Play interactive tour

Edit tour

Windows Analysis Report Delivery note_241493.exe

Overview

General Information

Sample Name:	Delivery note_241493.exe
Analysis ID:	502122
MD5:	ae27dccff11f1c8e17661269d90148b9
SHA1:	365138784e65ad92bc8f05653374348aa4e00788
SHA256:	dd739f42791b213769f242efac95b60d0026825d5c882d576533cd8ae57514b6
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

Delivery note_241493.exe (PID: 3148 cmdline: 'C:\Users\user\Desktop\Delivery note_241493.exe' MD5: AE27DCCFF11F1C8E17661269D90148B9)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1kFeDtVEJdXDeWXxK="}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1kFeDtVEJdXDeWXxK="}

Source: Delivery note_241493.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1kFeDtVEJdXDeWXxK=

Source: Delivery note_241493.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Delivery note_241493.exe, 00000000.00000000.250683237.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTains4.exe vs Delivery note_241493.exe
Source: Delivery note_241493.exe	Binary or memory string: OriginalFilenameTains4.exe vs Delivery note_241493.exe

Source: C:\Users\user\Desktop\Delivery note_241493.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00401679	0_2_00401679
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_0040162C	0_2_0040162C
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_0040143D	0_2_0040143D
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B074AF	0_2_02B074AF
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B0524E	0_2_02B0524E
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B003C2	0_2_02B003C2
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B0516D	0_2_02B0516D

Source: C:\Users\user\Desktop\Delivery note_241493.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF338A7E18907ED6EA.TMP

Jump to behavior

Source: Delivery note_241493.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Delivery note_241493.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Delivery note_241493.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00405C5C push edx; retf	0_2_00405C6F
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00405E5F push esp; ret	0_2_00405E60
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00406809 pushad ; iretd	0_2_0040681A
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00405A23 push cs; iretd	0_2_00405ADA
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_004038B9 push 4EA9091Fh; iretd	0_2_004038BE
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00405376 pushad ; retf	0_2_004053D4
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00405376 push esi; ret	0_2_004054C4
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_00406915 push edi; iretd	0_2_00406917
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_004053D5 push esi; ret	0_2_004054C4
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B028C8 push esp; iretd	0_2_02B028CB
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B010CB push ecx; retf	0_2_02B010DB
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B02834 push ebp; retf	0_2_02B02838
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B02E35 pushad ; retn 0004h	0_2_02B02E4E
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B04BF1 push cs; retf	0_2_02B04C36
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B04BE2 push cs; retf	0_2_02B04C36

Source: C:\Users\user\Desktop\Delivery note_241493.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Delivery note_241493.exe

RDTSC instruction interceptor: First address: 000000000040F270 second address: 000000000040F270 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 cmp ecx, 2Bh 0x00000008 popad 0x00000009 mfence 0x0000000c wait 0x0000000d dec edi 0x0000000e pushfd 0x0000000f popfd 0x00000010 nop 0x00000011 cmp edi, 00000000h 0x00000014 jne 00007F8D90FDCBEFh 0x00000016 lfence 0x00000019 cmp ecx, 000000FCh 0x0000001f pushad 0x00000020 nop 0x00000021 pushfd 0x00000022 popfd 0x00000023 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Delivery note_241493.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B09ED5 mov eax, dword ptr fs:[00000030h]	0_2_02B09ED5
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B099E3 mov eax, dword ptr fs:[00000030h]	0_2_02B099E3
Source: C:\Users\user\Desktop\Delivery note_241493.exe	Code function: 0_2_02B06DEB mov eax, dword ptr fs:[00000030h]	0_2_02B06DEB

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Delivery note_241493.exe, 00000000.00000002.785681023.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: Delivery note_241493.exe, 00000000.00000002.785681023.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Delivery note_241493.exe, 00000000.00000002.785681023.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Delivery note_241493.exe, 00000000.00000002.785681023.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Delivery note_241493.exe	8%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502122
Start date:	13.10.2021
Start time:	16:18:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Delivery note_241493.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 42.1% (good quality ratio 24.8%) Quality average: 36.7% Quality standard deviation: 35.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.216.89, 20.50.102.62, 2.20.178.56, 2.20.178.10, 20.54.110.249, 40.112.88.60, 2.20.178.33, 2.20.178.24, 20.82.209.183 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.792803239292208
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Delivery note_241493.exe
File size:	98304
MD5:	ae27dccff11f1c8e17661269d90148b9
SHA1:	365138784e65ad92bc8f05653374348aa4e00788
SHA256:	dd739f42791b213769f242efac95b60d0026825d5c882d576533cd8ae57514b6
SHA512:	6757d4c3370e72ee590c7f37ff2f4a5071cf6aadacd6ce7e4730c3e1b4ea8fc36d2206c5994a887347524bfd3134553413a65637f4091c2c35a2ce2bd2c9b159
SSDEEP:	1536:t+DTwpq/hDgCLBytxYxAK1zjzAk1Knpps45QJcs1VlkOO0tFVVOWHZRGD:t+Ypq/hcAytIBfz/1KnppsxJJ1VlkWnc
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....{_Q.................@...0...............P....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x4012b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x515F7BE1 [Sat Apr 6 01:35:29 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3d3cd1bd8dcc611a5734bf41f4e1a6a6

