Loading ...

Play interactive tourEdit tour

Windows Analysis Report Pago Transferencia.pdf.exe

Overview

General Information

Sample Name:Pago Transferencia.pdf.exe
Analysis ID:528709
MD5:02bf0fc6d6fdc5aa692f136da966b62c
SHA1:7ab36a1ea547408e9254428887b3a41a83e2c849
SHA256:49121cf42d9ee0f820e76416c3bd0ea7f69036fde442ca8ad2a69737c50ac97e
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Uses an obfuscated file name to hide its real file extension (double extension)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Pago Transferencia.pdf.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\Pago Transferencia.pdf.exe" MD5: 02BF0FC6D6FDC5AA692F136DA966B62C)
    • Pago Transferencia.pdf.exe (PID: 4876 cmdline: C:\Users\user\Desktop\Pago Transferencia.pdf.exe MD5: 02BF0FC6D6FDC5AA692F136DA966B62C)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "ugo@bhgautopartes.com", "Password": "icui4cu2@@", "Host": "mail.bhgautopartes.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000000.248078811.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000000.248078811.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000003.00000000.248613721.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000003.00000000.248613721.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 15 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.0.Pago Transferencia.pdf.exe.400000.8.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              3.0.Pago Transferencia.pdf.exe.400000.8.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                1.2.Pago Transferencia.pdf.exe.2c68fb4.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
                  3.0.Pago Transferencia.pdf.exe.400000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    3.0.Pago Transferencia.pdf.exe.400000.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                      Click to see the 17 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Suspicious Double ExtensionShow sources
                      Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, CommandLine: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, NewProcessName: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, ParentCommandLine: "C:\Users\user\Desktop\Pago Transferencia.pdf.exe" , ParentImage: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, ParentProcessId: 3228, ProcessCommandLine: C:\Users\user\Desktop\Pago Transferencia.pdf.exe, ProcessId: 4876

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "ugo@bhgautopartes.com", "Password": "icui4cu2@@", "Host": "mail.bhgautopartes.com"}
                      Source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: Pago Transferencia.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Pago Transferencia.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmp, Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmpString found in binary or memory: http://uArhJl.com
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.251510094.0000000003C0D000.00000004.00000001.sdmp, Pago Transferencia.pdf.exe, 00000003.00000000.248078811.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Pago Transferencia.pdf.exe
                      .NET source code contains very large array initializationsShow sources
                      Source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.csLarge array initialization: .cctor: array initializer size 11787
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.csLarge array initialization: .cctor: array initializer size 11787
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.csLarge array initialization: .cctor: array initializer size 11787
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.csLarge array initialization: .cctor: array initializer size 11787
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.csLarge array initialization: .cctor: array initializer size 11787
                      Source: Pago Transferencia.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 1_2_007A6BFF1_2_007A6BFF
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 1_2_007A5C241_2_007A5C24
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00606BFF3_2_00606BFF
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00605C243_2_00605C24
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007918A83_2_007918A8
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007912D83_2_007912D8
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_0079A3403_2_0079A340
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007953103_2_00795310
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00792CF03_2_00792CF0
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007977503_2_00797750
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00793F383_2_00793F38
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007900403_2_00790040
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00F2077C3_2_00F2077C
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00F2D8683_2_00F2D868
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00F24B683_2_00F24B68
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00F254D83_2_00F254D8
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00F2EC303_2_00F2EC30
                      Source: Pago Transferencia.pdf.exeBinary or memory string: OriginalFilename vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.253625240.0000000006080000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.251510094.0000000003C0D000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.251510094.0000000003C0D000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.253100415.0000000005BF0000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exeBinary or memory string: OriginalFilename vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000003.00000000.248740658.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.506211522.0000000000AF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Pago Transferencia.pdf.exe
                      Source: Pago Transferencia.pdf.exeBinary or memory string: OriginalFilenameIteratorOfTToIteratorAdapt.exe. vs Pago Transferencia.pdf.exe
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeSection loaded: wldp.dllJump to behavior
                      Source: Pago Transferencia.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile read: C:\Users\user\Desktop\Pago Transferencia.pdf.exe:Zone.IdentifierJump to behavior
                      Source: Pago Transferencia.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Pago Transferencia.pdf.exe "C:\Users\user\Desktop\Pago Transferencia.pdf.exe"
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess created: C:\Users\user\Desktop\Pago Transferencia.pdf.exe C:\Users\user\Desktop\Pago Transferencia.pdf.exe
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess created: C:\Users\user\Desktop\Pago Transferencia.pdf.exe C:\Users\user\Desktop\Pago Transferencia.pdf.exeJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pago Transferencia.pdf.exe.logJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@0/0
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: /IteratorOfTToIteratorAdapt;component/views/addbook.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: views/addcustomer.baml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: views/addbook.baml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: /IteratorOfTToIteratorAdapt;component/views/addcustomer.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: /IteratorOfTToIteratorAdapt;component/views/addbook.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: views/addcustomer.baml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: views/addbook.baml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: /IteratorOfTToIteratorAdapt;component/views/addcustomer.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: q/IteratorOfTToIteratorAdapt;component/views/addbook.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: /IteratorOfTToIteratorAdapt;component/views/deletecustomer.xamlu/IteratorOfTToIteratorAdapt;component/views/errorview.xamly/IteratorOfTToIteratorAdapt;component/views/smallextras.xamly/IteratorOfTToIteratorAdapt;component/views/addcustomer.xaml
                      Source: Pago Transferencia.pdf.exeString found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
                      Source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Pago Transferencia.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Pago Transferencia.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: Pago Transferencia.pdf.exe, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.0.Pago Transferencia.pdf.exe.7a0000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.2.Pago Transferencia.pdf.exe.7a0000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.Pago Transferencia.pdf.exe.600000.2.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.Pago Transferencia.pdf.exe.600000.9.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.Pago Transferencia.pdf.exe.600000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.Pago Transferencia.pdf.exe.600000.11.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.Pago Transferencia.pdf.exe.600000.13.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 1_2_007A92F5 push ds; ret 1_2_007A9340
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 1_2_007A9361 push ds; retf 1_2_007A9364
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 1_2_007A9347 push ds; ret 1_2_007A934C
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00609361 push ds; retf 3_2_00609364
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_006092F5 push ds; ret 3_2_00609340
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_00609347 push ds; ret 3_2_0060934C
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.87898246248

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
                      Source: Possible double extension: pdf.exeStatic PE information: Pago Transferencia.pdf.exe
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.2c68fb4.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.2cfb800.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 3228, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmp, Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250733467.0000000002C01000.00000004.00000001.sdmp, Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -3689348814741908s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -240000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239874s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 900Thread sleep count: 1449 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 900Thread sleep count: 614 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 2176Thread sleep time: -31669s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239749s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239633s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239515s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239404s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239281s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239140s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -239000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238874s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238750s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238624s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238515s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238405s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -238047s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -237609s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -237203s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -236359s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -236203s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep time: -236091s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 468Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 3532Thread sleep time: -17524406870024063s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep count: 1620 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exe TID: 1560Thread sleep count: 8234 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 240000Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239874Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239749Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239633Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239515Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239404Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239281Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239140Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239000Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238874Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238750Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238624Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238515Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238405Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238047Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 237609Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 237203Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236359Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236203Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236091Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWindow / User API: threadDelayed 1449Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWindow / User API: threadDelayed 614Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWindow / User API: threadDelayed 1620Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWindow / User API: threadDelayed 8234Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 240000Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239874Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 31669Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239749Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239633Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239515Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239404Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239281Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239140Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 239000Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238874Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238750Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238624Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238515Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238405Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 238047Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 237609Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 237203Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236359Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236203Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 236091Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: Pago Transferencia.pdf.exe, 00000001.00000002.250904097.0000000002CCB000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeCode function: 3_2_007903C0 LdrInitializeThunk,3_2_007903C0
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeProcess created: C:\Users\user\Desktop\Pago Transferencia.pdf.exe C:\Users\user\Desktop\Pago Transferencia.pdf.exeJump to behavior
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.507717551.00000000013A0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.507717551.00000000013A0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.507717551.00000000013A0000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.507717551.00000000013A0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
                      Source: Pago Transferencia.pdf.exe, 00000003.00000002.507717551.00000000013A0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Users\user\Desktop\Pago Transferencia.pdf.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Users\user\Desktop\Pago Transferencia.pdf.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3d31df8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3cfc5d8.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3d31df8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3cfc5d8.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000000.248078811.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.248613721.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.247491327.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.505276535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.247106547.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.251510094.0000000003C0D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 3228, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 4876, type: MEMORYSTR
                      Tries to steal Mail credentials (via file / registry access)Show sources
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\Pago Transferencia.pdf.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: Yara matchFile source: 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 4876, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3d31df8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3cfc5d8.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Pago Transferencia.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.0.Pago Transferencia.pdf.exe.400000.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3d31df8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Pago Transferencia.pdf.exe.3cfc5d8.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000000.248078811.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.248613721.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.247491327.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.505276535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000000.247106547.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.251510094.0000000003C0D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.508136463.0000000002981000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 3228, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Pago Transferencia.pdf.exe PID: 4876, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211DLL Side-Loading1Process Injection12Masquerading11OS Credential Dumping1Security Software Discovery211Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsCommand and Scripting Interpreter2Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion131Security Account ManagerVirtualization/Sandbox Evasion131SMB/Windows Admin SharesData from Local System1Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsSystem Information Discovery114SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information12Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobDLL Side-Loading1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.