Windows Analysis Report PI.1872GAT02.pdf.exe

Overview

General Information

Sample Name:	PI.1872GAT02.pdf.exe
Analysis ID:	553435
MD5:	1396637598469e7e918c70be938370d5
SHA1:	c83510c66f043c3595960102ac030a3c99656768
SHA256:	d6f3d5fbdc9c7f68e29260badb6fd6e8f1b606798fd9fe544e0b28387f21eaf9
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Powershell Defender Exclusion

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: PI.1872GAT02.pdf.exe	Virustotal: Detection: 47%			Perma Link
Source: PI.1872GAT02.pdf.exe	ReversingLabs: Detection: 45%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\catch\catch.exe	ReversingLabs: Detection: 46%
Source: C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe	ReversingLabs: Detection: 46%

Machine Learning detection for sample

Source: PI.1872GAT02.pdf.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe	Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 9.0.PI.1872GAT02.pdf.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.catch.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.0.catch.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.PI.1872GAT02.pdf.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.PI.1872GAT02.pdf.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.PI.1872GAT02.pdf.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.0.catch.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.0.catch.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.catch.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.2.catch.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.catch.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.PI.1872GAT02.pdf.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.0.catch.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.catch.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.2.PI.1872GAT02.pdf.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 32.0.catch.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.catch.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.2.catch.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: PI.1872GAT02.pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: PI.1872GAT02.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: TextIn.pdb source: catch.exe, catch.exe, 00000018.00000000.473725790.0000000000272000.00000002.00020000.sdmp, catch.exe, 00000019.00000000.481075981.00000000003D2000.00000002.00020000.sdmp, catch.exe, 0000001C.00000000.485808707.0000000000332000.00000002.00020000.sdmp, catch.exe, 0000001F.00000000.490124493.0000000000942000.00000002.00020000.sdmp, catch.exe, 00000020.00000000.494419414.0000000000992000.00000002.00020000.sdmp, PI.1872GAT02.pdf.exe, catch.exe.9.dr, iDGyQtltoKmu.exe.0.dr

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49845 -> 208.91.199.224:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49846 -> 208.91.199.224:587

Source: PI.1872GAT02.pdf.exe, 00000009.00000002.610231002.0000000003071000.00000004.00000001.sdmp, catch.exe, 0000001F.00000002.512689898.0000000002E31000.00000004.00000001.sdmp, catch.exe, 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: catch.exe, 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.342428606.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.342376975.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.342448075.00000000055DA000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341824019.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341652269.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341738040.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341797011.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341764187.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341718830.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341797011.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341764187.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comH
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341824019.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341738040.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341797011.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341764187.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.341718830.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comY
Source: catch.exe, 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp	String found in binary or memory: http://oHtnSs.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383033038.0000000002761000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.383089116.00000000027AB000.00000004.00000001.sdmp, catch.exe, 00000010.00000002.507778914.0000000002791000.00000004.00000001.sdmp, catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.614063425.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.tranpotescamdonic.us
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.614063425.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.355059217.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.346720788.00000000055D3000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346994696.00000000055D3000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.347052526.00000000055D3000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346868051.00000000055D3000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346747432.00000000055D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345653672.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345712831.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345765130.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comd
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345166705.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comen
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346101172.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comexc
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.346182389.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346137811.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346252723.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346101172.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346267222.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345712831.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345765130.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comicr
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comint
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.346182389.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346137811.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346252723.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346101172.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346267222.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345712831.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345765130.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comk.
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.346299565.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346182389.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345621529.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345520263.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345653672.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346137811.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346252723.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346101172.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346267222.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345712831.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345485164.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345765130.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlo
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345485164.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comncy
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345621529.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345520263.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345653672.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345485164.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345166705.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comno
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comos
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345485164.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comtigY
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.349563544.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.349795020.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.349485061.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348682641.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.350740671.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350834095.00000000055EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.350538299.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350106929.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350231749.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350179211.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350438951.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350272250.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350205792.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350063993.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350314698.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350585382.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350462344.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350509924.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350082934.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350165532.00000000055EE000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350027194.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350418250.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350130711.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350397111.00000000055EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.350849136.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.350908927.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0.
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348918399.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.349323893.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.349002423.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers2
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.349323893.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.349485061.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersH
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.351023238.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersk
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.382630491.0000000000AC7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.382630491.0000000000AC7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comtX(
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344513930.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344330943.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344243109.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344699399.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344820593.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345117213.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344444976.00000000055CD000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345166705.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344944025.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344214607.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344651272.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345017322.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344593750.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344011241.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/.m
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344444976.00000000055CD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/r
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344330943.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnn
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344243109.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344214607.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnn-u?
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344513930.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344330943.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344699399.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344820593.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344444976.00000000055CD000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344944025.00000000055D4000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344651272.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344593750.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnsk.
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.355602281.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353253105.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355000874.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353979670.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354410089.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352539337.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353040919.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355456833.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355059217.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355104139.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354676559.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352631483.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355798640.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353354516.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353914805.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355661429.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355512777.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353605294.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355335081.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354077275.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354188877.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352723895.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355558253.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354761451.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354807622.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353476286.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353190242.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354585604.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352897777.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355405169.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353702244.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355713046.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354887021.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352778011.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.386058108.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354288508.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355836459.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353859656.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.354936948.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353542324.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355199978.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355256754.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.355152588.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.353790375.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.352539337.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352631483.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352723895.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352897777.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.352778011.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm=
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-e
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr.m
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.347717700.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.347673213.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343671517.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343603284.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.347806036.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.347629233.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343826733.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341031540.00000000055B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma)
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341031540.00000000055B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comk
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.341031540.00000000055B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comt#
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346720788.00000000055D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344046675.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344011241.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.c
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.344011241.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343826733.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.344011241.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr(
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.343931833.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.343826733.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krs-c
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com5
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346137811.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346101172.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comlic
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348396796.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348186597.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348260615.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.351070142.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.351131352.00000000055D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386241392.00000000068A2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348186597.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348260615.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deQ
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348186597.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348260615.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.351070142.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.351131352.00000000055D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.ded
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.348543246.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348396796.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348186597.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348260615.00000000055D0000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.348682641.00000000055D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deettr
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345166705.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345621529.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345860474.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345963065.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345520263.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345653672.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345712831.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345485164.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345117213.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345283896.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345815598.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345765130.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345218625.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345166705.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345441267.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345345476.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.345392285.00000000055CB000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000003.346027248.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnlt8
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345117213.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.t
Source: PI.1872GAT02.pdf.exe, 00000000.00000003.345117213.00000000055CB000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnr-c
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.614063425.00000000033D7000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000009.00000003.589182184.0000000001144000.00000004.00000001.sdmp	String found in binary or memory: https://JZAeubGsK9Sikz.org
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.610231002.0000000003071000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: catch.exe, 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383386260.0000000003769000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000009.00000000.377405263.0000000000402000.00000040.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000009.00000000.378343563.0000000000402000.00000040.00000001.sdmp, catch.exe, 00000010.00000002.510080482.0000000003799000.00000004.00000001.sdmp, catch.exe, 00000014.00000002.509847995.0000000003799000.00000004.00000001.sdmp, catch.exe, 0000001F.00000000.500639086.0000000000402000.00000040.00000001.sdmp, catch.exe, 0000001F.00000000.499174008.0000000000402000.00000040.00000001.sdmp, catch.exe, 00000020.00000000.499820218.0000000000402000.00000040.00000001.sdmp, catch.exe, 00000020.00000000.501701572.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.610231002.0000000003071000.00000004.00000001.sdmp, catch.exe, 0000001F.00000002.512689898.0000000002E31000.00000004.00000001.sdmp, catch.exe, 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: smtp.tranpotescamdonic.us

System Summary:

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PI.1872GAT02.pdf.exe

.NET source code contains very large array initializations

Source: 9.0.PI.1872GAT02.pdf.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b73F50571u002d8E40u002d411Fu002d8F2Bu002d0DBA915C720Cu007d/u00351990C9Fu002dADF8u002d4F9Cu002dBED8u002d3040FC7E7F13.cs	Large array initialization: .cctor: array initializer size 11932
Source: 9.0.PI.1872GAT02.pdf.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b73F50571u002d8E40u002d411Fu002d8F2Bu002d0DBA915C720Cu007d/u00351990C9Fu002dADF8u002d4F9Cu002dBED8u002d3040FC7E7F13.cs	Large array initialization: .cctor: array initializer size 11932
Source: 9.0.PI.1872GAT02.pdf.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b73F50571u002d8E40u002d411Fu002d8F2Bu002d0DBA915C720Cu007d/u00351990C9Fu002dADF8u002d4F9Cu002dBED8u002d3040FC7E7F13.cs	Large array initialization: .cctor: array initializer size 11932
Source: 9.0.PI.1872GAT02.pdf.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b73F50571u002d8E40u002d411Fu002d8F2Bu002d0DBA915C720Cu007d/u00351990C9Fu002dADF8u002d4F9Cu002dBED8u002d3040FC7E7F13.cs	Large array initialization: .cctor: array initializer size 11932
Source: 9.0.PI.1872GAT02.pdf.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b73F50571u002d8E40u002d411Fu002d8F2Bu002d0DBA915C720Cu007d/u00351990C9Fu002dADF8u002d4F9Cu002dBED8u002d3040FC7E7F13.cs	Large array initialization: .cctor: array initializer size 11932

Uses 32bit PE files

Source: PI.1872GAT02.pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Detected potential crypto function

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_00ABC9D4	0_2_00ABC9D4
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_00ABEE08	0_2_00ABEE08
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_00ABEE18	0_2_00ABEE18
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_07020006	0_2_07020006
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_07020040	0_2_07020040
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_07029DB3	0_2_07029DB3
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_07029DC0	0_2_07029DC0
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_07029DC0	0_2_07029DC0
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_01399108	9_2_01399108
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_01394500	9_2_01394500
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_0139488F	9_2_0139488F
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_0139B718	9_2_0139B718
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_01393308	9_2_01393308
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_01399860	9_2_01399860
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_0139F4A8	9_2_0139F4A8
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_02E546A0	9_2_02E546A0
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_02E54690	9_2_02E54690
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_02E54672	9_2_02E54672
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_00BFC9D4	16_2_00BFC9D4
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_00BFEE18	16_2_00BFEE18
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_00BFEE08	16_2_00BFEE08
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_0834001E	16_2_0834001E
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_0834C86C	16_2_0834C86C
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_08340040	16_2_08340040
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_0834513F	16_2_0834513F
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_08349336	16_2_08349336
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_08349338	16_2_08349338
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 16_2_08349338	16_2_08349338
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_00D9C9D4	20_2_00D9C9D4
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_00D9EE18	20_2_00D9EE18
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_00D9EE08	20_2_00D9EE08
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_0849CA78	20_2_0849CA78
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_08499338	20_2_08499338
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_08490040	20_2_08490040
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_08490016	20_2_08490016
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_08499327	20_2_08499327
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Code function: 20_2_08499338	20_2_08499338

Sample file is different than original file name gathered from version info

Source: PI.1872GAT02.pdf.exe	Binary or memory string: OriginalFilename vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000000.00000000.338145138.00000000002C2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTextIn.exe0 vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383386260.0000000003769000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevuduTLYHGZhoMUxQolVCGKD.exe4 vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383386260.0000000003769000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383033038.0000000002761000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamevuduTLYHGZhoMUxQolVCGKD.exe4 vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.386729402.0000000006EB0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe	Binary or memory string: OriginalFilename vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000009.00000000.377475434.0000000000B62000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTextIn.exe0 vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe, 00000009.00000000.378343563.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamevuduTLYHGZhoMUxQolVCGKD.exe4 vs PI.1872GAT02.pdf.exe
Source: PI.1872GAT02.pdf.exe	Binary or memory string: OriginalFilenameTextIn.exe0 vs PI.1872GAT02.pdf.exe

Source: PI.1872GAT02.pdf.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: iDGyQtltoKmu.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: catch.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: PI.1872GAT02.pdf.exe	Virustotal: Detection: 47%
Source: PI.1872GAT02.pdf.exe	ReversingLabs: Detection: 45%

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe

File read: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe

Source: unknown	Process created: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe "C:\Users\user\Desktop\PI.1872GAT02.pdf.exe"
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmpB28A.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe C:\Users\user\Desktop\PI.1872GAT02.pdf.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe "C:\Users\user\AppData\Roaming\catch\catch.exe"
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe "C:\Users\user\AppData\Roaming\catch\catch.exe"
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmp79D1.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmp86D2.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmpB28A.tmp	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process created: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmp79D1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGyQtltoKmu" /XML "C:\Users\user\AppData\Local\Temp\tmp86D2.tmp
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process created: C:\Users\user\AppData\Roaming\catch\catch.exe C:\Users\user\AppData\Roaming\catch\catch.exe

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2988:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1752:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01

Source: 9.0.PI.1872GAT02.pdf.exe.400000.8.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.PI.1872GAT02.pdf.exe.400000.8.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.PI.1872GAT02.pdf.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.PI.1872GAT02.pdf.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.PI.1872GAT02.pdf.exe.400000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.PI.1872GAT02.pdf.exe.400000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: PI.1872GAT02.pdf.exe, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: iDGyQtltoKmu.exe.0.dr, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PI.1872GAT02.pdf.exe.2c0000.0.unpack, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PI.1872GAT02.pdf.exe.2c0000.0.unpack, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: catch.exe.9.dr, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.13.unpack, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.3.unpack, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.7.unpack, lN/HS.cs	.Net Code: od System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: PI.1872GAT02.pdf.exe, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: iDGyQtltoKmu.exe.0.dr, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 0.0.PI.1872GAT02.pdf.exe.2c0000.0.unpack, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 0.2.PI.1872GAT02.pdf.exe.2c0000.0.unpack, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: catch.exe.9.dr, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.13.unpack, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.3.unpack, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 9.0.PI.1872GAT02.pdf.exe.b60000.7.unpack, lN/HS.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 0_2_0702D88D push FFFFFF8Bh; iretd		0_2_0702D88F
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Code function: 9_2_02E5DD39 push FFFFFF8Bh; iretd		9_2_02E5DD3B

Source: initial sample	Static PE information: section name: .text entropy: 7.24659563485
Source: initial sample	Static PE information: section name: .text entropy: 7.24659563485
Source: initial sample	Static PE information: section name: .text entropy: 7.24659563485

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File created: C:\Users\user\AppData\Roaming\catch\catch.exe			Jump to dropped file
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File created: C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe			Jump to dropped file

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run catch			Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run catch			Jump to behavior

Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.2797840.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.278f834.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.27d661c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.27bf844.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.27bf844.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.27c7850.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.27c7850.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.383033038.0000000002761000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.507778914.0000000002791000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.383089116.00000000027AB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.1872GAT02.pdf.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 5320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 2772, type: MEMORYSTR

Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383033038.0000000002761000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.383089116.00000000027AB000.00000004.00000001.sdmp, catch.exe, 00000010.00000002.507778914.0000000002791000.00000004.00000001.sdmp, catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: PI.1872GAT02.pdf.exe, 00000000.00000002.383033038.0000000002761000.00000004.00000001.sdmp, PI.1872GAT02.pdf.exe, 00000000.00000002.383089116.00000000027AB000.00000004.00000001.sdmp, catch.exe, 00000010.00000002.507778914.0000000002791000.00000004.00000001.sdmp, catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe TID: 6904	Thread sleep time: -34769s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe TID: 6936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe TID: 6060	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe TID: 2440	Thread sleep count: 4166 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe TID: 2440	Thread sleep count: 5649 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 2944	Thread sleep time: -37884s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 6308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4708	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 6376	Thread sleep time: -33793s >= -30000s
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 4828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2296	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 4528	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 4528	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 1752	Thread sleep count: 3295 > 30
Source: C:\Users\user\AppData\Roaming\catch\catch.exe TID: 1752	Thread sleep count: 6529 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6204	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2617	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Window / User API: threadDelayed 4166	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Window / User API: threadDelayed 5649	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7657
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 723
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6776
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1753
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Window / User API: threadDelayed 3295
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Window / User API: threadDelayed 6529

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Thread delayed: delay time: 34769	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 37884	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 33793
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Thread delayed: delay time: 922337203685477

Source: catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: catch.exe, 00000014.00000002.507639555.0000000002791000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Process token adjusted: Debug

Windows Analysis Report PI.1872GAT02.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Domains

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Memory written: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Memory written: C:\Users\user\AppData\Roaming\catch\catch.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\catch\catch.exe	Memory written: C:\Users\user\AppData\Roaming\catch\catch.exe base: 400000 value starts with: 4D5A

Source: PI.1872GAT02.pdf.exe, 00000009.00000002.609447003.0000000001900000.00000002.00020000.sdmp, catch.exe, 00000020.00000002.608790450.0000000001800000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.609447003.0000000001900000.00000002.00020000.sdmp, catch.exe, 00000020.00000002.608790450.0000000001800000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.609447003.0000000001900000.00000002.00020000.sdmp, catch.exe, 00000020.00000002.608790450.0000000001800000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: PI.1872GAT02.pdf.exe, 00000009.00000002.609447003.0000000001900000.00000002.00020000.sdmp, catch.exe, 00000020.00000002.608790450.0000000001800000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: Yara match	File source: 9.0.PI.1872GAT02.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.PI.1872GAT02.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.382b948.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.PI.1872GAT02.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.37fb948.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.37c5928.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.catch.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.PI.1872GAT02.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.catch.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.catch.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.37f5928.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.catch.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.catch.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.catch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.catch.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.PI.1872GAT02.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.catch.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.382b948.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.catch.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.37f5928.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.PI.1872GAT02.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.catch.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.catch.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.catch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.382b948.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.382b948.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.37c5928.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.catch.exe.37f5928.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.catch.exe.37f5928.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.1872GAT02.pdf.exe.37fb948.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000000.500639086.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.499820218.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.377405263.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.501701572.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.378343563.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.383386260.0000000003769000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.606123172.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.509847995.0000000003799000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.502624331.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.499174008.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.510080482.0000000003799000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.501171531.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.511166140.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.379158737.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.606087624.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.379924132.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.502205022.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.500431945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.512689898.0000000002E31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610231002.0000000003071000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.609266504.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.1872GAT02.pdf.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PI.1872GAT02.pdf.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 5320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 2772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 4860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: catch.exe PID: 2948, type: MEMORYSTR

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PI.1872GAT02.pdf.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Name	IP	Active
us2.smtp.mailhostbox.com	208.91.199.224	true
smtp.tranpotescamdonic.us	unknown	unknown

ID:	553435
Product:	CloudBasic
Start time:	22:21:14
Start date:	14.01.2022
Sample:	PI.1872GAT02.pdf.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1396637598469e7e918c70be938370d5
SHA1:	c83510c66f043c3595960102ac030a3c99656768
SHA256:	d6f3d5fbdc9c7f68e29260badb6fd6e8f1b606798fd9fe544e0b28387f21eaf9
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI.1872GAT02.pdf.exe.log	ASCII text, with CRLF line terminators	A9EFF9253CAF99EC8665E41D736DDAED	D95BB4ABC856D774DA4602A59DE252B4BF560530	DBC637B33F1F3CD1AB40AFED23F94C4571CA43621EBB52C5DC267DBDC52D4783
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\catch.exe.log	ASCII text, with CRLF line terminators	A9EFF9253CAF99EC8665E41D736DDAED	D95BB4ABC856D774DA4602A59DE252B4BF560530	DBC637B33F1F3CD1AB40AFED23F94C4571CA43621EBB52C5DC267DBDC52D4783
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	53C520BE8CDC6F6BF16863F4BB562638	70391CC67D9B586AAC373FBF7DF6C70669BB4776	8129FB32F8FCC386F60B0C6E0EF92F1322B254CAB0A4DFE00F099F140F2A4E0D
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qysiocw.gzb.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajno0yrk.14b.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixzoiwgh.ddw.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kawb1whi.elv.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmd43qat.nwn.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2btzcjm.l41.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmp79D1.tmp	XML 1.0 document, ASCII text	3D101574D5C7C36A6FFB1733E9A405ED	C16D43BEB7493D4F119E60C62E5D895CD4FED054	3A52CA55D7A163C15E187788137F8CB1B4A84779EC7DE748463F1AA23314E901
C:\Users\user\AppData\Local\Temp\tmp86D2.tmp	XML 1.0 document, ASCII text	3D101574D5C7C36A6FFB1733E9A405ED	C16D43BEB7493D4F119E60C62E5D895CD4FED054	3A52CA55D7A163C15E187788137F8CB1B4A84779EC7DE748463F1AA23314E901
C:\Users\user\AppData\Local\Temp\tmpB28A.tmp	XML 1.0 document, ASCII text	3D101574D5C7C36A6FFB1733E9A405ED	C16D43BEB7493D4F119E60C62E5D895CD4FED054	3A52CA55D7A163C15E187788137F8CB1B4A84779EC7DE748463F1AA23314E901
C:\Users\user\AppData\Roaming\catch\catch.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	1396637598469E7E918C70BE938370D5	C83510C66F043C3595960102AC030A3C99656768	D6F3D5FBDC9C7F68E29260BADB6FD6E8F1B606798FD9FE544E0B28387F21EAF9
C:\Users\user\AppData\Roaming\catch\catch.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	1396637598469E7E918C70BE938370D5	C83510C66F043C3595960102AC030A3C99656768	D6F3D5FBDC9C7F68E29260BADB6FD6E8F1B606798FD9FE544E0B28387F21EAF9
C:\Users\user\AppData\Roaming\iDGyQtltoKmu.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20220114\PowerShell_transcript.377142.QGssXbBu.20220114222222.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	71D228AAF492D79076B73C9D2B27013A	0A86EAB450B1CD81557CCF72E31E7C803F9AB44A	A8517EDF2BC36DF48DF3C3E13A0BE1BA07B132AD0D1F54FC09979F9299470954
C:\Users\user\Documents\20220114\PowerShell_transcript.377142.b0jiOviu.20220114222318.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9856AC8EDA71C81081373075C63B1FBF	1127A82E408E284F58970BFC492FDF3155D7F1CA	67D2D901C2AE839AC5BB8A3D65AA9772BF9E469B5BFE055CDB8B12E02C1ABFBC
C:\Users\user\Documents\20220114\PowerShell_transcript.377142.dHeZQIbB.20220114222311.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	85283F0F6FA628A82FFF3E0E79A83DEC	3917D8CD74B27A603CB7B1FCA06B2BD6522617C6	81EE9C2B79D72E329B1A5B6F9043F27224D36E967C0BCBADA6E9DE1D37B7438F