Windows Analysis Report SecuriteInfo.com.__vbaHresultCheckObj.11013.exe

Signatures

May try to detect the Windows Explorer process (often used for injection)

Signatures

Found potential dummy code loops (likely to delay analysis)

Sample might executed code dummy loops to delay execution, try to increase analysis time

Signatures

Uses code obfuscation techniques (call, push, ret)

Signatures

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Tries to detect virtualization through RDTSC time measurements

Found potential dummy code loops (likely to delay analysis)

Contains functionality for execution timing, often used to detect debuggers

Signatures

May try to detect the Windows Explorer process (often used for injection)

Signatures

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Tries to detect virtualization through RDTSC time measurements

Contains functionality to query CPU information (cpuid)

Reads software policies

Signatures

Detected potential crypto function

Signatures

Detected potential crypto function

Signatures

C2 URLs / IPs found in malware configuration

Execution Graphs are highly condensed control flow graphs which give the user a synthetic view of the code detected during Hybrid Code Analysis. They include additional runtime information such as the execution status which is highlighted with different colors and shapes.

Entrypoint

Program entry point, most likely the entry point of the PE file.

Key Decision

A code location where a decision has been made to avoid execution of potentially malicious behavior.

Dynamic / Decrypted

Code which has been generated at runtime, often referred to as unpacked or self-modifying code.

Unpacker / Decrypter

Code section which is responsible for unpacking or decrypting a portion of dynamic code.

Executed