Entrypoint Preview

Instruction
push 004106D0h
call 00007F8D90A735D3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+3AC426A1h], ah
popad
iretd
dec ebx
xchg byte ptr [ebp+71h], ah
test byte ptr [edx-62h], ah
in eax, 11h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc esi
inc ecx
push edx
push edx
inc ecx
dec esi
push esp
dec esp
pop ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
cmp byte ptr [eax-2CAED641h], dh
stosd
mov es, word ptr [edx-7Bh]
adc eax, esi
cmp eax, dword ptr [edi+220F3A63h]
pop edx
dec edx
push FFFFFFB9h
jnle 00007F8D90A73643h
dec edx
test byte ptr [eax], ch
fld dword ptr [ecx+10h]
in eax, 1Dh
in al, dx
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xchg eax, edx
int1
add byte ptr [eax], al
adc cl, byte ptr [ecx]
add byte ptr [eax], al
add byte ptr [ebx], cl
add byte ptr [ebp+6Eh], dl
popad
je 00007F8D90A73656h
jnc 00007F8D90A73657h
xor dword ptr fs:[eax], eax
or eax, 42000701h
popad
jc 00007F8D90A73650h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x142a4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1c1a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13698	0x14000	False	0.508874511719	data	6.24728492454	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xcc4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1c1a	0x2000	False	0.345092773438	data	3.68121833479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x1791c	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x1705e	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x16d60	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x164b8	0x8a8	data
RT_GROUP_ICON	0x164a4	0x14	data
RT_VERSION	0x161a0	0x304	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	ExpressVPN
InternalName	Tains4
FileVersion	4.00
CompanyName	ExpressVPN
LegalTrademarks	ExpressVPN
Comments	ExpressVPN
ProductName	ExpressVPN
ProductVersion	4.00
FileDescription	ExpressVPN
OriginalFilename	Tains4.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Delivery note_241493.exe PID: 3148 Parent PID: 5712

General

Start time:	16:19:08
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\Delivery note_241493.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Delivery note_241493.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	AE27DCCFF11F1C8E17661269D90148B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Delivery note_241493.exe PID: 3148 Parent PID: 5712 Delivery note_241493.exeCOMMON

Executed Functions

Function 00413BE0, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413C79
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413C98
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000000F8), ref: 00413CBE
__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413CD7
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413CF0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001B4), ref: 00413DA0
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413DB0
#606.MSVBVM60(00000001,?), ref: 00413DCD
__vbaStrMove.MSVBVM60 ref: 00413DD8
__vbaStrCmp.MSVBVM60(00411058,00000000), ref: 00413DEA
__vbaFreeStr.MSVBVM60 ref: 00413DF9
__vbaFreeVar.MSVBVM60 ref: 00413E08
#706.MSVBVM60(00000001,00000000,00000000), ref: 00413E19
__vbaStrMove.MSVBVM60 ref: 00413E24
__vbaNew2.MSVBVM60(00411004,00415590), ref: 00413E3D
__vbaHresultCheckObj.MSVBVM60(00000000,020A004C,00410FF4,00000014), ref: 00413E62
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411014,00000070), ref: 00413E89
__vbaFreeObj.MSVBVM60 ref: 00413E92
#580.MSVBVM60(Stalakitter,00000001), ref: 00413E9F
#574.MSVBVM60(00000002), ref: 00413EB7
__vbaStrMove.MSVBVM60 ref: 00413EC2
__vbaStrCmp.MSVBVM60(0041107C,00000000), ref: 00413ECE
__vbaFreeStr.MSVBVM60 ref: 00413EDD
__vbaFreeVar.MSVBVM60 ref: 00413EE6
#594.MSVBVM60(00000002), ref: 00413F01
__vbaFreeVar.MSVBVM60 ref: 00413F0A
#648.MSVBVM60(00000002), ref: 00413F16
__vbaFreeVar.MSVBVM60 ref: 00413F1F
__vbaVarDup.MSVBVM60 ref: 00413F3B
#666.MSVBVM60(?,00000002), ref: 00413F49
__vbaVarMove.MSVBVM60 ref: 00413F55
__vbaFreeVar.MSVBVM60 ref: 00413F5E
__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413F9A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413FB3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000000F8), ref: 00413FDD
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410C2C,000006F8), ref: 00414014
__vbaFreeObj.MSVBVM60 ref: 0041401D
__vbaNew2.MSVBVM60(004111EC,@\), ref: 00414036
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041404F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,00000130), ref: 00414076
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00414088
__vbaStrVarMove.MSVBVM60(00000000), ref: 00414092
__vbaStrMove.MSVBVM60 ref: 0041409D
__vbaFreeStr.MSVBVM60 ref: 004140C4
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004140D4
__vbaFreeVar.MSVBVM60 ref: 004140E0
__vbaNew2.MSVBVM60(004111EC,@\), ref: 004140F5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041410E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,00000078), ref: 00414138
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410C2C,000006FC), ref: 00414189
__vbaFreeObj.MSVBVM60 ref: 0041418E
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410BFC,000002B4), ref: 004141AF
__vbaVarAdd.MSVBVM60(00000002,?,?), ref: 004141DD
__vbaVarMove.MSVBVM60 ref: 004141E4
#598.MSVBVM60 ref: 004141EA
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 00414208
__vbaFreeVar.MSVBVM60(00414272), ref: 00414261
__vbaFreeStr.MSVBVM60 ref: 00414266
__vbaFreeVar.MSVBVM60 ref: 0041426F

