Play interactive tour

Edit tour

Windows Analysis Report PEDIDO.exe

Overview

General Information

Sample Name:	PEDIDO.exe
Analysis ID:	502290
MD5:	83046fa32e563289dbd98efe27f884f4
SHA1:	fdacb1537161c011f5803471b6971225010d4e71
SHA256:	6b3d06b20b3ae5a3dd8d3a2eb9eb1f1a86d9ba5eb59f5ef75cfa1b2f28dcfd6c
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

PEDIDO.exe (PID: 5460 cmdline: 'C:\Users\user\Desktop\PEDIDO.exe' MD5: 83046FA32E563289DBD98EFE27F884F4)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?expordD|"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?expordD|"}

Source: PEDIDO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?expordD|

Source: PEDIDO.exe, 00000000.00000002.775910735.000000000079A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: PEDIDO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D754D NtAllocateVirtualMemory,	0_2_021D754D
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7685 NtAllocateVirtualMemory,	0_2_021D7685
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7500 NtAllocateVirtualMemory,	0_2_021D7500
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D75B8 NtAllocateVirtualMemory,	0_2_021D75B8

Source: PEDIDO.exe, 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSkovslotte5.exe vs PEDIDO.exe
Source: PEDIDO.exe	Binary or memory string: OriginalFilenameSkovslotte5.exe vs PEDIDO.exe

Source: C:\Users\user\Desktop\PEDIDO.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00401441	0_2_00401441
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_0040167D	0_2_0040167D
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00401630	0_2_00401630
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021DB8DA	0_2_021DB8DA
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D754D	0_2_021D754D
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5814	0_2_021D5814
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7A10	0_2_021D7A10
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7C39	0_2_021D7C39
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D6068	0_2_021D6068
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021DA48D	0_2_021DA48D
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5A83	0_2_021D5A83
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5CBC	0_2_021D5CBC
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D62B0	0_2_021D62B0
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D54DB	0_2_021D54DB
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D9ED7	0_2_021D9ED7
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D6EC8	0_2_021D6EC8
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D56FC	0_2_021D56FC
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7B1C	0_2_021D7B1C
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7D1B	0_2_021D7D1B
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D6F08	0_2_021D6F08
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5F07	0_2_021D5F07
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7500	0_2_021D7500
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5B38	0_2_021D5B38
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021DA941	0_2_021DA941
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7342	0_2_021D7342
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5167	0_2_021D5167
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5B94	0_2_021D5B94
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021DA7BC	0_2_021DA7BC
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D15B1	0_2_021D15B1
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D51B1	0_2_021D51B1
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D79A0	0_2_021D79A0
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D59D5	0_2_021D59D5
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D7BF4	0_2_021D7BF4
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D5DF0	0_2_021D5DF0
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D67E9	0_2_021D67E9
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D55E0	0_2_021D55E0

Source: C:\Users\user\Desktop\PEDIDO.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DFA503C7990D69B3B8.TMP

Jump to behavior

Source: PEDIDO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PEDIDO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PEDIDO.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00406171 push ds; ret	0_2_00406172
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D0678 push ecx; iretd	0_2_021D0680
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D24A4 push ebx; retf	0_2_021D24A5
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D1728 push ecx; iretd	0_2_021D18BD
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D8B9E push es; iretd	0_2_021D8B9F
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D15B1 push ecx; iretd	0_2_021D18BD
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D17C4 push ecx; iretd	0_2_021D18BD

Source: C:\Users\user\Desktop\PEDIDO.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PEDIDO.exe	RDTSC instruction interceptor: First address: 000000000040F011 second address: 000000000040F011 instructions: 0x00000000 rdtsc 0x00000002 wait 0x00000003 mfence 0x00000006 popad 0x00000007 nop 0x00000008 nop 0x00000009 dec edi 0x0000000a mfence 0x0000000d cmp ecx, 000000D9h 0x00000013 cmp edi, 00000000h 0x00000016 jne 00007F6A04DFC4ABh 0x00000018 pushfd 0x00000019 popfd 0x0000001a cmp eax, 3Eh 0x0000001d pushad 0x0000001e lfence 0x00000021 cmp ecx, 00000096h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\PEDIDO.exe	RDTSC instruction interceptor: First address: 00000000021D6E81 second address: 00000000021D6E81 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 22DB5954h 0x00000007 xor eax, 441A9EA9h 0x0000000c sub eax, 6FF07AD2h 0x00000011 xor eax, F6D14D2Ah 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F6A04394AB8h 0x0000001e lfence 0x00000021 mov edx, 46F988CAh 0x00000026 xor edx, 81718B2Dh 0x0000002c xor edx, 9D47D208h 0x00000032 xor edx, 2531D1FBh 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 cmp dx, cx 0x00000044 pop ecx 0x00000045 add edi, edx 0x00000047 dec ecx 0x00000048 mov dword ptr [ebp+0000019Eh], edi 0x0000004e mov edi, 702D4F49h 0x00000053 cmp edx, ecx 0x00000055 add edi, 87EB9CDBh 0x0000005b sub edi, 175830E3h 0x00000061 add edi, 1F3F44BFh 0x00000067 cmp ecx, edi 0x00000069 mov edi, dword ptr [ebp+0000019Eh] 0x0000006f jne 00007F6A04394A6Ch 0x00000071 mov dword ptr [ebp+000001CFh], eax 0x00000077 mov eax, ecx 0x00000079 test dl, cl 0x0000007b push eax 0x0000007c mov eax, dword ptr [ebp+000001CFh] 0x00000082 call 00007F6A04394B7Fh 0x00000087 call 00007F6A04394AD9h 0x0000008c lfence 0x0000008f mov edx, 46F988CAh 0x00000094 xor edx, 81718B2Dh 0x0000009a xor edx, 9D47D208h 0x000000a0 xor edx, 2531D1FBh 0x000000a6 mov edx, dword ptr [edx] 0x000000a8 lfence 0x000000ab ret 0x000000ac mov esi, edx 0x000000ae pushad 0x000000af rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PEDIDO.exe

Code function: 0_2_021D6E18 rdtsc

0_2_021D6E18

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\PEDIDO.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D980C mov eax, dword ptr fs:[00000030h]	0_2_021D980C
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D6CBF mov eax, dword ptr fs:[00000030h]	0_2_021D6CBF
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021D9D56 mov eax, dword ptr fs:[00000030h]	0_2_021D9D56
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_021DA941 mov eax, dword ptr fs:[00000030h]	0_2_021DA941

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PEDIDO.exe

Code function: 0_2_021D6E18 rdtsc

0_2_021D6E18

Source: C:\Users\user\Desktop\PEDIDO.exe

Code function: 0_2_021DB8DA RtlAddVectoredExceptionHandler,

0_2_021DB8DA

Source: PEDIDO.exe, 00000000.00000002.777397061.0000000000D20000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: PEDIDO.exe, 00000000.00000002.777397061.0000000000D20000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PEDIDO.exe, 00000000.00000002.777397061.0000000000D20000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PEDIDO.exe, 00000000.00000002.777397061.0000000000D20000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery21	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PEDIDO.exe	8%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502290
Start date:	13.10.2021
Start time:	19:19:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PEDIDO.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 29.4% (good quality ratio 18.4%) Quality average: 42.8% Quality standard deviation: 38.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 95.100.216.89, 20.82.210.154, 209.197.3.8, 20.54.110.249, 40.112.88.60, 2.20.178.24, 2.20.178.33 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.757968809183827
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PEDIDO.exe
File size:	98304
MD5:	83046fa32e563289dbd98efe27f884f4
SHA1:	fdacb1537161c011f5803471b6971225010d4e71
SHA256:	6b3d06b20b3ae5a3dd8d3a2eb9eb1f1a86d9ba5eb59f5ef75cfa1b2f28dcfd6c
SHA512:	9669be8d89c08729dbb62da4cdf54a6dc43fe7b59ecc93ac756a6ed35f42ba38981316465a2b286e124656350993d76f7e6fd5ed51e88324e9d66edcb26df282
SSDEEP:	1536:t9BDgiAEkkSAIJQpaehY0gB0PXUhzYMns1h7IuDhaD:t9BXAZAADehhgB0PXAzYMnekuDha
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L.....(N.................@...0...............P....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x4012b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4E28E7F0 [Fri Jul 22 03:01:04 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3d3cd1bd8dcc611a5734bf41f4e1a6a6

Entrypoint Preview

Instruction
push 0041052Ch
call 00007F6A04D58AB3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+50h], ch
mov dr0, esp
push eax
cmp dword ptr [ebp-71h], ecx
sti
fcomp st(0), st(3)
push ebx
stc
pop esp
xor dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+45h], cl
push esp
push edx
dec ecx
dec ebx
inc ebp
push edx
inc ebp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
cmp dl, bh
mov byte ptr [E39A3674h], al
in eax, dx
inc edi
test eax, 46B9A7D4h
shr byte ptr [edi], 1
sbb dword ptr [ebx-6Ah], ebx
sar byte ptr [ebx], 0000007Fh
mov esp, FAA4446Eh
mov ah, A2h
xchg eax, esp
jc 00007F6A04D58B3Ch
pop es
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
in eax, dx
out dx, eax
add byte ptr [eax], al
adc eax, 00000009h
adc byte ptr [eax], al
outsd
jbe 00007F6A04D58B27h
jc 00007F6A04D58B2Eh
imul esp, dword ptr [ebx+65h], 6F69746Eh
jne 00007F6A04D58B35h
insb
jns 00007F6A04D58AC2h
or eax, 00000601h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14134	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1c2a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13528	0x14000	False	0.504711914063	data	6.20991689297	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xcc4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1c2a	0x2000	False	0.346557617188	data	3.68630783779	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x1792c	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x1706e	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x16d70	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x164c8	0x8a8	data
RT_GROUP_ICON	0x164b4	0x14	data
RT_VERSION	0x161a0	0x314	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	ExpressVPN
InternalName	Skovslotte5
FileVersion	4.00
CompanyName	ExpressVPN
LegalTrademarks	ExpressVPN
Comments	ExpressVPN
ProductName	ExpressVPN
ProductVersion	4.00
FileDescription	ExpressVPN
OriginalFilename	Skovslotte5.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PEDIDO.exe PID: 5460 Parent PID: 3272

General

Start time:	19:20:08
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\PEDIDO.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PEDIDO.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	83046FA32E563289DBD98EFE27F884F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PEDIDO.exe PID: 5460 Parent PID: 3272 PEDIDO.exeCOMMON

Executed Functions

Function 021D7685, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-4C76C2F1,?,-F902D8EC), ref: 021D773A

Strings

8, xrefs: 021D76D2

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: 8
API String ID: 2167126740-4194326291
Opcode ID: 53448d7376e41cc4d391c0bd1e1e25456d1c0e9f77862eb779e8c32c453cc024
Instruction ID: 6559f8d391ad1dfbcccd30b37cc1f0b1b3dd1526f1825dd53defc5d253f0f5fc
Opcode Fuzzy Hash: 53448d7376e41cc4d391c0bd1e1e25456d1c0e9f77862eb779e8c32c453cc024
Instruction Fuzzy Hash: 344103345483C2CFEB228F7CC8596D9FB62AF4A364F08415EDC899B2A6D7304602CB64

Uniqueness

Uniqueness Score: -1.00%

Function 021DB8DA, Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6a7d1e124e12cf3f026eb133c0b054ea645363ad85470b95425477a5feddc5
Instruction ID: efad48aa3dbeeca8bd0bbec7c9cea8ee14c99849acc3338caef0dff6ec98af1c
Opcode Fuzzy Hash: 5c6a7d1e124e12cf3f026eb133c0b054ea645363ad85470b95425477a5feddc5
Instruction Fuzzy Hash: 20710271648688CFDF798E38C9987EA77A2AF85314F62812ADC4B8F354D734C681CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D7500, Relevance: 1.6, APIs: 1, Instructions: 144memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-4C76C2F1,?,-F902D8EC), ref: 021D773A

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: d0353af6a0c6cfc91eaf552d8ab35371e070d62865a339947f1461f4de8868c6
Instruction ID: 9a9f5aa01d5ac225f70b422de3c3f0b484005f5284fd9bc09dcfd87bb95891b8
Opcode Fuzzy Hash: d0353af6a0c6cfc91eaf552d8ab35371e070d62865a339947f1461f4de8868c6
Instruction Fuzzy Hash: 3C512471648385CFDB718F38CC997DABBA2EF4A314F15055ECC8A9B2A5D3304A42CB56

Uniqueness

Uniqueness Score: -1.00%

Function 021D754D, Relevance: 1.6, APIs: 1, Instructions: 127memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-4C76C2F1,?,-F902D8EC), ref: 021D773A

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3c2a65fe1928a71eb1a6f73ed8da6246e0e88e9f76aaa5a377484c6c07d2523c
Instruction ID: d2f3ca0597cf701d2141b25f846cafbd13208a201d31903166c72092593d8303
Opcode Fuzzy Hash: 3c2a65fe1928a71eb1a6f73ed8da6246e0e88e9f76aaa5a377484c6c07d2523c
Instruction Fuzzy Hash: F65100B2649388CFDB709F28CC997DAB7A6EF99318F010519DC4D9B264D3358A46CF42

Uniqueness

Uniqueness Score: -1.00%

Function 021D75B8, Relevance: 1.6, APIs: 1, Instructions: 120memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-4C76C2F1,?,-F902D8EC), ref: 021D773A

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: a843ead0a61768b7de80c8b0c826d92f911dc11a39bd30015d1f72c9ef78ee40
Instruction ID: 8c2e3125b8aacb106072cdb06eaf029b20e7f230a450eb8b5d1e226f5e206378
Opcode Fuzzy Hash: a843ead0a61768b7de80c8b0c826d92f911dc11a39bd30015d1f72c9ef78ee40
Instruction Fuzzy Hash: 2341E1B5648385CFDB31CF38CC596DABB62AF5A314F04021ECC8D9B295D7314A06CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00413A70, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0041107C,y), ref: 00413B09
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B28
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000000F8), ref: 00413B4E
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413B67
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B80
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001B4), ref: 00413C30
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413C40
#606.MSVBVM60(00000001,?), ref: 00413C5D
__vbaStrMove.MSVBVM60 ref: 00413C68
__vbaStrCmp.MSVBVM60(00410EE8,00000000), ref: 00413C7A
__vbaFreeStr.MSVBVM60 ref: 00413C89
__vbaFreeVar.MSVBVM60 ref: 00413C98
#706.MSVBVM60(00000001,00000000,00000000), ref: 00413CA9
__vbaStrMove.MSVBVM60 ref: 00413CB4
__vbaNew2.MSVBVM60(00410E94,00415590), ref: 00413CCD
__vbaHresultCheckObj.MSVBVM60(00000000,02AB004C,00410E84,00000014), ref: 00413CF2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410EA4,00000070), ref: 00413D19
__vbaFreeObj.MSVBVM60 ref: 00413D22
#580.MSVBVM60(Stalakitter,00000001), ref: 00413D2F
#574.MSVBVM60(00000002), ref: 00413D47
__vbaStrMove.MSVBVM60 ref: 00413D52
__vbaStrCmp.MSVBVM60(00410F0C,00000000), ref: 00413D5E
__vbaFreeStr.MSVBVM60 ref: 00413D6D
__vbaFreeVar.MSVBVM60 ref: 00413D76
#594.MSVBVM60(00000002), ref: 00413D91
__vbaFreeVar.MSVBVM60 ref: 00413D9A
#648.MSVBVM60(00000002), ref: 00413DA6
__vbaFreeVar.MSVBVM60 ref: 00413DAF
__vbaVarDup.MSVBVM60 ref: 00413DCB
#666.MSVBVM60(?,00000002), ref: 00413DD9
__vbaVarMove.MSVBVM60 ref: 00413DE5
__vbaFreeVar.MSVBVM60 ref: 00413DEE
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413E2A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413E43
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000000F8), ref: 00413E6D
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410AA8,000006F8), ref: 00413EA4
__vbaFreeObj.MSVBVM60 ref: 00413EAD
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413EC6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413EDF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,00000130), ref: 00413F06
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00413F18
__vbaStrVarMove.MSVBVM60(00000000), ref: 00413F22
__vbaStrMove.MSVBVM60 ref: 00413F2D
__vbaFreeStr.MSVBVM60 ref: 00413F54
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413F64
__vbaFreeVar.MSVBVM60 ref: 00413F70
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413F85
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413F9E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,00000078), ref: 00413FC8
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410AA8,000006FC), ref: 00414019
__vbaFreeObj.MSVBVM60 ref: 0041401E
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410A78,000002B4), ref: 0041403F
__vbaVarAdd.MSVBVM60(00000002,?,?), ref: 0041406D
__vbaVarMove.MSVBVM60 ref: 00414074
#598.MSVBVM60 ref: 0041407A
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 00414098
__vbaFreeVar.MSVBVM60(00414102), ref: 004140F1
__vbaFreeStr.MSVBVM60 ref: 004140F6
__vbaFreeVar.MSVBVM60 ref: 004140FF

