAC7.tmp	data	9BE376D85B319264740EF583F548B72A	6C6416CBC51AAC89A21A529695A8FCD3AD5E6B85	07FDF8BC502E6BB4CF6AE214694F45C54A53228FC2002B2F17C9A2EF64EB76F6
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue Jun 22 19:26:38 2021, atime=Tue Jun 22 19:26:38 2021, length=8192, window=hide	64EB129663574FFAF3327CA9360299CB	5E4EBA6C1312336B58CA21CA178209371B69EA3B	9963C2EA6DFD76705A3BA607DE78F7BE08042F9D8249EC0D6E8B9855FD5754EA
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	32693F1BBA06D4B8A5179CF03093DEAD	F575E24C8881BD57208B03CFA8361860C3AD5F7F	BE869C5A0ECA3ADB50B587185C18633DBA657341B5B8022F57F49C33191189EA
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\plan-1637276620.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Tue Jun 22 19:26:38 2021, atime=Tue Jun 22 19:26:38 2021, length=93153, window=hide	3E75EAB3A0105D7C163F0D643D69EDE8	158AE84392602D30FEB6E14AE350DA62EA84AD30	A84C948DE21FB1B7682248E9433C7BEC4AE241476C0CA306A72DCFA20B92947F
C:\Users\user\Desktop\DFCE0000	data	47C592EB97A153A45E1C51F969D8C787	9095E3626503E6B3F9FD173927A00FDDCB4B7234	F779082667B29A95A2A60C3261C15C09BD80A414898FCFF2B1E7B528C940F8CD
C:\Users\user\Desktop\~$plan-1637276620.xlsm	data	96114D75E30EBD26B572C1FC83D1D02E	A44EEBDA5EB09862AC46346227F06F8CFAF19407	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523

Windows Analysis Report plan-1637276620.xlsm

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains