Play interactive tour

Edit tour

Windows Analysis Report Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Overview

General Information

Sample Name:	Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe
Analysis ID:	492176
MD5:	419a3e9ce6606d5ed7b22a7574e1a294
SHA1:	7c08e8f1f4f478df9baf5d00675bd174467621bc
SHA256:	3ebfb7cdc30291bcc995951dda1d8f62cea3e0beb990e35fabb3078b6d9d9921
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe (PID: 3504 cmdline: 'C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe' MD5: 419A3E9CE6606D5ED7B22A7574E1A294)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1"}

Multi AV Scanner detection for submitted file

Show sources

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Virustotal: Detection: 32%			Perma Link
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	ReversingLabs: Detection: 59%

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000002.874364498.00000000006EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000000.347136276.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSOOTIER.exe vs Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Binary or memory string: OriginalFilenameSOOTIER.exe vs Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02287551	0_2_02287551
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02285013	0_2_02285013
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02285046	0_2_02285046
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02284EAF	0_2_02284EAF
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_022872F7	0_2_022872F7
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02289AC8	0_2_02289AC8
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02285381	0_2_02285381
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02285186	0_2_02285186

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02287551 NtAllocateVirtualMemory,	0_2_02287551
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_0228770D NtAllocateVirtualMemory,	0_2_0228770D
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_022875F5 NtAllocateVirtualMemory,	0_2_022875F5

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Process Stats: CPU usage > 98%

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Virustotal: Detection: 32%
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	ReversingLabs: Detection: 59%

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

File created: C:\Users\user\AppData\Local\Temp\~DFB490F95CF5EA8B6F.TMP

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_00405846 push edi; retf	0_2_0040585F
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_00405D7E push edx; iretd	0_2_00405D7F
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_00402B90 push ebx; retf	0_2_00402B96
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_0228A443 push esp; retf	0_2_0228A67F
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02283300 pushfd ; ret	0_2_02283303

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	RDTSC instruction interceptor: First address: 000000000040E85B second address: 000000000040E85B instructions: 0x00000000 rdtsc 0x00000002 wait 0x00000003 wait 0x00000004 popad 0x00000005 lfence 0x00000008 mfence 0x0000000b dec edi 0x0000000c pushfd 0x0000000d popfd 0x0000000e pushfd 0x0000000f popfd 0x00000010 cmp edi, 00000000h 0x00000013 jne 00007F5770EAA462h 0x00000015 lfence 0x00000018 mfence 0x0000001b pushad 0x0000001c wait 0x0000001d mfence 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	RDTSC instruction interceptor: First address: 0000000002286DFC second address: 0000000002286DFC instructions: 0x00000000 rdtsc 0x00000002 mov eax, F9F0A62Eh 0x00000007 sub eax, C3698614h 0x0000000c xor eax, A054C6ADh 0x00000011 sub eax, 96D3E6B6h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F5770EA7F3Bh 0x0000001e lfence 0x00000021 mov edx, B7F0CA33h 0x00000026 xor edx, D51E11ABh 0x0000002c add edx, A4F999EAh 0x00000032 xor edx, 78167596h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+00000200h], 2A782AA0h 0x0000004f jmp 00007F5770EA7F7Eh 0x00000051 test eax, edx 0x00000053 xor dword ptr [ebp+00000200h], 7BA13BC5h 0x0000005d xor dword ptr [ebp+00000200h], 6C4338F5h 0x00000067 test ch, dh 0x00000069 sub dword ptr [ebp+00000200h], 3D9A2990h 0x00000073 cmp ecx, dword ptr [ebp+00000200h] 0x00000079 jne 00007F5770EA7E91h 0x0000007f mov dword ptr [ebp+00000271h], edi 0x00000085 mov edi, ecx 0x00000087 push edi 0x00000088 cmp al, F4h 0x0000008a mov edi, dword ptr [ebp+00000271h] 0x00000090 cmp bl, al 0x00000092 test dh, FFFFFFF1h 0x00000095 call 00007F5770EA7FF7h 0x0000009a call 00007F5770EA7F5Ch 0x0000009f lfence 0x000000a2 mov edx, B7F0CA33h 0x000000a7 xor edx, D51E11ABh 0x000000ad add edx, A4F999EAh 0x000000b3 xor edx, 78167596h 0x000000b9 mov edx, dword ptr [edx] 0x000000bb lfence 0x000000be ret 0x000000bf mov esi, edx 0x000000c1 pushad 0x000000c2 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Code function: 0_2_022870F5 rdtsc