Strings

y, xrefs: 00413AB2, 00413AFF, 00413B0F, 00413B54, 00413B5D, 00413B6D, 00413E17, 00413E20, 00413E30, 00413EB3, 00413EBC, 00413ECC, 00413F72, 00413F7B, 00413F8B
, xrefs: 00413C4C
Mallorcinerens, xrefs: 00413DBA
Stalakitter, xrefs: 00413D2A
zk:K&6, xrefs: 00413FA6, 00413FAC

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#574#580#594#598#606#648#666#706CallLate
String ID: $Mallorcinerens$Stalakitter$zk:K&6$y
API String ID: 1003127262-1759668181
Opcode ID: 3fb572eefc52f177b497d075a08af66f1647808622104ff392917154411f14a4
Instruction ID: c1d66298a17406c4ac23741557e1d0a157476de6bb597e14b3265459ffcde1b1
Opcode Fuzzy Hash: 3fb572eefc52f177b497d075a08af66f1647808622104ff392917154411f14a4
Instruction Fuzzy Hash: 9A124970A00319DFDB10DFA5DD88BDABBB8FF48305F10816AE549A7260DB745A85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6"*), ref: 004012B9

Strings

VB5!6"*, xrefs: 004012B4

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: 467dc737aa8b94c82001d2401ccbd6003c69166d10a4ccdabb9a96ff415a4d71
Instruction ID: b9d2f6751adad05ed045119631103fee3a4ca033b7332fe8de831fefc6b68479
Opcode Fuzzy Hash: 467dc737aa8b94c82001d2401ccbd6003c69166d10a4ccdabb9a96ff415a4d71
Instruction Fuzzy Hash: A241A6A184E7C10FD70397749D696953FB0AF53268B4A42EBC880CF5F7D26D480AD762

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021DA941, Relevance: 11.1, Strings: 8, Instructions: 1111COMMON

Download Yara Rule

Strings

CxH', xrefs: 021DAF39
mWwP, xrefs: 021D5ACB
pm6}, xrefs: 021DAEE9
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$CxH'$Dkz5$W-/v$eAa$mSqx$mWwP$pm6}
API String ID: 0-2917364049
Opcode ID: 4d343ff8a0fc9595064fcdaa6829984833fe695150c6581f3f9a573943228211
Instruction ID: 9879f1580825bf96a99f5e21267e7d3aeaa4e95dc0377d5ba0906d2ba5d4e233
Opcode Fuzzy Hash: 4d343ff8a0fc9595064fcdaa6829984833fe695150c6581f3f9a573943228211
Instruction Fuzzy Hash: ACB21172548389DFCB74CF38CC987DABBA2AF56310F0A815EDC999B291D3348641CB52

Uniqueness

Uniqueness Score: -1.00%

Function 021D67E9, Relevance: 8.3, Strings: 6, Instructions: 792COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 2167126740-1349272540
Opcode ID: 93ee978c3aea49986e1bb9b8e44b7f2456793a935d955e20c5be4cabf8b08b85
Instruction ID: 91823ec19cf448059db9c4d6196dfe79d886b7e379160a7469cd497457137a9a
Opcode Fuzzy Hash: 93ee978c3aea49986e1bb9b8e44b7f2456793a935d955e20c5be4cabf8b08b85
Instruction Fuzzy Hash: 9872FBB2644389DFDB789F28CD447DA7BA2FF95350F46852EDC899B220D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D7342, Relevance: 8.3, Strings: 6, Instructions: 774COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: b8f3320e2d67339d55f51873d63cd7dc1c0e72eaba0f483dab407f462251fdf7
Instruction ID: 2a0c73d06409ecdbbde5f64c2feeb91f90ec6693e999584382573b89b0755603
Opcode Fuzzy Hash: b8f3320e2d67339d55f51873d63cd7dc1c0e72eaba0f483dab407f462251fdf7
Instruction Fuzzy Hash: D672EDB2644389DFDB689F29CD447DABBB2FF95350F06852EDC899B210D3349A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D54DB, Relevance: 8.2, Strings: 6, Instructions: 696COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: cef99f0aea92c70b41683f06d1b442a647e1197b718044a51212fc289497e2ca
Instruction ID: cb2eb04d1fc2f1d30c4bcffff326330076916a51acb7b75bf51f463d24245a03
Opcode Fuzzy Hash: cef99f0aea92c70b41683f06d1b442a647e1197b718044a51212fc289497e2ca
Instruction Fuzzy Hash: E862EBB2644389EFDB648F38CD457DABBA2FF55350F45852EDC899B210D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D55E0, Relevance: 8.2, Strings: 6, Instructions: 668COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: de75f04036fb412f2badeae67e9e4a91a3bd7a157e16920aa2664af4981f8ab0
Instruction ID: f9970107ef1e5310c70cfe5a4ad1ab2c52127b54dec885967b1fdb3e92a55fae
Opcode Fuzzy Hash: de75f04036fb412f2badeae67e9e4a91a3bd7a157e16920aa2664af4981f8ab0
Instruction Fuzzy Hash: 3952EBB2644389DFDB688F38CD547DABBB2FF55350F06812ADC899B260D7349A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D56FC, Relevance: 8.1, Strings: 6, Instructions: 611COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: 1b0d0c0d21e672e7ec3b9137eb3b9750ed3bf028fb9b66651e9cfc1bc9b12c1c
Instruction ID: f7f6adb362bf8ac414083c30a5d1e387d519f05fe694f3863f1d982781a5c1d7
Opcode Fuzzy Hash: 1b0d0c0d21e672e7ec3b9137eb3b9750ed3bf028fb9b66651e9cfc1bc9b12c1c
Instruction Fuzzy Hash: 6642FBB2644389DFDB788F28CD447DABBA2FF94350F55812EDC899B260D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5814, Relevance: 8.1, Strings: 6, Instructions: 561COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: 36a8fcda9d5efaa211e6b0ae449168d562c31c35995fecc8911e36e3d86902fa
Instruction ID: 41ef918ac621f7707ed5df868451c649d3f46053cdd4e810ceae996512fde5aa
Opcode Fuzzy Hash: 36a8fcda9d5efaa211e6b0ae449168d562c31c35995fecc8911e36e3d86902fa
Instruction Fuzzy Hash: EA32CBB2644389EFDB788F28CD547DABBA2FF55350F05852EDC899B260D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D59D5, Relevance: 8.0, Strings: 6, Instructions: 459COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: d6ed1e10c74f3a489b0dfd845c4a20600525306e6c8b94e1be9c97d30e394219
Instruction ID: fcf4e06ac8b439ef2540ddb51f9c8d6924b72c039ec819105b0a396c074bd280
Opcode Fuzzy Hash: d6ed1e10c74f3a489b0dfd845c4a20600525306e6c8b94e1be9c97d30e394219
Instruction Fuzzy Hash: 2422BBB2644389DFDBA48F28CD447DABBA2FF55340F05812ADC899B620D7709A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5A83, Relevance: 8.0, Strings: 6, Instructions: 454COMMON

Download Yara Rule

Strings

mWwP, xrefs: 021D5ACB
W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx$mWwP
API String ID: 0-1349272540
Opcode ID: 8ebe295afecfa6152ee9914cb05a28a6841614ab90853997e91843cbe734a8c4
Instruction ID: 1d6fd5ab5bfd78263da0251ba60ef4026f46fd6b75c09c995eadabdcaf9220e9
Opcode Fuzzy Hash: 8ebe295afecfa6152ee9914cb05a28a6841614ab90853997e91843cbe734a8c4
Instruction Fuzzy Hash: AB12CAB2644389EFDB649F38CD447EABBA2FF55350F05812EDC899B260D7709A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5B38, Relevance: 6.7, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Dkz5, xrefs: 021D5B4D
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$Dkz5$W-/v$eAa$mSqx
API String ID: 0-1759686016
Opcode ID: 3d2eca1302f9094d2fe7eea1288aa8c404cb0a00843266b4d6ca3885f8ab4bfa
Instruction ID: d5e6b642d674aaf314699875916e5b5424946615b230be4f2b3df31dba1861f7
Opcode Fuzzy Hash: 3d2eca1302f9094d2fe7eea1288aa8c404cb0a00843266b4d6ca3885f8ab4bfa
Instruction Fuzzy Hash: F402DDB2644388DFDBB49F28CD547EA7BA2FF55340F06412EDC899B220D7709A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021D5B94, Relevance: 5.4, Strings: 4, Instructions: 428COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
eAa, xrefs: 021D5C35
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v$eAa$mSqx
API String ID: 0-4157767374
Opcode ID: 3824cebbbe9a3d1d066c7c99083986b0023a8bd1fd7871884eec7013bb417677
Instruction ID: f0f69935ca2d573e50d6b66416f4bafe228a47c24aa6a163ea8b1040908dcbb6
Opcode Fuzzy Hash: 3824cebbbe9a3d1d066c7c99083986b0023a8bd1fd7871884eec7013bb417677
Instruction Fuzzy Hash: B812C7B2648388DFDB748F28CD547EA7BA2FF59350F06412EDD899B260D7708A818B51

Uniqueness

Uniqueness Score: -1.00%

Function 021D15B1, Relevance: 4.2, Strings: 3, Instructions: 460COMMON

Download Yara Rule

Strings

\,4, xrefs: 021D18AE
>NAV, xrefs: 021D15D9
&,u{, xrefs: 021D1810

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: &,u{$>NAV$\,4
API String ID: 2167126740-828407719
Opcode ID: 281b2ec0db6f0a53362c1164aeb336561d473ce6793a04033c88c9bf58d8bedf
Instruction ID: f7de34e5575eeebbbd4dc8b7d87bae16046a7df438d1f002dcb53d8625cbef65
Opcode Fuzzy Hash: 281b2ec0db6f0a53362c1164aeb336561d473ce6793a04033c88c9bf58d8bedf
Instruction Fuzzy Hash: A1E1AC715883C6DFC7269F788C892D9BFA2AF46320F19466DC9998F693C7304542CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 021D5CBC, Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v$mSqx
API String ID: 0-1040747695
Opcode ID: dc3a3b57c3e3e957ed0cfaa6ca712b3e66373845133539f188f4826288cf3122
Instruction ID: 42b985ee316a75c5d84ad4de16fe08a2080e9d6748fda558193de991145337e5
Opcode Fuzzy Hash: dc3a3b57c3e3e957ed0cfaa6ca712b3e66373845133539f188f4826288cf3122
Instruction Fuzzy Hash: A002DAB2648388DFDB689F38CD547EA7BA2FF55350F06452EDD899B260D7308A81CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021D5DF0, Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v$mSqx
API String ID: 0-1040747695
Opcode ID: 9abebf83c20b1ace1b9183b4f0635692748507fb1cf0f9a0e8fb9a8fb5e407e2
Instruction ID: 841d115fe0266da073b00153049cae639cd9cc9f6f8843f32f031e8623df5f57
Opcode Fuzzy Hash: 9abebf83c20b1ace1b9183b4f0635692748507fb1cf0f9a0e8fb9a8fb5e407e2
Instruction Fuzzy Hash: CDE1DAB2548388DFDBB89F38CD547EA7BA2FF55350F05451EDD898A220D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5F07, Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v$mSqx
API String ID: 0-1040747695
Opcode ID: f472c8c5db0bc3e570c89b9269dba48ba3d7a4761adf90a592ec78d401276c0e
Instruction ID: bf018347753a5201b25eb214436be3bdcaa35dce5b040642d46276d659a3be41
Opcode Fuzzy Hash: f472c8c5db0bc3e570c89b9269dba48ba3d7a4761adf90a592ec78d401276c0e
Instruction Fuzzy Hash: 63D1C9B2688388DFDB758F38CD547DABBA2FF55314F05412EDD899A264C7308A81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D6068, Relevance: 4.0, Strings: 3, Instructions: 204COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
Qng, xrefs: 021D6392
mSqx, xrefs: 021D607C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v$mSqx
API String ID: 0-1040747695
Opcode ID: 1bde619ce1dde159ece8de29907a48ef048b8d8da0ae430bfd754ca119a1fece
Instruction ID: 5f27607b8a891f4055b88607b0f55814519af771bc6a2add9b32387f89111473
Opcode Fuzzy Hash: 1bde619ce1dde159ece8de29907a48ef048b8d8da0ae430bfd754ca119a1fece
Instruction Fuzzy Hash: 54919BB2684288DFCBB8CF28DD507DA7BA6FF55340F05452EDD899B220D7709A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D79A0, Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48
f, xrefs: 021D79FE

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n$f
API String ID: 0-1551997028
Opcode ID: e7f2e1dc05582af1b457ab01a4cf0847d961325c6b2cd7571c2d8e6361b56a80
Instruction ID: 15cd27d6cfa7c138df8faac47f557825e85c0ec16aef6d9d5e524eed1a96b306
Opcode Fuzzy Hash: e7f2e1dc05582af1b457ab01a4cf0847d961325c6b2cd7571c2d8e6361b56a80
Instruction Fuzzy Hash: 6BC1287168438ADFDB35CF78CC94BDA7BA2AF09350F45422ECD8A6B295D7304A05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D62B0, Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

W-/v, xrefs: 021D64CD
Qng, xrefs: 021D6392

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qng$W-/v
API String ID: 0-3828014847
Opcode ID: 9dd5c61b8715d6b4e35a26e757e24608c30a643f4e0e3d84326b32415b462f00
Instruction ID: 83434d7734f1819d9c392f588265497648fc4028dca17f2cb325453e2864b398
Opcode Fuzzy Hash: 9dd5c61b8715d6b4e35a26e757e24608c30a643f4e0e3d84326b32415b462f00
Instruction Fuzzy Hash: D751EC71284388DFDB358F38DD65BD97BA2FF49354F04416EED895A2A1CB308681CB54

Uniqueness

Uniqueness Score: -1.00%

Function 021D51B1, Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

PPLx, xrefs: 021D53D8
sd2, xrefs: 021D54BD

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: PPLx$sd2
API String ID: 0-3550479558
Opcode ID: 85596b8916e775be17328341edca76f0ab76c78717a9945d0089b33ab8a71273
Instruction ID: 84a6be31504ce05e8c11e76ed44699ef7dd4931664d12964a166aa99eba4a26b
Opcode Fuzzy Hash: 85596b8916e775be17328341edca76f0ab76c78717a9945d0089b33ab8a71273
Instruction Fuzzy Hash: 56513172A85348DFDB74CE1ACA953DBB3E3AF98315FA9411AC84A5B604D335B601CB06

Uniqueness

Uniqueness Score: -1.00%

Function 021D7A10, Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n
API String ID: 0-1341086823
Opcode ID: 5402dca22943c88e04eaad120e29e6ed2fcf2ee2d6e190990220eeeef334d6fb
Instruction ID: 567fa694503bcf1e8eed9147e6d88d8afb3e50b65395b7c8c5b43a1d9d54eb2e
Opcode Fuzzy Hash: 5402dca22943c88e04eaad120e29e6ed2fcf2ee2d6e190990220eeeef334d6fb
Instruction Fuzzy Hash: 64B1CF71684389DFCF789F68CD90BEE37A6AF05340F82812ADD4EAB254E7304A45DB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D7B1C, Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n
API String ID: 0-1341086823
Opcode ID: d64323b1d2aa1e97a023a2a80f6824f3c2846f736a9ad85cde360563c49d6a19
Instruction ID: db0956f359cd3cb89205b320e3fe1be7f769069affba8dbe7ca7ed5a1ef6c17b
Opcode Fuzzy Hash: d64323b1d2aa1e97a023a2a80f6824f3c2846f736a9ad85cde360563c49d6a19
Instruction Fuzzy Hash: E281F37164438ADFCF78CE28CDA5BEA37A6AF05340F42812ADD4EAB650E3304B05DB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D7BF4, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n
API String ID: 0-1341086823
Opcode ID: 0e31684931fd270e23e7535666ba2d81d9496dc8b4af3529fd79d5f0e9a2f914
Instruction ID: 3015acb047f38d31a340e7ad51b8c27929accba7d442b3dc253f230a64762d27
Opcode Fuzzy Hash: 0e31684931fd270e23e7535666ba2d81d9496dc8b4af3529fd79d5f0e9a2f914
Instruction Fuzzy Hash: F771287168438ADFDB74CF78CD91BEA7BA2AF05350F41412DDD9A9B291E7304A01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 021D7C39, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n
API String ID: 0-1341086823
Opcode ID: 9f34ed1fe19bc6433a723d0f7633386670bbf13bc7654d5ec09edd1b0bcfffd9
Instruction ID: 779b44ca1225c279345613fbcef7d93e019671157afb4c5ddab335a2a2768c8d
Opcode Fuzzy Hash: 9f34ed1fe19bc6433a723d0f7633386670bbf13bc7654d5ec09edd1b0bcfffd9
Instruction Fuzzy Hash: BF51D17568438ADFCF78CE28CDA1BEA37A5AF05350F41412ADD4E9B650E7314B01DB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D5167, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

PPLx, xrefs: 021D53D8

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: PPLx
API String ID: 0-2229733129
Opcode ID: 2cc9c3f8a38266fc9e16df701829b50ad93527aba550e73ab860834d0d8e1102
Instruction ID: 806c468fa67c40c348c8172e9b28331b60c92cd71f144674eb19b00ca9b7a484
Opcode Fuzzy Hash: 2cc9c3f8a38266fc9e16df701829b50ad93527aba550e73ab860834d0d8e1102
Instruction Fuzzy Hash: BC515632589385DFDB34CE29CA953DAB7E3AF99324F99411EC88A5F245D330A501CB12

Uniqueness

Uniqueness Score: -1.00%

Function 021D7D1B, Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

J:n, xrefs: 021D7E48

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J:n
API String ID: 0-1341086823
Opcode ID: 78a325e8a69184994ff97f5329573aa84d89f485dceb72fda1c9f8482c93e799
Instruction ID: 6400242236c3ebcc273646f959a82cac0b5e4427aad74d105ee4d821724aed1e
Opcode Fuzzy Hash: 78a325e8a69184994ff97f5329573aa84d89f485dceb72fda1c9f8482c93e799
Instruction Fuzzy Hash: 8C51D3706883CADFCB75CF7C89947EABB62AF05364F44412ECD9A9E286E7314601DB10

Uniqueness

Uniqueness Score: -1.00%

Function 021D6EC8, Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

`, xrefs: 021D702C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: dc04a6c124eea99c62e3d26e7a3ee79bb4f89eb95bee329609775f74b4d0be97
Instruction ID: 37d99013109c0a14a09363386c5b8aaf0c1cad80190badbe0f3d435447a0b4c4
Opcode Fuzzy Hash: dc04a6c124eea99c62e3d26e7a3ee79bb4f89eb95bee329609775f74b4d0be97
Instruction Fuzzy Hash: 1C31BD315887C5CFEB39CF78D9663CA7BA2AF45324F14826ECC5A5E195C7304245CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021D6F08, Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

`, xrefs: 021D702C

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 978b0b6d161bc5344a106c58e1217f66dc78ad96eccbc4b0d4708550471c1f80
Instruction ID: 1eba374043efbf79376df41cf3474914268509bd24c7f26de936d310514f79ee
Opcode Fuzzy Hash: 978b0b6d161bc5344a106c58e1217f66dc78ad96eccbc4b0d4708550471c1f80
Instruction Fuzzy Hash: 292178712887C88ADB78CE28E9663CE37A2BF85314F44812ADC1A5A1A4C7744345CF02

Uniqueness

Uniqueness Score: -1.00%

Function 021D9ED7, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19dd24262bc447c62755129414d98fa04b638da0113bca5fc654ac77393d14ee
Instruction ID: bd61b3f4418f44a2d062a8888b5380798a2eed0fbc2c24a7f37360c315375e89
Opcode Fuzzy Hash: 19dd24262bc447c62755129414d98fa04b638da0113bca5fc654ac77393d14ee
Instruction Fuzzy Hash: D981D2B1984399DFDB74CF29CC847EA77B2AF58300F65412ACC4D9B644D7319A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00401441, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 021DA7BC, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eedeecf610a9cbf69d7865dc57832c4a7893ff3decfa564e8bdf229631f9fce
Instruction ID: 13bd31b73cb9c0144b36babd6e489515d184c7dfb9f7e0c9f43d9f08b7c21c9e
Opcode Fuzzy Hash: 1eedeecf610a9cbf69d7865dc57832c4a7893ff3decfa564e8bdf229631f9fce
Instruction Fuzzy Hash: 5B11063668835A8FCB20DF3CC4D07E667A2AF6A700B464179DD998B306D7304843C785

Uniqueness

Uniqueness Score: -1.00%

Function 021D6E18, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f66609b8540c5cb5c61e641aaa0449b534f69b3935f61cdc7ef4149237779e6
Instruction ID: d0eefc13728941adea55da9bc52031549428fc55a01e4416532b0e490884eb8f
Opcode Fuzzy Hash: 2f66609b8540c5cb5c61e641aaa0449b534f69b3935f61cdc7ef4149237779e6
Instruction Fuzzy Hash: 3621D11568C7D2DEEB13DFBCA559084FF13AD46138328A7AEC4DA2D1DBD7209411C3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040167D, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 021DA48D, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec928ae586cc52910b6474226c2a8584a7c23aacc4b5e9e483b18520eec1848c
Instruction ID: ad543795f5782830f6384e3a38bcf6b40d8a61f2919a9b8e13aa56408cd15dc2
Opcode Fuzzy Hash: ec928ae586cc52910b6474226c2a8584a7c23aacc4b5e9e483b18520eec1848c
Instruction Fuzzy Hash: 1911A3B06183859FDBB9CE78DC667E773A1BF80300F41451E986BCB3A4DB7086018719

Uniqueness

Uniqueness Score: -1.00%

Function 021D9D56, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efe741e44773acb40f366f7c9ae30bde1961c919e1451b75b3b456c4be06bc3
Instruction ID: abf8ac8a4621389da6ce8148ff38189d7cdb9db75a29e09a0737911ab454d6ca
Opcode Fuzzy Hash: 3efe741e44773acb40f366f7c9ae30bde1961c919e1451b75b3b456c4be06bc3
Instruction Fuzzy Hash: E801D275691688CFCB74CE28CA84AD977E1AB59700F618469E908CB314D331EA41CF20

Uniqueness

Uniqueness Score: -1.00%

Function 00401630, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 021D6CBF, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 021D980C, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.778170637.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00413600, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

#685.MSVBVM60 ref: 00413652
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413663
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EC4,0000001C), ref: 00413680
__vbaFreeObj.MSVBVM60 ref: 00413698
__vbaNew2.MSVBVM60(00410E94,00415590), ref: 004136B9
__vbaHresultCheckObj.MSVBVM60(00000000,02AB004C,00410E84,00000014), ref: 004136DE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410EA4,000000D0), ref: 00413708
__vbaStrMove.MSVBVM60 ref: 0041371D
__vbaFreeObj.MSVBVM60 ref: 00413722
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 00413732
__vbaStrVarMove.MSVBVM60(?), ref: 0041373C
__vbaStrMove.MSVBVM60 ref: 00413747
__vbaFreeVar.MSVBVM60 ref: 0041374C
#568.MSVBVM60(00000063), ref: 00413754
__vbaNew2.MSVBVM60(0041107C,y), ref: 0041376D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413786
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410ED4,00000178), ref: 00413807
__vbaFreeObj.MSVBVM60 ref: 00413810
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413829
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413848
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000000F8), ref: 0041386B
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413884
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041389D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001B4), ref: 00413938
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413948
__vbaFreeStr.MSVBVM60(00413990), ref: 00413988
__vbaFreeStr.MSVBVM60 ref: 0041398D

Strings

y, xrefs: 0041375A, 00413763, 00413773, 00413816, 0041381F, 0041382F, 00413871, 0041387A, 0041388A

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#539#568#685List
String ID: y
API String ID: 342513763-1407423915
Opcode ID: 0d012aeed5d589267b0380bbc30fd202d6945c3b22ca26ad8f922c72de804236
Instruction ID: 2fbb3d0470237833e038f403d87e5f1637157bad294c0aea0e6a398f60e833e8
Opcode Fuzzy Hash: 0d012aeed5d589267b0380bbc30fd202d6945c3b22ca26ad8f922c72de804236
Instruction Fuzzy Hash: FCB15CB4A00204EFCB10DFA9D988ADDBBF9FF48300F14856AE549E72A1D7749985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413290, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0041107C,y), ref: 004132E3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413302
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001B0), ref: 00413341
__vbaFreeObj.MSVBVM60 ref: 0041334A
__vbaNew2.MSVBVM60(0041107C,y), ref: 00413363
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041337C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,00000098), ref: 0041339F
__vbaNew2.MSVBVM60(0041107C,y), ref: 004133B8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004133D1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001B4), ref: 00413460
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413470
__vbaNew2.MSVBVM60(0041107C,y), ref: 0041348C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004134A5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001A8), ref: 004134C8
__vbaFreeObj.MSVBVM60 ref: 004134D1

Strings

y, xrefs: 004132C7, 004132D9, 004132E9, 00413350, 00413359, 00413369, 004133A5, 004133AE, 004133BE, 00413476, 00413482, 00413492

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID: y
API String ID: 191279167-1407423915
Opcode ID: 94a00dc535739f452d63772e1140c940111012dd718384473c72ba7c8fbc3ddf
Instruction ID: bda0bd5c9400568b1d1bec474407ab79b0399cf0f6c26180919e6df6dce6a76d
Opcode Fuzzy Hash: 94a00dc535739f452d63772e1140c940111012dd718384473c72ba7c8fbc3ddf
Instruction Fuzzy Hash: BE711A74A00204EFCB10DFA9C989ADABBF8BB4C701B10856AE945E7361D7749841CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413070, Relevance: 22.7, APIs: 15, Instructions: 154COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 004130C8
__vbaVarTstNe.MSVBVM60(?,?), ref: 004130E4
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 004130F7
__vbaNew2.MSVBVM60(00410E94,00415590), ref: 0041311B
__vbaHresultCheckObj.MSVBVM60(00000000,02AB004C,00410E84,00000014), ref: 00413146
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410EA4,000000C0), ref: 00413174
__vbaFreeObj.MSVBVM60 ref: 0041317F
__vbaNew2.MSVBVM60(00410E94,00415590), ref: 00413194
__vbaHresultCheckObj.MSVBVM60(00000000,02AB004C,00410E84,00000014), ref: 004131B9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410EA4,000000B8), ref: 004131DF
__vbaFreeObj.MSVBVM60 ref: 004131E4
__vbaNew2.MSVBVM60(00410E94,00415590), ref: 004131F9
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041320F
__vbaHresultCheckObj.MSVBVM60(00000000,02AB004C,00410E84,00000010), ref: 00413229
__vbaFreeObj.MSVBVM60 ref: 0041322E

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#714AddrefList
String ID:
API String ID: 169271594-0
Opcode ID: 102b1d3e3a96e1b03066c95da38c7d9e88162709b7b54c11fd38eefba32cbe95
Instruction ID: dc0b455483c3343e8a805e3bfe9d89944404ae6c78ba50272849d93903937e85
Opcode Fuzzy Hash: 102b1d3e3a96e1b03066c95da38c7d9e88162709b7b54c11fd38eefba32cbe95
Instruction Fuzzy Hash: 775150B0900204EBDB10DFA5CD85BDEB7B9FB08705F20452AE545B31A1D7786E85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413520, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0041107C,y), ref: 00413563
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041357C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EB4,000001B0), ref: 004135BF
__vbaFreeObj.MSVBVM60 ref: 004135C8

Strings

y, xrefs: 00413549, 00413559, 00413569

Memory Dump Source

Source File: 00000000.00000002.775371802.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775351271.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.775464339.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.775473557.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: y
API String ID: 1645334062-1407423915
Opcode ID: 4980e4ceb4c8d86db0d308b9f9c9432c9602d164503f161ea9b41af41c0313ce
Instruction ID: 6ed02973bb89436fc852641f8432b6640317c8802e02d2b393aeea7320baf756
Opcode Fuzzy Hash: 4980e4ceb4c8d86db0d308b9f9c9432c9602d164503f161ea9b41af41c0313ce
Instruction Fuzzy Hash: 71118674A00305EBC700DFA9CA49BDABBB8FB4CB05F108529F545E7790D778A940CBA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PEDIDO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PEDIDO.exe PID: 5460 Parent PID: 3272

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: PEDIDO.exe PID: 5460 Parent PID: 3272 PEDIDO.exeCOMMON

Executed Functions

Function 021D7685, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105memorynativeCOMMON

Function 021DB8DA, Relevance: 1.7, APIs: 1, Instructions: 179COMMON