Strings

zk:K&6, xrefs: 00414116, 0041411C
Mallorcinerens, xrefs: 00413F2A
Stalakitter, xrefs: 00413E9A
, xrefs: 00413DBC
@\, xrefs: 00413C22, 00413C6F, 00413C7F, 00413CC4, 00413CCD, 00413CDD, 00413F87, 00413F90, 00413FA0, 00414023, 0041402C, 0041403C, 004140E2, 004140EB, 004140FB

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#574#580#594#598#606#648#666#706CallLate
String ID: $@\$Mallorcinerens$Stalakitter$zk:K&6
API String ID: 1003127262-4132851195
Opcode ID: fb9012a9b7921ee2bbdf570e41c1b7a46f8804321f16d06dfe129dfd8e50577b
Instruction ID: 2771da817462343ba28014306b4faa651393d39e15e1ea5e5a14d5ffd8e3a9a0
Opcode Fuzzy Hash: fb9012a9b7921ee2bbdf570e41c1b7a46f8804321f16d06dfe129dfd8e50577b
Instruction Fuzzy Hash: 9B123A70A00219EFDB10DFA5DD88BDEBBB8FF48704F10816AE549A7260DB745A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6"*), ref: 004012B9

Strings

VB5!6"*, xrefs: 004012B4

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: ad5c034ffb9058339c619adc7bb3e39a77b379a049b8d70b0f235033fd197c52
Instruction ID: 45bd0d13e4e4182b1e38fa9826e084f0eea559ebe950a83726e08ea8bec5cbf0
Opcode Fuzzy Hash: ad5c034ffb9058339c619adc7bb3e39a77b379a049b8d70b0f235033fd197c52
Instruction Fuzzy Hash: 43D0B61698E3C00FE30393B11A265862F700C6366079F04EBD4C2EE0E3C49C18A9C73B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B003C2, Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

iDbh, xrefs: 02B00452

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: iDbh
API String ID: 0-73114310
Opcode ID: c14f9909c34ca223de3ea8f6f66dfc65cc8d82a852534e04f8cf378653f0c160
Instruction ID: 575c2684ff3f744dbe29ece6b5c44e5918528020fafa8824ffc97bc1f138a736
Opcode Fuzzy Hash: c14f9909c34ca223de3ea8f6f66dfc65cc8d82a852534e04f8cf378653f0c160
Instruction Fuzzy Hash: 23313A758283A4EAC3119FB0C49969E7FA4FF1B200F15598DE4984B6B1CFB445438B9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040143D, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 02B0516D, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b1043a8cdbcbfb7122b6ec58896b3ec9a3a834fa8c76a113ace884a4e80305
Instruction ID: f245b3dc82e657f8359b906262448a8b20104b1b8f7eb3b944cb6fff14b5b720
Opcode Fuzzy Hash: 18b1043a8cdbcbfb7122b6ec58896b3ec9a3a834fa8c76a113ace884a4e80305
Instruction Fuzzy Hash: E351CE726113848FDB34CE2A99D47DE7AE3FF58604F99452AC84D8BA15D330AA41CF09