0_2_022870F5

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02286C29 mov eax, dword ptr fs:[00000030h]	0_2_02286C29
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_02289D47 mov eax, dword ptr fs:[00000030h]	0_2_02289D47
Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	Code function: 0_2_022897B7 mov eax, dword ptr fs:[00000030h]	0_2_022897B7

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Code function: 0_2_022870F5 rdtsc

0_2_022870F5

Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000002.874467100.0000000000D70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000002.874467100.0000000000D70000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000002.874467100.0000000000D70000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe, 00000000.00000002.874467100.0000000000D70000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery21	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	32%	Virustotal		Browse
Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe	59%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492176
Start date:	28.09.2021
Start time:	12:48:49
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 38.2% (good quality ratio 17.2%) Quality average: 29% Quality standard deviation: 35.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.50.102.62, 20.54.110.249, 40.112.88.60, 20.82.210.154, 80.67.82.211, 80.67.82.235, 23.211.4.86 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.697062658365674
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe
File size:	90112
MD5:	419a3e9ce6606d5ed7b22a7574e1a294
SHA1:	7c08e8f1f4f478df9baf5d00675bd174467621bc
SHA256:	3ebfb7cdc30291bcc995951dda1d8f62cea3e0beb990e35fabb3078b6d9d9921
SHA512:	9656f15444698040c29674c4370604397c37147c07924b1bc8751b62e3a437808c234f3f155a9af927f57084264b762d5daa949c3d76b2e9755ec17690cb656e
SSDEEP:	768:tKI6PD+GddmSjV7vdnt/L/qT/pYT2IO7vPPqRgAWn95fRiBLWfRrhTSgStnLYqwp:tP0+6mSjxvD/q7eT2HQgFn3OWflNULK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L...q.(T.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5428C171 [Mon Sep 29 02:18:25 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 0040FD84h
call 00007F5770926B53h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, dl
sbb eax, 16A1B5FBh
xchg eax, ecx
inc ecx
mov bh, A2h
pop esi
stosd
xchg eax, ecx
js 00007F5770926B62h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+69h], dl
arpl word ptr [ebp+esi*2+72h], si
dec eax
push edx
inc esi
inc ecx
push edx
push esi
inc ebp
push esp
add byte ptr [ecx+eax*2+47h], al
inc ebp
dec esi
inc ebp
push ebx
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
cmp byte ptr [ecx+4514D5FFh], dl
push esi
stosd
inc edi
cdq
inc esp
mov ah, EFh
adc dh, byte ptr [esi-555086FBh]
jmp 00007F5770926B55h
das
outsb
rol dword ptr [ecx-69h], cl
neg byte ptr [esp+esi]
pop ecx
cmp dword ptr [ecx-47h], esp
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc eax, ebp
add byte ptr [eax], al
mov eax, dword ptr [ecx]
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [esp+eax*2+53h], al
inc esp
inc ecx
inc edi
inc ebp
dec esi
inc ebp
push ebx
add byte ptr [4E000401h], cl
popad
jo 00007F5770926BC3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13484	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x540	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x128ec	0x13000	False	0.512232730263	data	6.18689428252	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x540	0x1000	False	0.12939453125	data	1.40564634666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15418	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x15404	0x14	data
RT_VERSION	0x150f0	0x314	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	SOOTIER
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	SOOTIER.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 12:49:43.078562021 CEST	55074	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:49:43.099668026 CEST	53	55074	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:16.515784025 CEST	54513	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:16.541287899 CEST	53	54513	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:37.793857098 CEST	62044	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:37.835972071 CEST	53	62044	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:38.729141951 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:38.753321886 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:39.386317015 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:39.406080008 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:39.797696114 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:39.831516981 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:40.452873945 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:40.474850893 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:40.919061899 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:40.936233044 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:41.335553885 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:41.363702059 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:41.562084913 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:41.587434053 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:42.813127995 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:42.847450018 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:44.544662952 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:44.563193083 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:45.190165997 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:45.278191090 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:58.982588053 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:59.010984898 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:50:59.018351078 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 28, 2021 12:50:59.045727968 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 28, 2021 12:51:04.990025997 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:51:05.014221907 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 28, 2021 12:51:14.774714947 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:51:14.836568117 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 28, 2021 12:51:37.425332069 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:51:37.453387022 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 28, 2021 12:51:39.309722900 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:51:39.329574108 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 28, 2021 12:52:14.868485928 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 28, 2021 12:52:14.895586967 CEST	53	50055	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe PID: 3504 Parent PID: 5784

