Play interactive tour
Edit tourWindows Analysis Report R0xLHA2mT5.exe
Overview
General Information
| Sample Name: | R0xLHA2mT5.exe |
| Analysis ID: | 528072 |
| MD5: | 9f3b8462c508884f6966f3ad4a275799 |
| SHA1: | 6288e611de585a6dc56c6399ef03012698d60392 |
| SHA256: | a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543 |
| Tags: | exeGozi |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Ursnif
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Multi AV Scanner detection for submitted file
Detected unpacking (overwrites its own PE header)
Yara detected Ursnif
Detected unpacking (changes PE section rights)
Writes or reads registry keys via WMI
Machine Learning detection for sample
Writes registry values via WMI
Uses 32bit PE files
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
PE file contains strange resources
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
Threatname: Ursnif |
|---|
{"RSA Public Key": "dm+RfNkITE5FceWriGPYkZaFfoP/k2XQ2jeLd8rNgFw6gJ6fNWsHd0U6akxsQHth/SBWm4/eMI9Y1qgwNJteasgQsUC7Ht20y96mIxH1hvPh9uvLSH5z2CNo+fcP8K+V0yoOOQzDln/qE7mMJHLu+rmogHE7S6lb7FVy/7xxrRe3zMDt5K9bDwOreWw0blGE", "c2_domain": ["yahoo.com", "soderunovos.website", "qoderunovos.website", "https://soderunovos.website", "https://qoderunovos.website"], "botnet": "4482", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "dga_base_url": "constitution.org/usdeclar.txt", "dga_tld": "com ru org", "DGA_count": "10"}Yara Overview |
|---|
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | ||
| Click to see the 6 entries | ||||
Unpacked PEs |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Ursnif_1 | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif_1 | Yara detected Ursnif | Joe Security | ||
| JoeSecurity_Ursnif_1 | Yara detected Ursnif | Joe Security |
Sigma Overview |
|---|
| No Sigma rule has matched |
|---|
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: |   |
|---|
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Machine Learning detection for sample | Show sources | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
Compliance: | |
|---|
| Detected unpacking (overwrites its own PE header) | Show sources | ||
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | JA3 fingerprint: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | Code function: | 0_2_022B5988 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
E-Banking Fraud: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
System Summary: | |
|---|
| Writes or reads registry keys via WMI | Show sources | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Writes registry values via WMI | Show sources | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | WMI Registry write: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_022B836E | |
| Source: | Code function: | 0_2_022B7FBE | |
| Source: | Code function: | 0_2_022BAFC0 | |
| Source: | Code function: | 0_2_00401703 | |
| Source: | Code function: | 0_2_00401C90 | |
| Source: | Code function: | 0_2_004019A0 | |
| Source: | Code function: | 0_2_022B9A0F | |
| Source: | Code function: | 0_2_022BB1E5 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Metadefender: | ||
| Source: | ReversingLabs: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_022B8F1B | |
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation: | |
|---|
| Detected unpacking (overwrites its own PE header) | Show sources | ||
| Source: | Unpacked PE file: | ||
| Detected unpacking (changes PE section rights) | Show sources | ||
| Source: | Unpacked PE file: | ||
| Source: | Code function: | 0_2_022BE630 | |
| Source: | Code function: | 0_2_022BAC09 | |
| Source: | Code function: | 0_2_022BAFBF | |
| Source: | Code function: | 0_2_022BE9B1 | |
| Source: | Code function: | 0_2_0042E631 | |
| Source: | Code function: | 0_2_023600B7 | |
| Source: | Code function: | 0_2_02363EB2 | |
| Source: | Code function: | 0_2_0235EEC8 | |
| Source: | Code function: | 0_2_0235E89E | |
| Source: | Code function: | 0_2_02362CF6 | |
| Source: | Code function: | 0_2_0235F196 | |
| Source: | Code function: | 0_2_02365B89 | |
| Source: | Code function: | 0_2_00401264 | |
| Source: | Static PE information: | ||
Hooking and other Techniques for Hiding and Protection: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00401264 | |
| Source: | Code function: | 0_2_0235C2F6 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_022B7A2E | |
| Source: | Code function: | 0_2_00401E22 | |
| Source: | Code function: | 0_2_00401752 | |
| Source: | Code function: | 0_2_022B7A2E | |
Stealing of Sensitive Information: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality: | |
|---|
| Yara detected Ursnif | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation2 | Path Interception | Process Injection1 | Process Injection1 | Input Capture1 | System Time Discovery1 | Remote Services | Input Capture1 | Exfiltration Over Other Network Medium | Encrypted Channel11 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Native API1 | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Obfuscated Files or Information2 | LSASS Memory | Security Software Discovery1 | Remote Desktop Protocol | Archive Collected Data1 | Exfiltration Over Bluetooth | Ingress Tool Transfer4 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Software Packing22 | Security Account Manager | Process Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Non-Application Layer Protocol3 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Binary Padding | NTDS | Account Discovery1 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Application Layer Protocol14 | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | System Owner/User Discovery1 | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | Steganography | Cached Domain Credentials | Remote System Discovery1 | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Compile After Delivery | DCSync | System Information Discovery13 | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 23% | Metadefender | Browse | ||
| 45% | ReversingLabs | Win32.Trojan.Chapak | ||
| 100% | Joe Sandbox ML |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| Source | Detection | Scanner | Label | Link | Download |
|---|---|---|---|---|---|
| 100% | Avira | TR/Patched.Ren.Gen | Download File | ||
| 100% | Avira | TR/Crypt.XPACK.Gen7 | Download File | ||
| 100% | Avira | TR/Patched.Ren.Gen | Download File | ||
| 100% | Avira | HEUR/AGEN.1108168 | Download File |
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| new-fp-shed.wg1.b.yahoo.com | 87.248.100.216 | true | false | high | |
| yahoo.com | 74.6.231.21 | true | false | high | |
| www.yahoo.com | unknown | unknown | false | high | |
| qoderunovos.website | unknown | unknown | true |
| unknown |
| soderunovos.website | unknown | unknown | true |
| unknown |
Contacted URLs |
|---|
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| true |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| true |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 74.6.231.21 | yahoo.com | United States | 36646 | YAHOO-NE1US | false | |
| 87.248.100.216 | new-fp-shed.wg1.b.yahoo.com | United Kingdom | 34010 | YAHOO-IRDGB | false |
General Information |
|---|
| Joe Sandbox Version: | 34.0.0 Boulder Opal |
| Analysis ID: | 528072 |
| Start date: | 24.11.2021 |
| Start time: | 18:22:58 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 6m 21s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | R0xLHA2mT5.exe |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@1/0@4/2 |
| EGA Information: | Failed |
| HDC Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 74.6.231.21 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| 87.248.100.216 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| new-fp-shed.wg1.b.yahoo.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| YAHOO-NE1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| No created / dropped files found |
|---|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 5.862869752671554 |
| TrID: |
|
| File name: | R0xLHA2mT5.exe |
| File size: | 298496 |
| MD5: | 9f3b8462c508884f6966f3ad4a275799 |
| SHA1: | 6288e611de585a6dc56c6399ef03012698d60392 |
| SHA256: | a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543 |
| SHA512: | d9d529ed258ffaf33f729cb822fc602748772df8f8710a4a77e9d4fbea02658fd0c9a0e4d1f920c99230551705c0e643e4eac5bcca0b008f5cb48679e56c1a37 |
| SSDEEP: | 6144:0fcUtwkDhJYbsB/qMZSXuZet0yyen73jF20+Mpbz/CyU:0U2n1B/3ZSXuZet0yye7w0+MpC |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.r"t..qt..qt..q...q]..q...qe..q...q...q}..q...qt..qq..q...qu..q...qu..q...qu..qRicht..q........PE..L.....``................... |
File Icon |
|---|
 | |
| Icon Hash: | a2e8e8e8aaa2a488 |
Static PE Info |
|---|
General | |
|---|---|
| Entrypoint: | 0x417cf0 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | 32BIT_MACHINE, EXECUTABLE_IMAGE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE, NX_COMPAT |
| Time Stamp: | 0x6060D3B3 [Sun Mar 28 19:06:27 2021 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 62f526399c5bc6ba1d2354b3cc3131f3 |
Entrypoint Preview |
|---|
| Instruction |
|---|
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| call 00007FA350B87BBBh |
| call 00007FA350B878C6h |
| pop ebp |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| push FFFFFFFEh |
| push 0042FAD0h |
| push 0041BF10h |
| mov eax, dword ptr fs:[00000000h] |
| push eax |
| add esp, FFFFFF98h |
| push ebx |
| push esi |
| push edi |
| mov eax, dword ptr [00432064h] |
| xor dword ptr [ebp-08h], eax |
| xor eax, ebp |
| push eax |
| lea eax, dword ptr [ebp-10h] |
| mov dword ptr fs:[00000000h], eax |
| mov dword ptr [ebp-18h], esp |
| mov dword ptr [ebp-70h], 00000000h |
| lea eax, dword ptr [ebp-60h] |
| push eax |
| call dword ptr [00401368h] |
| cmp dword ptr [01FB5ABCh], 00000000h |
| jne 00007FA350B878C0h |
| push 00000000h |
| push 00000000h |
| push 00000001h |
| push 00000000h |
| call dword ptr [00401364h] |
| call 00007FA350B87A43h |
| mov dword ptr [ebp-6Ch], eax |
| call 00007FA350B8BA0Bh |
| test eax, eax |
| jne 00007FA350B878BCh |
| push 0000001Ch |
| call 00007FA350B87A00h |
| add esp, 04h |
| call 00007FA350B8B368h |
| test eax, eax |
| jne 00007FA350B878BCh |
| push 00000010h |
| call 00007FA350B879EDh |
| add esp, 04h |
| push 00000001h |
| call 00007FA350B8B2B3h |
| add esp, 04h |
| call 00007FA350B88F6Bh |
| mov dword ptr [ebp-04h], 00000000h |
| call 00007FA350B88B4Fh |
| test eax, eax |
Rich Headers |
|---|
| Programming Language: |
|
Data Directories |
|---|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x300b4 | 0x78 | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1bb7000 | 0x5470 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1bbd000 | 0x17fc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x1450 | 0x1c | .text |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x17b28 | 0x40 | .text |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x1000 | 0x408 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Sections |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x30970 | 0x30a00 | False | 0.607316436375 | data | 7.03993935197 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .data | 0x32000 | 0x1b84ac0 | 0x1400 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x1bb7000 | 0x5470 | 0x5600 | False | 0.609783793605 | data | 5.95998340963 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x1bbd000 | 0x115e0 | 0x11600 | False | 0.0756379271583 | data | 0.97914473251 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Resources |
|---|
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| YONAMIKORUFENI | 0x1bba700 | 0xee8 | ASCII text, with very long lines, with no line terminators | Spanish | Paraguay |
| RT_CURSOR | 0x1bbb5e8 | 0x8a8 | dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" | Divehi; Dhivehi; Maldivian | Maldives |
| RT_ICON | 0x1bb7330 | 0x8a8 | data | Spanish | Paraguay |
| RT_ICON | 0x1bb7bd8 | 0x6c8 | data | Spanish | Paraguay |
| RT_ICON | 0x1bb82a0 | 0x568 | GLS_BINARY_LSB_FIRST | Spanish | Paraguay |
| RT_ICON | 0x1bb8808 | 0x10a8 | data | Spanish | Paraguay |
| RT_ICON | 0x1bb98b0 | 0x988 | data | Spanish | Paraguay |
| RT_ICON | 0x1bba238 | 0x468 | GLS_BINARY_LSB_FIRST | Spanish | Paraguay |
| RT_STRING | 0x1bbbea8 | 0xfc | data | Divehi; Dhivehi; Maldivian | Maldives |
| RT_STRING | 0x1bbbfa8 | 0x26c | data | Divehi; Dhivehi; Maldivian | Maldives |
| RT_STRING | 0x1bbc218 | 0x254 | data | Divehi; Dhivehi; Maldivian | Maldives |
| RT_GROUP_CURSOR | 0x1bbbe90 | 0x14 | data | Divehi; Dhivehi; Maldivian | Maldives |
| RT_GROUP_ICON | 0x1bba6a0 | 0x5a | data | Spanish | Paraguay |
Imports |
|---|
| DLL | Import |
|---|---|
| KERNEL32.dll | GetNumaNodeProcessorMask, SetCriticalSectionSpinCount, SearchPathW, SetInformationJobObject, lstrcmpA, FindFirstFileW, SetThreadContext, EnumCalendarInfoA, WriteConsoleInputW, IsBadStringPtrW, lstrlenA, EnumDateFormatsExW, CopyFileExW, GetNumaProcessorNode, TlsGetValue, SetLocalTime, UnmapViewOfFile, MoveFileExA, CommConfigDialogA, GetNumberOfConsoleInputEvents, GetConsoleAliasExesLengthA, SetErrorMode, FindResourceW, BuildCommDCBAndTimeoutsA, FreeLibrary, DeleteVolumeMountPointA, SetUnhandledExceptionFilter, LoadLibraryExW, SetDllDirectoryW, InterlockedIncrement, GetQueuedCompletionStatus, VerSetConditionMask, MoveFileExW, ReadConsoleA, InterlockedDecrement, WaitNamedPipeA, SetMailslotInfo, SetConsoleActiveScreenBuffer, WritePrivateProfileSectionA, SetDefaultCommConfigW, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, CreateJobObjectW, SignalObjectAndWait, AddConsoleAliasW, GetComputerNameW, SetEvent, SetThreadExecutionState, OpenSemaphoreA, CreateHardLinkA, GetFileAttributesExA, _lclose, GetModuleHandleW, GetTickCount, GetCommConfig, GetProcessHeap, IsBadReadPtr, GetConsoleAliasesLengthA, GetSystemTimeAsFileTime, GetPrivateProfileStringW, GetConsoleTitleA, CreateRemoteThread, GetCompressedFileSizeW, EnumTimeFormatsA, GetSystemWow64DirectoryA, SetCommTimeouts, CreateActCtxW, InitializeCriticalSection, GetProcessTimes, TlsSetValue, AllocateUserPhysicalPages, OpenProcess, FindResourceExA, GlobalAlloc, GetPrivateProfileIntA, LoadLibraryW, GetConsoleMode, FatalAppExitW, GetThreadSelectorEntry, AssignProcessToJobObject, GetCalendarInfoA, ReadFileScatter, SetSystemTimeAdjustment, SetVolumeMountPointA, ReadConsoleOutputW, SetConsoleCP, InterlockedPopEntrySList, LeaveCriticalSection, GetFileAttributesA, GlobalFlags, lstrcpynW, GetNamedPipeInfo, HeapValidate, GetVolumePathNamesForVolumeNameW, CreateSemaphoreA, SetConsoleCursorPosition, VerifyVersionInfoA, HeapQueryInformation, WritePrivateProfileSectionW, TerminateProcess, GetAtomNameW, FileTimeToSystemTime, UnregisterWait, GetModuleFileNameW, lstrcatA, GetBinaryTypeW, CompareStringW, ExitThread, GetVolumePathNameA, lstrlenW, SetConsoleTitleA, WritePrivateProfileStringW, GlobalUnlock, VirtualUnlock, GetTempPathW, GetStringTypeExA, GetNamedPipeHandleStateW, GetLargestConsoleWindowSize, GetPrivateProfileIntW, InterlockedExchange, ReleaseActCtx, SetCurrentDirectoryA, GetStdHandle, FindFirstFileA, GetLastError, ChangeTimerQueueTimer, BackupRead, BindIoCompletionCallback, GetProcAddress, FindVolumeMountPointClose, GetLongPathNameA, VirtualAlloc, HeapSize, SetFirmwareEnvironmentVariableW, CreateNamedPipeA, CreateJobSet, LocalLock, LockFileEx, VerLanguageNameW, BuildCommDCBW, DefineDosDeviceA, FindClose, GetPrivateProfileStringA, LoadLibraryA, Process32FirstW, OpenMutexA, ProcessIdToSessionId, MoveFileA, GetExitCodeThread, GetNumberFormatW, SetFileApisToANSI, QueryDosDeviceW, SetConsoleWindowInfo, SetThreadIdealProcessor, HeapWalk, GetPrivateProfileStructA, GetTapeParameters, GetVolumePathNamesForVolumeNameA, GetModuleFileNameA, GetDefaultCommConfigA, FindNextFileA, WriteProfileStringA, WTSGetActiveConsoleSessionId, EnumDateFormatsA, WaitCommEvent, _lread, FindFirstChangeNotificationA, GetProcessShutdownParameters, QueueUserWorkItem, ContinueDebugEvent, IsDebuggerPresent, GetProcessAffinityMask, FatalExit, FreeEnvironmentStringsW, EnumResourceNamesA, WriteProfileStringW, EnumDateFormatsW, FatalAppExitA, PeekConsoleInputA, DeleteCriticalSection, WriteConsoleOutputAttribute, OutputDebugStringA, GetCPInfoExA, DuplicateHandle, FindFirstVolumeA, GetVersionExA, ReadConsoleInputW, TlsAlloc, TerminateJobObject, CloseHandle, GetVersion, DeleteTimerQueueTimer, GlobalAddAtomW, SetFileValidData, FindActCtxSectionStringW, ResetWriteWatch, UnregisterWaitEx, ReadConsoleOutputCharacterW, TlsFree, GetProfileSectionW, EnumSystemLocalesW, lstrcpyW, CopyFileExA, CreateFileW, SetStdHandle, GetPrivateProfileSectionNamesW, EnumResourceNamesW, GetThreadContext, IsDBCSLeadByte, GetFullPathNameA, RaiseException, GetCommandLineW, HeapSetInformation, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, DecodePointer, ExitProcess, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, EncodePointer, SetLastError, HeapCreate, WriteFile, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, EnterCriticalSection, GetCurrentProcess, UnhandledExceptionFilter, HeapAlloc, HeapReAlloc, HeapFree, RtlUnwind, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetStringTypeW, WriteConsoleW, OutputDebugStringW, IsProcessorFeaturePresent, SetFilePointer, GetConsoleCP, FlushFileBuffers |
| USER32.dll | GetMessageTime |
| GDI32.dll | GetBitmapBits |
| ADVAPI32.dll | InitiateSystemShutdownA, GetFileSecurityW |
| MSIMG32.dll | AlphaBlend |
Possible Origin |
|---|
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Spanish | Paraguay |  |
| Divehi; Dhivehi; Maldivian | Maldives |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 24, 2021 18:24:25.064677000 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.064727068 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.064826965 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.084196091 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.084261894 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.350553036 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.350639105 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.605936050 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.605972052 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.606558084 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.606643915 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.609898090 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.652873993 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.739583015 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.739701033 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.739703894 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.739758968 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.788775921 CET | 49720 | 443 | 192.168.2.3 | 74.6.231.21 |
| Nov 24, 2021 18:24:25.788804054 CET | 443 | 49720 | 74.6.231.21 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.822021008 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.822061062 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.822155952 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.822999954 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.823020935 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.910984993 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.911099911 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.929397106 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.929425001 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.929687977 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.929764032 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.930593014 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:25.972871065 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:26.150295019 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:26.150407076 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:26.150423050 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:26.150445938 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
| Nov 24, 2021 18:24:26.150509119 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:26.150522947 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:26.152529001 CET | 49721 | 443 | 192.168.2.3 | 87.248.100.216 |
| Nov 24, 2021 18:24:26.152566910 CET | 443 | 49721 | 87.248.100.216 | 192.168.2.3 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 24, 2021 18:24:25.005891085 CET | 59026 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2021 18:24:25.025409937 CET | 53 | 59026 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2021 18:24:25.798044920 CET | 49572 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2021 18:24:25.818571091 CET | 53 | 49572 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2021 18:24:46.316181898 CET | 53615 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2021 18:24:46.338320017 CET | 53 | 53615 | 8.8.8.8 | 192.168.2.3 |
| Nov 24, 2021 18:26:06.369411945 CET | 60352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 24, 2021 18:26:06.391844034 CET | 53 | 60352 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 24, 2021 18:24:25.005891085 CET | 192.168.2.3 | 8.8.8.8 | 0x4a4 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2021 18:24:25.798044920 CET | 192.168.2.3 | 8.8.8.8 | 0xe878 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2021 18:24:46.316181898 CET | 192.168.2.3 | 8.8.8.8 | 0x802d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Nov 24, 2021 18:26:06.369411945 CET | 192.168.2.3 | 8.8.8.8 | 0xd72f | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 74.6.231.21 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 74.6.143.26 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 74.6.143.25 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 74.6.231.20 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 98.137.11.164 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.025409937 CET | 8.8.8.8 | 192.168.2.3 | 0x4a4 | No error (0) | 98.137.11.163 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.818571091 CET | 8.8.8.8 | 192.168.2.3 | 0xe878 | No error (0) | new-fp-shed.wg1.b.yahoo.com | CNAME (Canonical name) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.818571091 CET | 8.8.8.8 | 192.168.2.3 | 0xe878 | No error (0) | 87.248.100.216 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:25.818571091 CET | 8.8.8.8 | 192.168.2.3 | 0xe878 | No error (0) | 87.248.100.215 | A (IP address) | IN (0x0001) | ||
| Nov 24, 2021 18:24:46.338320017 CET | 8.8.8.8 | 192.168.2.3 | 0x802d | Name error (3) | none | none | A (IP address) | IN (0x0001) | |
| Nov 24, 2021 18:26:06.391844034 CET | 8.8.8.8 | 192.168.2.3 | 0xd72f | Name error (3) | none | none | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
|---|
|
HTTPS Proxied Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.2.3 | 49720 | 74.6.231.21 | 443 | C:\Users\user\Desktop\R0xLHA2mT5.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-24 17:24:25 UTC | 0 | OUT | |
| 2021-11-24 17:24:25 UTC | 0 | IN | |
| 2021-11-24 17:24:25 UTC | 1 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.2.3 | 49721 | 87.248.100.216 | 443 | C:\Users\user\Desktop\R0xLHA2mT5.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| 2021-11-24 17:24:25 UTC | 1 | OUT | |
| 2021-11-24 17:24:26 UTC | 1 | IN | |
| 2021-11-24 17:24:26 UTC | 2 | IN | |
| 2021-11-24 17:24:26 UTC | 3 | IN |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 18:23:55 |
| Start date: | 24/11/2021 |
| Path: | C:\Users\user\Desktop\R0xLHA2mT5.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 298496 bytes |
| MD5 hash: | 9F3B8462C508884F6966F3AD4A275799 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
Disassembly |
|---|
Code Analysis |
|---|
Executed Functions |
|---|
Function 004019A0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 140threadsleepnativeCOMMON
Download Yara Rule
| C-Code - Quality: 88% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B7A2E, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 103memoryCOMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 69% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 38% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 70% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401C90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
Download Yara Rule
| C-Code - Quality: 72% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401703, Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B9BF1, Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 201memorystringCOMMON
Download Yara Rule
| C-Code - Quality: 66% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B7C3D, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150timememoryCOMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022BA85C, Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
Download Yara Rule
| C-Code - Quality: 92% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022BAC95, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
Download Yara Rule
| C-Code - Quality: 51% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 74% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 93% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022BA2C6, Relevance: 10.6, APIs: 7, Instructions: 75COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004002F3, Relevance: 10.1, APIs: 6, Instructions: 1084libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 74% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B1128, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29sleepmemoryCOMMON
Download Yara Rule
| C-Code - Quality: 50% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00419617, Relevance: 7.8, APIs: 5, Instructions: 256COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 57% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B2D74, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
Download Yara Rule
| C-Code - Quality: 22% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401D38, Relevance: 7.5, APIs: 5, Instructions: 19memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B5319, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B2C58, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76memoryCOMMON
Download Yara Rule
| C-Code - Quality: 57% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401BAE, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68memoryCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004014AD, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96memoryCOMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B5B05, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50memorytimeCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B4A2A, Relevance: 4.6, APIs: 3, Instructions: 58COMMON
Download Yara Rule