Uniqueness

Uniqueness Score: -1.00%

Function 02B0524E, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95702c155cad5d2a882d031928a487401f305ccc31273e6516506e2ac26c7fc1
Instruction ID: 7c21f24be7981e0d05bdaa0ad174351df0129c6efa76f419a7560c32924dc290
Opcode Fuzzy Hash: 95702c155cad5d2a882d031928a487401f305ccc31273e6516506e2ac26c7fc1
Instruction Fuzzy Hash: 1831BF726117849FCB74CE29D8D57DA7AE2FF4C604F99852A884E4FA56D330AA00CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00401679, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 02B074AF, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf9f19ca5852e67b94fc2fecfe1801df007a075d47068bf3aba803124d6e13a
Instruction ID: b08db1613313691ac7d92dbaa9c27d5af99c7b02d347e72feeb49126759c1bdc
Opcode Fuzzy Hash: adf9f19ca5852e67b94fc2fecfe1801df007a075d47068bf3aba803124d6e13a
Instruction Fuzzy Hash: 0211BFB2808345CFD768AE34C9997BEFBA1FF58350F52492D89CA961A1C7305681CF12

Uniqueness

Uniqueness Score: -1.00%

Function 02B09ED5, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a95f83b700cc1d5422a2f2a97c092ee5e66ed74f923717ff15c6a701ca9230
Instruction ID: d69c749128f7768dc7c8b2a2c2ceddc65f13c0415ad97294c8d46a0e58747a0c
Opcode Fuzzy Hash: b3a95f83b700cc1d5422a2f2a97c092ee5e66ed74f923717ff15c6a701ca9230
Instruction Fuzzy Hash: EE110235604688CFCB35DF24C9D8AD9B7B1BF55B10F1884A9E809CB621CB30AA45DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0040162C, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 02B06DEB, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aea52b760b6ee111d3ec5e38b38bb0bb6718d349a07d15fc9fc510425a049bf
Instruction ID: 43fe41e505802848b27975c1aea7631347d956f7843b7466bd303762b70dad09
Opcode Fuzzy Hash: 8aea52b760b6ee111d3ec5e38b38bb0bb6718d349a07d15fc9fc510425a049bf
Instruction Fuzzy Hash: E0B092BA2026808FFB41CF08C491B0173A4FB01A88B980490E802CB712E228E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02B099E3, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.788395065.0000000002B00000.00000040.00000001.sdmp, Offset: 02B00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00413770, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

#685.MSVBVM60 ref: 004137C2
__vbaObjSet.MSVBVM60(?,00000000), ref: 004137D3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411034,0000001C), ref: 004137F0
__vbaFreeObj.MSVBVM60 ref: 00413808
__vbaNew2.MSVBVM60(00411004,00415590), ref: 00413829
__vbaHresultCheckObj.MSVBVM60(00000000,020A004C,00410FF4,00000014), ref: 0041384E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411014,000000D0), ref: 00413878
__vbaStrMove.MSVBVM60 ref: 0041388D
__vbaFreeObj.MSVBVM60 ref: 00413892
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 004138A2
__vbaStrVarMove.MSVBVM60(?), ref: 004138AC
__vbaStrMove.MSVBVM60 ref: 004138B7
__vbaFreeVar.MSVBVM60 ref: 004138BC
#568.MSVBVM60(00000063), ref: 004138C4
__vbaNew2.MSVBVM60(004111EC,@\), ref: 004138DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 004138F6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411044,00000178), ref: 00413977
__vbaFreeObj.MSVBVM60 ref: 00413980
__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413999
__vbaObjSet.MSVBVM60(?,00000000), ref: 004139B8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000000F8), ref: 004139DB
__vbaNew2.MSVBVM60(004111EC,@\), ref: 004139F4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413A0D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001B4), ref: 00413AA8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413AB8
__vbaFreeStr.MSVBVM60(00413B00), ref: 00413AF8
__vbaFreeStr.MSVBVM60 ref: 00413AFD

Strings

@\, xrefs: 004138CA, 004138D3, 004138E3, 00413986, 0041398F, 0041399F, 004139E1, 004139EA, 004139FA

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#539#568#685List
String ID: @\
API String ID: 342513763-3984165437
Opcode ID: 4062e646641915c3c2fe9581579fd7a223b85b310baa66095836b626a5a216cb
Instruction ID: 46b7b74fbefb11aec07ec8abca4a370cfe5b3f83fd4ed91ab9150128fedc6eb3
Opcode Fuzzy Hash: 4062e646641915c3c2fe9581579fd7a223b85b310baa66095836b626a5a216cb
Instruction Fuzzy Hash: D0B14974A00204EFCB10DFA9C989AD9BBF9FF4C700F14816AE509E72A1D7759981CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00413400, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413453
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413472
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001B0), ref: 004134B1
__vbaFreeObj.MSVBVM60 ref: 004134BA
__vbaNew2.MSVBVM60(004111EC,@\), ref: 004134D3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004134EC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,00000098), ref: 0041350F
__vbaNew2.MSVBVM60(004111EC,@\), ref: 00413528
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413541
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001B4), ref: 004135D0
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004135E0
__vbaNew2.MSVBVM60(004111EC,@\), ref: 004135FC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413615
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001A8), ref: 00413638
__vbaFreeObj.MSVBVM60 ref: 00413641

Strings

@\, xrefs: 00413437, 00413449, 00413459, 004134C0, 004134C9, 004134D9, 00413515, 0041351E, 0041352E, 004135E6, 004135F2, 00413602

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID: @\
API String ID: 191279167-3984165437
Opcode ID: c9814bf8b46120b0649e64c0c88bb76143ad085149ed712300bd1e0d73688651
Instruction ID: a2bd2282e0936a3ae67f97e022c2bf2a51257d2e9314216f6652aae60ba54125
Opcode Fuzzy Hash: c9814bf8b46120b0649e64c0c88bb76143ad085149ed712300bd1e0d73688651
Instruction Fuzzy Hash: A7713A74A00204EFCB10DFA8C989ADABBF8FF4C700B10846AE945E7361D7749941CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004131E0, Relevance: 22.7, APIs: 15, Instructions: 154COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 00413238
__vbaVarTstNe.MSVBVM60(?,?), ref: 00413254
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 00413267
__vbaNew2.MSVBVM60(00411004,00415590), ref: 0041328B
__vbaHresultCheckObj.MSVBVM60(00000000,020A004C,00410FF4,00000014), ref: 004132B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411014,000000C0), ref: 004132E4
__vbaFreeObj.MSVBVM60 ref: 004132EF
__vbaNew2.MSVBVM60(00411004,00415590), ref: 00413304
__vbaHresultCheckObj.MSVBVM60(00000000,020A004C,00410FF4,00000014), ref: 00413329
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411014,000000B8), ref: 0041334F
__vbaFreeObj.MSVBVM60 ref: 00413354
__vbaNew2.MSVBVM60(00411004,00415590), ref: 00413369
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041337F
__vbaHresultCheckObj.MSVBVM60(00000000,020A004C,00410FF4,00000010), ref: 00413399
__vbaFreeObj.MSVBVM60 ref: 0041339E

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#714AddrefList
String ID:
API String ID: 169271594-0
Opcode ID: 09625c280e9631241557536d8fc5b052ae55058b09770ef63fe0e2634452116e
Instruction ID: 7ae62a6344c3a54454090a00e62edea1208f7460db843d065232987866f13041
Opcode Fuzzy Hash: 09625c280e9631241557536d8fc5b052ae55058b09770ef63fe0e2634452116e
Instruction Fuzzy Hash: 81515171900209EFDB10DFA5CD85BDEBBB9FB08705F204429E545F32A1D778AA85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413690, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004111EC,@\), ref: 004136D3
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 004136EC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411024,000001B0), ref: 0041372F
__vbaFreeObj.MSVBVM60 ref: 00413738

Strings

@\, xrefs: 004136B9, 004136C9, 004136D9

Memory Dump Source

Source File: 00000000.00000002.784852295.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.784665161.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.785031557.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.785052562.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: @\
API String ID: 1645334062-3984165437
Opcode ID: b8248bf81dab8640005362eced54ad9dc81a1f7c8877fc280de6835fb5c108fe
Instruction ID: 911490bf4439230edc2d1c5686e2a7c72a8a4c7a86aab5f370ef4ebf08e48abd
Opcode Fuzzy Hash: b8248bf81dab8640005362eced54ad9dc81a1f7c8877fc280de6835fb5c108fe
Instruction Fuzzy Hash: 131163B4A00305EBC710DFA9CE49BDABBB8FB4C701F108529F545E7790D778A9408BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Delivery note_241493.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Delivery note_241493.exe PID: 3148 Parent PID: 5712

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Delivery note_241493.exe PID: 3148 Parent PID: 5712 Delivery note_241493.exeCOMMON

Executed Functions

Function 00413BE0, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Function 004012B4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Non-executed Functions