General

Start time:	12:49:48
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	419A3E9CE6606D5ED7B22A7574E1A294
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe PID: 3504 Parent PID: 5784 Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exeCOMMON

Executed Functions

Function 022875F5, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-43F6B9C4,0000014C), ref: 02287707

Strings

], xrefs: 022875A8
{, xrefs: 022877B7

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ]${
API String ID: 2167126740-1505750341
Opcode ID: 2f7ec14b835ae134f4924f6e683d86c0f11cfa68810ec0acf00a74b16164f79f
Instruction ID: e807ec4c7153c428a38937fe66adfb0811e366235fff5cc044d99e5f2410c711
Opcode Fuzzy Hash: 2f7ec14b835ae134f4924f6e683d86c0f11cfa68810ec0acf00a74b16164f79f
Instruction Fuzzy Hash: CD512075A153899FD720DE64CC90BCA7BA2DFA9740F648119C90D8B365E7318A02CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02287551, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-43F6B9C4,0000014C), ref: 02287707

Strings

], xrefs: 022875A8
{, xrefs: 022877B7

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ]${
API String ID: 2167126740-1505750341
Opcode ID: 6dc3d068503fec493670eba52e9d0408cb156d5bd6e9fe601955845cb1ef9512
Instruction ID: 79e0978eef265cda2929b4ba2a4d45706132b30669743501307670c2416607fa
Opcode Fuzzy Hash: 6dc3d068503fec493670eba52e9d0408cb156d5bd6e9fe601955845cb1ef9512
Instruction Fuzzy Hash: A2412072A143889FEB70CE69CC917DA7BA2EF99740F15812EDC0D9B328D3309A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0228770D, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-43F6B9C4,0000014C), ref: 02287707

Strings

{, xrefs: 022877B7

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: {
API String ID: 2167126740-366298937
Opcode ID: 4ef690b49439c1b5b6dc99b87aa436cf0c521922eb64559824a52305f9bfceca
Instruction ID: 5ebf1089824d6e1e9b11dfb896bcad3686eed00dd302dded998f3e1bc33bd7aa
Opcode Fuzzy Hash: 4ef690b49439c1b5b6dc99b87aa436cf0c521922eb64559824a52305f9bfceca
Instruction Fuzzy Hash: 5B518D31B2A3868FD322D6A0DC41AC87B91CF5F674B188549DA59CB3F6E7218813CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00412AD0, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