| C-Code - Quality: 47% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B8B22, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B76E7, Relevance: 3.1, APIs: 2, Instructions: 112COMMON
Download Yara Rule
| C-Code - Quality: 75% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B5D79, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 43memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B831C, Relevance: 3.0, APIs: 2, Instructions: 40COMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B7EFD, Relevance: 3.0, APIs: 2, Instructions: 26COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B1037, Relevance: 1.5, APIs: 1, Instructions: 49COMMON
Download Yara Rule
| C-Code - Quality: 34% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0235CA19, Relevance: 1.5, APIs: 1, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041999C, Relevance: 1.5, APIs: 1, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042E430, Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040136F, Relevance: 1.5, APIs: 1, Instructions: 8COMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041B7D0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401D7E, Relevance: 1.3, APIs: 1, Instructions: 70COMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0235C6D8, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042E410, Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
Function 022B7FBE, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 258memoryCOMMONCrypto
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 68% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401752, Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 49% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022BAFC0, Relevance: .1, Instructions: 77COMMONCrypto
Download Yara Rule
| C-Code - Quality: 71% |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0235C2F6, Relevance: .1, Instructions: 61COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B5450, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 244memorystringCOMMON
Download Yara Rule
| C-Code - Quality: 74% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00426C73, Relevance: 25.8, APIs: 17, Instructions: 319COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042BF2A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B3485, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109librarymemoryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 73% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042BD54, Relevance: 13.7, APIs: 9, Instructions: 222COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 27% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041A205, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00425DD0, Relevance: 12.2, APIs: 8, Instructions: 160COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B57DD, Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B7B8D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
Download Yara Rule
| C-Code - Quality: 63% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B4B2A, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
Download Yara Rule
| C-Code - Quality: 88% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B9FF6, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28sleepmemoryCOMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B9267, Relevance: 7.6, APIs: 5, Instructions: 83COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B9EBB, Relevance: 7.5, APIs: 5, Instructions: 37COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 46% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B29ED, Relevance: 6.1, APIs: 4, Instructions: 136COMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004183E7, Relevance: 6.1, APIs: 4, Instructions: 100COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B9870, Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
Download Yara Rule
| C-Code - Quality: 40% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 78% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 68% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B8C01, Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B4DB1, Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B8CFA, Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
Download Yara Rule
| C-Code - Quality: 58% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022B272D, Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 022BA677, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |