Windows Analysis Report pago12_14299038859.exe

Overview

General Information

Sample Name: pago12_14299038859.exe
Analysis ID: 539535
MD5: 9a1518ed709f916360e56b5ac7d76995
SHA1: 7c85312d66edf5b02ebd6c25cfe9c036a3471263
SHA256: 2a0878c196278384aab473c92977d236680c788b4e5ae0cc1f415a075a6fa9e2
Tags: exe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.1196997646.0000000004D20000.00000040.00000001.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/"}
Multi AV Scanner detection for submitted file
Source: pago12_14299038859.exe ReversingLabs: Detection: 15%
Machine Learning detection for sample
Source: pago12_14299038859.exe Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: pago12_14299038859.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/

System Summary:

barindex
Uses 32bit PE files
Source: pago12_14299038859.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Sample file is different than original file name gathered from version info
Source: pago12_14299038859.exe, 00000000.00000002.1196818293.0000000002930000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameFort.exeFE2X vs pago12_14299038859.exe
Source: pago12_14299038859.exe, 00000000.00000000.669780195.000000000042B000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameFort.exe vs pago12_14299038859.exe
Source: pago12_14299038859.exe Binary or memory string: OriginalFilenameFort.exe vs pago12_14299038859.exe
PE file contains strange resources
Source: pago12_14299038859.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Detected potential crypto function
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2841D 0_2_04D2841D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2D38F 0_2_04D2D38F
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D204CA 0_2_04D204CA
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28498 0_2_04D28498
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2749D 0_2_04D2749D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C4BD 0_2_04D2C4BD
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C45D 0_2_04D2C45D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28441 0_2_04D28441
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D205C3 0_2_04D205C3
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D265C9 0_2_04D265C9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26589 0_2_04D26589
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D20549 0_2_04D20549
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2057D 0_2_04D2057D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D20517 0_2_04D20517
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C509 0_2_04D2C509
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D236F8 0_2_04D236F8
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C66C 0_2_04D2C66C
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2663D 0_2_04D2663D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26759 0_2_04D26759
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C70E 0_2_04D2C70E
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D260CA 0_2_04D260CA
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D260F6 0_2_04D260F6
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D29085 0_2_04D29085
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C052 0_2_04D2C052
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2706B 0_2_04D2706B
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26005 0_2_04D26005
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28180 0_2_04D28180
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C2E9 0_2_04D2C2E9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28255 0_2_04D28255
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C259 0_2_04D2C259
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26214 0_2_04D26214
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C226 0_2_04D2C226
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C3D1 0_2_04D2C3D1
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D263ED 0_2_04D263ED
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2838C 0_2_04D2838C
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C37D 0_2_04D2C37D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2632E 0_2_04D2632E
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26C93 0_2_04D26C93
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27C39 0_2_04D27C39
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26DC9 0_2_04D26DC9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26EE9 0_2_04D26EE9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D25F92 0_2_04D25F92
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26F8D 0_2_04D26F8D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D268D1 0_2_04D268D1
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D269B1 0_2_04D269B1
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D259A7 0_2_04D259A7
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D289A8 0_2_04D289A8
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26951 0_2_04D26951
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2595B 0_2_04D2595B
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28A90 0_2_04D28A90
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26A75 0_2_04D26A75
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28A15 0_2_04D28A15
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28BD1 0_2_04D28BD1
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D25BF0 0_2_04D25BF0
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D25BB1 0_2_04D25BB1
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28B59 0_2_04D28B59
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D26B4E 0_2_04D26B4E
Contains functionality to call native functions
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2841D NtAllocateVirtualMemory, 0_2_04D2841D
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D284D9 NtAllocateVirtualMemory, 0_2_04D284D9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28498 NtAllocateVirtualMemory, 0_2_04D28498
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28441 NtAllocateVirtualMemory, 0_2_04D28441
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28551 NtAllocateVirtualMemory, 0_2_04D28551
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28663 NtAllocateVirtualMemory, 0_2_04D28663
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28621 NtAllocateVirtualMemory, 0_2_04D28621
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D28255 NtAllocateVirtualMemory, 0_2_04D28255
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2838C NtAllocateVirtualMemory, 0_2_04D2838C
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\pago12_14299038859.exe Process Stats: CPU usage > 98%
Source: pago12_14299038859.exe ReversingLabs: Detection: 15%
Source: pago12_14299038859.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\pago12_14299038859.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe File created: C:\Users\user\AppData\Local\Temp\~DF56158A8C389C0AF7.TMP Jump to behavior
Source: classification engine Classification label: mal76.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.1196997646.0000000004D20000.00000040.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_00406471 push edi; iretd 0_2_00406472
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_00409011 push esp; retf 0_2_00409013
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_0040682F push esi; retf 0_2_00406830
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_0040A490 push ds; iretd 0_2_0040A491
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_004079F6 push eax; retf 0_2_00407A10
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_004055BF push ds; ret 0_2_004055D9
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_00405ECC push ebp; ret 0_2_00405ED8
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_00407F27 push edi; ret 0_2_00407F28
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_00407FBA push eax; iretd 0_2_00407FBB
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2747D pushfd ; iretd 0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27404 pushfd ; iretd 0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D200CA push 5D54C3DCh; ret 0_2_04D20116
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D29157 push E8BBB633h; retf 001Bh 0_2_04D2915F
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D24344 push 8122E3ECh; ret 0_2_04D24349
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27371 pushfd ; iretd 0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27368 pushfd ; iretd 0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D21F01 push esi; ret 0_2_04D21F02
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D29B93 pushfd ; iretd 0_2_04D29C58
Source: initial sample Static PE information: section name: .text entropy: 7.15645216813
Source: C:\Users\user\Desktop\pago12_14299038859.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\pago12_14299038859.exe RDTSC instruction interceptor: First address: 0000000004D27C16 second address: 0000000004D27C16 instructions: 0x00000000 rdtsc 0x00000002 mov eax, B4901491h 0x00000007 sub eax, 05E3F0C7h 0x0000000c xor eax, 8F9A272Fh 0x00000011 sub eax, 213604E4h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F6BBC38AE6Dh 0x0000001e lfence 0x00000021 mov edx, 238EE826h 0x00000026 sub edx, 0388C43Eh 0x0000002c xor edx, E448541Bh 0x00000032 xor edx, BBB077E7h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+00000229h], AD8B339Ah 0x0000004f xor dword ptr [ebp+00000229h], 22419229h 0x00000059 xor dword ptr [ebp+00000229h], 3996C157h 0x00000063 sub dword ptr [ebp+00000229h], B65C60E4h 0x0000006d cmp ecx, dword ptr [ebp+00000229h] 0x00000073 jne 00007F6BBC38AD87h 0x00000075 cmp cx, ax 0x00000078 mov dword ptr [ebp+0000020Bh], ebx 0x0000007e mov ebx, ecx 0x00000080 push ebx 0x00000081 mov ebx, dword ptr [ebp+0000020Bh] 0x00000087 jmp 00007F6BBC38AE2Eh 0x00000089 cmp dl, bl 0x0000008b call 00007F6BBC38AE71h 0x00000090 call 00007F6BBC38AE8Eh 0x00000095 lfence 0x00000098 mov edx, 238EE826h 0x0000009d sub edx, 0388C43Eh 0x000000a3 xor edx, E448541Bh 0x000000a9 xor edx, BBB077E7h 0x000000af mov edx, dword ptr [edx] 0x000000b1 lfence 0x000000b4 ret 0x000000b5 mov esi, edx 0x000000b7 pushad 0x000000b8 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27C0E rdtsc 0_2_04D27C0E

Anti Debugging:

barindex
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2B2F5 mov eax, dword ptr fs:[00000030h] 0_2_04D2B2F5
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C259 mov eax, dword ptr fs:[00000030h] 0_2_04D2C259
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2C226 mov eax, dword ptr fs:[00000030h] 0_2_04D2C226
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2ACF0 mov eax, dword ptr fs:[00000030h] 0_2_04D2ACF0
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27A41 mov eax, dword ptr fs:[00000030h] 0_2_04D27A41
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D27C0E rdtsc 0_2_04D27C0E
Source: C:\Users\user\Desktop\pago12_14299038859.exe Code function: 0_2_04D2D38F RtlAddVectoredExceptionHandler, 0_2_04D2D38F
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp Binary or memory string: Progman
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp Binary or memory string: Progmanlock