#612.MSVBVM60(?), ref: 00412B52
__vbaStrVarMove.MSVBVM60(?), ref: 00412B5C
__vbaStrMove.MSVBVM60 ref: 00412B67
__vbaFreeVar.MSVBVM60 ref: 00412B70
#575.MSVBVM60(?,?), ref: 00412B8C
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412BAE
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412BC1
__vbaNew2.MSVBVM60(00410824,004145C0), ref: 00412BE1
__vbaHresultCheckObj.MSVBVM60(00000000,02A7004C,00410814,00000034,?,?,00000ACB,?), ref: 00412C2B
__vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 00412C3C
__vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 00412C4C
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00412C5F
__vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 00412C7E
__vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 00412C91
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004102D8,000002C8), ref: 00412CC7
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 00412CDD
__vbaNew2.MSVBVM60(00410824,004145C0), ref: 00412D05
__vbaHresultCheckObj.MSVBVM60(00000000,02A7004C,00410814,0000004C), ref: 00412D2A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410850,0000001C,?,?,?,?), ref: 00412D7A
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412D8B
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00412D94
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410308,000006F8), ref: 00412DBC
__vbaStrCopy.MSVBVM60 ref: 00412DCA
__vbaFreeStr.MSVBVM60 ref: 00412E03
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004102D8,000002B4), ref: 00412E30
__vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 00412E4D
__vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 00412E64
__vbaFreeStr.MSVBVM60 ref: 00412E83
__vbaNew2.MSVBVM60(00410824,004145C0), ref: 00412E9C
__vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 00412EB8
__vbaObjVar.MSVBVM60(00000000), ref: 00412EC2
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00412ECD
__vbaHresultCheckObj.MSVBVM60(00000000,02A7004C,00410814,0000000C), ref: 00412EE7
__vbaFreeObj.MSVBVM60 ref: 00412EF0
__vbaFreeVar.MSVBVM60 ref: 00412EF9
__vbaFreeObj.MSVBVM60(00412F5A), ref: 00412F44
__vbaFreeStr.MSVBVM60 ref: 00412F49
__vbaFreeObj.MSVBVM60 ref: 00412F52
__vbaFreeObj.MSVBVM60 ref: 00412F57

Strings

SINGFEST, xrefs: 00412E47
snappishly, xrefs: 00412C46
Palmira, xrefs: 00412DC2
WkKauIFp5j1bv26pBJsl8jmR69NV785, xrefs: 00412EAC

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
API String ID: 1255662601-1278630523
Opcode ID: 57a7e6ddf68f3481645ba134acf423f00e4d159d21e6b44fe6e6a72cddb667f4
Instruction ID: d92881ed6eb9d3553e3f1eff9150c784f4882c86947db668497fd4175a260685
Opcode Fuzzy Hash: 57a7e6ddf68f3481645ba134acf423f00e4d159d21e6b44fe6e6a72cddb667f4
Instruction Fuzzy Hash: 35D16B70900209EFDB10DFA4DE89ADEBBB9FF48701F10816AF545A72A0D7745985CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012C8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 61%

			_entry_() {
				signed char _t12;
				intOrPtr* _t13;
				intOrPtr* _t16;
				signed int _t17;
				intOrPtr* _t20;
				intOrPtr* _t22;
				intOrPtr* _t23;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t34;
				void* _t35;

				_push("VB5!6!*"); // executed
				L004012C0(); // executed
				 *_t12 =  *_t12 + _t12;
				 *_t12 =  *_t12 + _t12;
				 *_t12 =  *_t12 + _t12;
				 *_t12 =  *_t12 ^ _t12;
				 *_t12 =  *_t12 + _t12;
				_t13 = _t12 + 1;
				 *_t13 =  *_t13 + _t13;
				 *_t13 =  *_t13 + _t13;
				 *_t13 =  *_t13 + _t13;
				asm("sbb eax, 0x16a1b5fb");
				_t22 = _t13 + _t25 + 1;
				asm("lock pop esi");
				asm("stosd");
				_t16 = _t22;
				_t23 = _t20;
				if (_t22 < 0) goto L1;
				 *_t16 =  *_t16 + _t16;
				 *_t16 =  *_t16 + _t16;
				 *_t23 =  *_t23 + _t16;
				 *_t16 =  *_t16 + _t16;
				 *((intOrPtr*)(_t16 + 0x69)) =  *((intOrPtr*)(_t16 + 0x69)) + _t25;
				asm("arpl [ebp+esi*2+0x72], si");
				_t17 = _t16 - 1;
				_push(_t25);
				_t28 = _t27 + 1;
				_t24 = _t23 + 1;
				_push(_t25);
				_push(_t28);
				_push(_t34);
				 *((intOrPtr*)(_t24 + 0x47 + _t17 * 2)) =  *((intOrPtr*)(_t23 + 1 + 0x47 + _t17 * 2)) + _t17;
				_push(0xa2);
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				_t35 = _t34 - 1;
				 *_t17 =  *_t17 ^ _t17;
				_push(_t28 - 1);
				asm("stosd");
				L2:
				_t26 = _t26 + 1;
				asm("cdq");
				_t35 = _t35 + 1;
				asm("adc dh, [esi-0x555086fb]");
				goto L2;
			}

0x004012c8
0x004012cd
0x004012d2
0x004012d4
0x004012d6
0x004012d8
0x004012da
0x004012dc
0x004012dd
0x004012df
0x004012e1
0x004012e5
0x004012eb
0x004012ee
0x004012f1
0x004012f2
0x004012f2
0x004012f3
0x004012f5
0x004012f7
0x004012f9
0x004012fb
0x004012fd
0x00401300
0x00401304
0x00401305
0x00401306
0x00401307
0x00401308
0x00401309
0x0040130b
0x0040130c
0x00401313
0x00401314
0x00401316
0x00401318
0x0040131a
0x00401322
0x00401323
0x00401324
0x00401324
0x00401325
0x00401326
0x00401329
0x00000000

APIs

#100.MSVBVM60(VB5!6!*), ref: 004012CD

Strings

VB5!6!*, xrefs: 004012C8, 00401309, 00401322

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: 059709186062d4cdfa91e99c4068550d70c9cbed65314edf9b53f941315a213c
Instruction ID: 427aba37f4e1bc6edd35d26432bfb5f9df48d119fb136e4deb46106c9c8291c6
Opcode Fuzzy Hash: 059709186062d4cdfa91e99c4068550d70c9cbed65314edf9b53f941315a213c
Instruction Fuzzy Hash: 4A01CC6405E3D56EE30B12399C619A23F74CD1369831A01EFD5C2DE0F3D119484A83B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02285381, Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

3$2N, xrefs: 02286536

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 3$2N
API String ID: 0-2156551817
Opcode ID: b6c39aa0cfc7ccde1b14b800c7853bbd315290886f468c05dd5885547bd804f8
Instruction ID: 5e0ca08f1f8e2b9eaf68a544ac2109deefa40fa8180a0bbed67e09f3a3cd000e
Opcode Fuzzy Hash: b6c39aa0cfc7ccde1b14b800c7853bbd315290886f468c05dd5885547bd804f8
Instruction Fuzzy Hash: 1981FD72A102889FCB74AF39CC547DA7BA2FF84300F56811EEC89AB258D7348A55CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02285013, Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

qw=, xrefs: 02285342

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID: qw=
API String ID: 0-1807335270
Opcode ID: 4a7358874659f2f1348ed28e61dfe33dc7c8034905f49d6107b4c810bbe569f7
Instruction ID: ab6aa521a4c9f837316efb6211367ffc64754d9f7696ef538092932609ff4ba7
Opcode Fuzzy Hash: 4a7358874659f2f1348ed28e61dfe33dc7c8034905f49d6107b4c810bbe569f7
Instruction Fuzzy Hash: 764100726167459FDB70DE6AC9913DB73F2BF98300F86812AC84E6F348C770AA518B45

Uniqueness

Uniqueness Score: -1.00%

Function 02285186, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ec7b620cc1ff32383895fd015cba07f7b9fb74c5b4764358a574113aefc206
Instruction ID: 504af1b19c46bf56a5ceac842b15e3f7f6cce4befcfa8ca453f269d5c2fb9fdf
Opcode Fuzzy Hash: 33ec7b620cc1ff32383895fd015cba07f7b9fb74c5b4764358a574113aefc206
Instruction Fuzzy Hash: EF519B72B257858FC331E964CC416D933E29B9D760FD58609C19A8F3A6E730D8138BD8

Uniqueness

Uniqueness Score: -1.00%

Function 02285046, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20a4931119d8b4c21f28e15cb65fd0e29f3477708c1f5c152051ceeaae108b9
Instruction ID: c32f9acd93d3f9f7ebe327166e36dfe9899c05b77853e855a99f11b4f11b5891
Opcode Fuzzy Hash: d20a4931119d8b4c21f28e15cb65fd0e29f3477708c1f5c152051ceeaae108b9
Instruction Fuzzy Hash: C95158326157458FD770DE25C9917DA77F2BFA8700F96851AC84E9F345C770E6018B84

Uniqueness

Uniqueness Score: -1.00%

Function 02284EAF, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b37ae05d6292212cc420e6bd395e03d8f52c1a0ce852202870c32c58f53a5c
Instruction ID: b00c021899e48c878201efb7d1e55c2ee0b4302fbb210e36f9e416419a8dd302
Opcode Fuzzy Hash: a7b37ae05d6292212cc420e6bd395e03d8f52c1a0ce852202870c32c58f53a5c
Instruction Fuzzy Hash: 9B21E3701042818BDF72CEB8C895B867BA1AF02328F0C829DCC9C4F29BE7759506C741

Uniqueness

Uniqueness Score: -1.00%

Function 02289AC8, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2c3c96ca01dd98642ae538cf815e3ce435845f556ebdbfc7039c766c7e92c3
Instruction ID: e5657ccfee5e8b0791f18dc5f059348f3f3ccba6ea704acb072c0c5a24841bcc
Opcode Fuzzy Hash: 6e2c3c96ca01dd98642ae538cf815e3ce435845f556ebdbfc7039c766c7e92c3
Instruction Fuzzy Hash: 3E21067261A2C55BEF31DE7548803EABAD25BE6304F94882A89C89B349D334CAC2C715

Uniqueness

Uniqueness Score: -1.00%

Function 022872F7, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fca25466ef8b8029bcb583891ac9351cf51af15a8fbcbf900bd181b2141966
Instruction ID: bb716faf78edac3c279009713be84563824cca79f28773c9c96f5b2c91786686
Opcode Fuzzy Hash: 34fca25466ef8b8029bcb583891ac9351cf51af15a8fbcbf900bd181b2141966
Instruction Fuzzy Hash: D9119A745583899FD7A4AE35DD857EEB7F5FF48300F81891DDDC98A226D3304A908A12

Uniqueness

Uniqueness Score: -1.00%

Function 02289D47, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5ac9b0104c7d59349c74b1bd0ae63ff49d7a49177f40ec74b444b49d3358c3
Instruction ID: eec2125ea6294523a5fc1ab094be4392e5e69b7d49248e948c932fc5ae87eabf
Opcode Fuzzy Hash: 1b5ac9b0104c7d59349c74b1bd0ae63ff49d7a49177f40ec74b444b49d3358c3
Instruction Fuzzy Hash: AD01B536A213608FCB30DF98C9846EA77A4BB08710F06459AEC15AB350C370ED40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02286C29, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 022870F5, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 022897B7, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.874642724.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdd1ebb2e8fc61ccbd28eab55fe466b49e419b15e00a2160ad62470ff015b3b
Instruction ID: 616f7659d6c841acf5bc19880a3c09f2e630f1ed68bab0080a5a5a6f535a2a03
Opcode Fuzzy Hash: efdd1ebb2e8fc61ccbd28eab55fe466b49e419b15e00a2160ad62470ff015b3b
Instruction Fuzzy Hash: 3FB002757516408FCA55CE19D290F4573B4BB45A55B425994E4119BA11C664E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00413290, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

#672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 004132DC
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004132E2
__vbaNew2.MSVBVM60(00410824,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413307
__vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 00413323
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041332D
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413338
__vbaHresultCheckObj.MSVBVM60(00000000,02A7004C,00410814,0000000C), ref: 00413352
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041335B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413364
__vbaFreeObj.MSVBVM60(00413396), ref: 0041338F

Strings

qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 00413317

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
API String ID: 263512575-2009357870
Opcode ID: 71b71276ff3097dd3d118dc4e46e40cff4b5bfe760e0241770953e2dd8303891
Instruction ID: 32d9fe3a18cc923cee3dbaf4f892a1f7826029f211639e758e40349ed304a372
Opcode Fuzzy Hash: 71b71276ff3097dd3d118dc4e46e40cff4b5bfe760e0241770953e2dd8303891
Instruction Fuzzy Hash: EE2141B0900249EBDB109F95DE4DFAABBB8FB54701F104016F541B2560D7781581CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00412F80, Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,004108D0,00000005), ref: 00412FBC
#682.MSVBVM60(?,?), ref: 00412FFD
__vbaFpR8.MSVBVM60 ref: 00413003
__vbaFreeVar.MSVBVM60 ref: 00413027
_adj_fdiv_m64.MSVBVM60 ref: 00413059
__vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 00413087
__vbaHresultCheckObj.MSVBVM60(00000000,?,004102D8,000002C0,?,436E0000), ref: 004130BB
__vbaAryDestruct.MSVBVM60(00000000,?,004130E6), ref: 004130DF

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
String ID:
API String ID: 4111779564-0
Opcode ID: 6dc88085493ff0b300ef62be2022bd5eecc8d4ce854d6e52a3ec44fb1fc64361
Instruction ID: 8f8f74fde1a01cbe1bb12d28b01b5064cba74e7af9c990e0183b89a63108f47a
Opcode Fuzzy Hash: 6dc88085493ff0b300ef62be2022bd5eecc8d4ce854d6e52a3ec44fb1fc64361
Instruction Fuzzy Hash: D0315E74901248EBCB049F91DE49BEEBBB8FB48701F00812AF541BB2A4C7B85985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00413100, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__vbaVarTstNe.MSVBVM60(?,?), ref: 00413164
__vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 0041317F

Strings

Bebyrdelses9, xrefs: 00413179
Hvislendes8, xrefs: 00413174

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba
String ID: Bebyrdelses9$Hvislendes8
API String ID: 3524132090-1996639642
Opcode ID: 68093a532412e65ef241b1491ff73f36d8f5636b0fcf591279e217219112fe44
Instruction ID: 35ff8a3f9e9de3b900832c2110d4a310f58da126c94b94fdcd018c4d2a64b38d
Opcode Fuzzy Hash: 68093a532412e65ef241b1491ff73f36d8f5636b0fcf591279e217219112fe44
Instruction Fuzzy Hash: 12010CB0910218BBCB10DF98C989BDDBFB8BF08B44F14815AF504B6251D7B91585CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004131C0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410824,004145C0), ref: 00413203
__vbaHresultCheckObj.MSVBVM60(00000000,02A7004C,00410814,0000004C), ref: 00413228
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410850,00000028), ref: 00413248
__vbaFreeObj.MSVBVM60 ref: 00413251

Memory Dump Source

Source File: 00000000.00000002.874275829.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.874269233.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.874298287.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.874306112.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 7b143a1cf2ffaeb7d32b2d42edd302fd4936fc20c17dd59404b4c77dec335ac2
Instruction ID: 31fbc812d28f71308fd95695de7c808f0f112ad60c5a0b29e90e68621daca0d6
Opcode Fuzzy Hash: 7b143a1cf2ffaeb7d32b2d42edd302fd4936fc20c17dd59404b4c77dec335ac2
Instruction Fuzzy Hash: 0C115174640205BBD700AF69CE49FDA7BF8FB18B01F104165B605F32A0E7B859858AE8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe PID: 3504 Parent PID: 5784

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exe PID: 3504 Parent PID: 5784 Zapytanie ofertowe (SHELMO Sp. z o.o. 09272021).exeCOMMON

Executed Functions

Function 004012C8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON