Windows Analysis Report Waybilldoc_220950655.pdf.exe

Overview

General Information

Sample Name: Waybilldoc_220950655.pdf.exe
Analysis ID: 532918
MD5: 717a4adeeaf2cc5ccccc944accb3b2fd
SHA1: 834b3549011ac52fa34c2299b8194087f6a695e8
SHA256: 52ffc0a75a42165e68bc35efc7b9bdd4069c7f5d4054c040737cfc87ae158da8
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Uses an obfuscated file name to hide its real file extension (double extension)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Binary contains a suspicious time stamp
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection:

barindex
Found malware configuration
Source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "ugo@bhgautopartes.com", "Password": "icui4cu2@@", "Host": "mail.bhgautopartes.com"}
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: Waybilldoc_220950655.pdf.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Waybilldoc_220950655.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp String found in binary or memory: http://uArhJl.com
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.286150173.0000000003879000.00000004.00000001.sdmp, Waybilldoc_220950655.pdf.exe, 00000003.00000000.282755212.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Waybilldoc_220950655.pdf.exe
Source: initial sample Static PE information: Filename: Waybilldoc_220950655.pdf.exe
.NET source code contains very large array initializations
Source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.cs Large array initialization: .cctor: array initializer size 11787
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.cs Large array initialization: .cctor: array initializer size 11787
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.cs Large array initialization: .cctor: array initializer size 11787
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.cs Large array initialization: .cctor: array initializer size 11787
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b576C0370u002dDCAFu002d423Eu002d8F1Fu002d624A7F18491Cu007d/u00364BA41D5u002dAF46u002d4AFCu002d9FA5u002dE8F45566EA94.cs Large array initialization: .cctor: array initializer size 11787
Uses 32bit PE files
Source: Waybilldoc_220950655.pdf.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Detected potential crypto function
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_00C8C6D4 1_2_00C8C6D4
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_00C8EB08 1_2_00C8EB08
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_00C8EB18 1_2_00C8EB18
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_04CEEF88 1_2_04CEEF88
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_04CEEF90 1_2_04CEEF90
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 3_2_014B1438 3_2_014B1438
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 3_2_015646A0 3_2_015646A0
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 3_2_015645B0 3_2_015645B0
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 3_2_0156DA00 3_2_0156DA00
Sample file is different than original file name gathered from version info
Source: Waybilldoc_220950655.pdf.exe Binary or memory string: OriginalFilename vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285254478.0000000002871000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285254478.0000000002871000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.284429418.0000000000402000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamePropertyIn.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.286150173.0000000003879000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.286150173.0000000003879000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.288796065.0000000005B50000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe Binary or memory string: OriginalFilename vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000000.283379090.0000000000CD2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamePropertyIn.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.544853027.0000000000438000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamegupTdBQVaomyfnIgAVHNNfxuAxDWRnFw.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.545500522.00000000010F8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe Binary or memory string: OriginalFilenamePropertyIn.exe4 vs Waybilldoc_220950655.pdf.exe
Source: Waybilldoc_220950655.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Waybilldoc_220950655.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe "C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe"
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process created: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process created: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Waybilldoc_220950655.pdf.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Waybilldoc_220950655.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Waybilldoc_220950655.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Waybilldoc_220950655.pdf.exe, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.Waybilldoc_220950655.pdf.exe.400000.0.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.9.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.7.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.5.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.3.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.1.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.2.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Waybilldoc_220950655.pdf.exe.cd0000.11.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.Waybilldoc_220950655.pdf.exe.cd0000.1.unpack, HX/Gr.cs .Net Code: zG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_00407279 push es; ret 1_2_00407376
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 1_2_00C8E638 push eax; iretd 1_2_00C8E641
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Code function: 3_2_00CD7279 push es; ret 3_2_00CD7376
Binary contains a suspicious time stamp
Source: Waybilldoc_220950655.pdf.exe Static PE information: 0x91B4DF98 [Wed Jun 19 09:40:40 2047 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.78942430376

Hooking and other Techniques for Hiding and Protection:

barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Waybilldoc_220950655.pdf.exe
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.2891bac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.285254478.0000000002871000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7004, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285254478.0000000002871000.00000004.00000001.sdmp, Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285254478.0000000002871000.00000004.00000001.sdmp, Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe TID: 7008 Thread sleep time: -37979s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe TID: 7044 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe TID: 2176 Thread sleep time: -24903104499507879s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe TID: 2504 Thread sleep count: 2091 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe TID: 2504 Thread sleep count: 7743 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Window / User API: threadDelayed 2091 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Window / User API: threadDelayed 7743 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Thread delayed: delay time: 37979 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.288796065.0000000005B50000.00000004.00020000.sdmp Binary or memory string: dcZtPLJoVMcibUETQAN
Source: Waybilldoc_220950655.pdf.exe, 00000001.00000002.285322085.00000000028AD000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Process created: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Jump to behavior
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547449889.0000000001AF0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547449889.0000000001AF0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547449889.0000000001AF0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: Waybilldoc_220950655.pdf.exe, 00000003.00000002.547449889.0000000001AF0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.38d3790.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.3908fb0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.3908fb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.38d3790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.282755212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.281746367.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.282312678.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.544593892.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.283323027.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.286150173.0000000003879000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7124, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Waybilldoc_220950655.pdf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7124, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.38d3790.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.3908fb0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Waybilldoc_220950655.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Waybilldoc_220950655.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.3908fb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Waybilldoc_220950655.pdf.exe.38d3790.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.282755212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.281746367.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.282312678.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.544593892.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.283323027.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.286150173.0000000003879000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.547694451.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Waybilldoc_220950655.pdf.exe PID: 7124, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532918 Sample: Waybilldoc_220950655.pdf.exe Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 12 Found malware configuration 2->12 14 Yara detected AgentTesla 2->14 16 Yara detected AntiVM3 2->16 18 6 other signatures 2->18 6 Waybilldoc_220950655.pdf.exe 3 2->6         started        process3 signatures4 20 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->20 22 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->22 9 Waybilldoc_220950655.pdf.exe 2 6->9         started        process5 signatures6 24 Tries to steal Mail credentials (via file / registry access) 9->24 26 Tries to harvest and steal browser information (history, passwords, etc) 9->26
No contacted IP infos