Windows Analysis Report
DHL Document.exe

Overview

General Information

Sample Name: DHL Document.exe
Analysis ID: 562453
MD5: c66df8b380d1db550cb5f0bc5ded67d7
SHA1: 080556dec75ae3a4a844fcad0419d9c533c0c0d5
SHA256: 6fc6d0526995ef4c7ab87e092759ef93e84495a8c71b9ec36b924bcf7c2fa75c
Tags: DHLexeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to detect virtual machines (SLDT)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.floridanratraining.com/how6/"], "decoy": ["wealthcabana.com", "fourfortyfourcreations.com", "cqqcsy.com", "bhwzjd.com", "niftyfashionrewards.com", "andersongiftemporium.com", "smarttradingcoin.com", "ilarealty.com", "sherrywine.net", "fsecg.info", "xoti.top", "pirosconsulting.com", "fundapie.com", "bbgm4egda.xyz", "legalfortmyers.com", "improvizy.com", "yxdyhs.com", "lucky2balls.com", "panelmall.com", "davenportkartway.com", "springfieldlottery.com", "pentagonpublishers.com", "icanmakeyoufamous.com", "40m2k.com", "projectcentered.com", "webfactory.agency", "metronixmedical.com", "dalingtao.xyz", "functionalsoft.com", "klopert77.com", "cortepuroiberico.com", "viavelleiloes.online", "bamedia.online", "skolicalunjo.com", "kayhardy.com", "excellentappraisers.com", "sademakale.com", "zbycsb.com", "empirejewelss.com", "coached.info", "20215414.online", "dazzlehide.com", "swickstyle.com", "specialtyplastics.online", "noordinarysenior.com", "bluinfo.digital", "chuxiaoxin.xyz", "adwin-estate.com", "girlwithaglow.com", "auctions.email", "topekasecurestorage.com", "mountain-chicken.com", "lhdtrj.com", "mhtqph.club", "solatopotato.com", "mecitiris.com", "hotrodathangtrungquoc.com", "gapteknews.com", "mantraexchange.online", "cinematiccarpenter.com", "wozka.xyz", "car-tech.tech", "jssatchell.media", "joyokanji-cheer.com"]}
Yara detected FormBook
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.floridanratraining.com/how6/ Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: DHL Document.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.DHL Document.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DHL Document.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DHL Document.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DHL Document.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: DHL Document.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: DHL Document.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: CultureNameResourceSetPa.pdb source: DHL Document.exe
Source: Binary string: colorcpl.pdbGCTL source: DHL Document.exe, 00000005.00000002.489364104.00000000033E0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: DHL Document.exe, 00000005.00000002.489364104.00000000033E0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: DHL Document.exe, 00000005.00000002.488054555.0000000001420000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000002.488674314.000000000153F000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000003.412367442.0000000001280000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.644486032.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.645100478.000000000503F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: DHL Document.exe, 00000005.00000002.488054555.0000000001420000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000002.488674314.000000000153F000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000003.412367442.0000000001280000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 0000000F.00000002.644486032.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.645100478.000000000503F000.00000040.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 4x nop then jmp 07D6954Bh 0_2_07D694A5
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 4x nop then pop edi 5_2_0040C3AE
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 4x nop then pop edi 5_2_00415681
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 4x nop then pop edi 15_2_02ECC3AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 4x nop then pop edi 15_2_02ED5681

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.floridanratraining.com/how6/
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://blog.iandreev.com
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://blog.iandreev.com/
Source: DHL Document.exe, 00000000.00000003.364941552.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.365105939.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.365172175.0000000005B3A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: DHL Document.exe, 00000000.00000003.364609073.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364198577.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364470211.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.363467464.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364020803.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364331164.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.363729294.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364941552.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.365105939.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.363650587.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.364736108.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.363877573.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.365324145.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: DHL Document.exe, 00000000.00000003.363650587.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com(
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL Document.exe, 00000000.00000003.375303832.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375879277.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375219441.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.376228367.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375729842.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375122627.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.376374655.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375522749.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.376031091.0000000005B33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: DHL Document.exe, 00000000.00000003.375303832.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375219441.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375122627.0000000005B33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html(
Source: explorer.exe, 00000008.00000000.417336784.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.457066024.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.438988395.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.516000007.000000000095C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: DHL Document.exe, 00000000.00000003.372366110.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371185243.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: DHL Document.exe, 00000000.00000003.370770475.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371333722.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371050045.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370913501.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371185243.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com(
Source: DHL Document.exe, 00000000.00000003.371590968.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371722553.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371864694.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com.
Source: DHL Document.exe, 00000000.00000003.370770475.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371333722.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371050045.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370913501.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comL
Source: DHL Document.exe, 00000000.00000003.372603205.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372516308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372761903.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372909291.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comal
Source: DHL Document.exe, 00000000.00000003.371864694.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comatt
Source: DHL Document.exe, 00000000.00000003.371590968.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372069177.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371722553.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371333722.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371050045.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371864694.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372227275.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372366110.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371185243.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comk
Source: DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: DHL Document.exe, 00000000.00000003.370770475.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370629591.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371050045.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370913501.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comncyD
Source: DHL Document.exe, 00000000.00000003.371590968.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370770475.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372069177.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371722553.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370629591.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371333722.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371050045.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.370913501.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371864694.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372227275.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372366110.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371185243.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: DHL Document.exe, 00000000.00000003.372603205.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372069177.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372227275.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372366110.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372516308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372761903.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372909291.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comroa
Source: DHL Document.exe, 00000000.00000003.371590968.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371463007.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371722553.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.371864694.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comva
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: DHL Document.exe, 00000000.00000003.400746887.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL Document.exe, 00000000.00000003.379897961.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/(
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL Document.exe, 00000000.00000003.389612639.0000000005B4E000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.389865490.0000000005B4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html(
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL Document.exe, 00000000.00000003.389612639.0000000005B4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlr
Source: DHL Document.exe, 00000000.00000003.385584605.0000000005B4E000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DHL Document.exe, 00000000.00000003.385720678.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.388682645.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.388184932.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.388824941.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.388516231.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.388382396.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.387955236.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.385477021.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlgfa
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL Document.exe, 00000000.00000003.383014501.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.384284843.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.382478395.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersO
Source: DHL Document.exe, 00000000.00000003.382077223.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.382274635.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.382478395.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersn
Source: DHL Document.exe, 00000000.00000003.380215559.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersp
Source: DHL Document.exe, 00000000.00000003.382274635.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerss
Source: DHL Document.exe, 00000000.00000002.413024823.0000000001287000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: DHL Document.exe, 00000000.00000003.369779518.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372761903.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.368790068.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372909291.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.373449690.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL Document.exe, 00000000.00000003.369287425.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.368254834.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL Document.exe, 00000000.00000003.369287425.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369854837.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369461001.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369626308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369779518.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/lg
Source: DHL Document.exe, 00000000.00000003.369287425.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369854837.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369461001.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369626308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369779518.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cna
Source: DHL Document.exe, 00000000.00000003.368980515.0000000005B34000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.368790068.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnht
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL Document.exe, 00000000.00000003.394503541.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394361753.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394167536.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394649020.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394783374.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL Document.exe, 00000000.00000003.394503541.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394361753.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.394167536.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm0
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: DHL Document.exe, 00000000.00000003.368102080.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.krtp
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL Document.exe, 00000000.00000003.360546997.0000000005B12000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: DHL Document.exe, 00000000.00000003.360546997.0000000005B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com2
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.375219441.0000000005B33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: DHL Document.exe, 00000000.00000003.368102080.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.367946380.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: DHL Document.exe, 00000000.00000003.368102080.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.367946380.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krFeN
Source: DHL Document.exe, 00000000.00000003.368102080.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.368254834.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krO
Source: DHL Document.exe, 00000000.00000003.368102080.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krormal
Source: DHL Document.exe, 00000000.00000003.367946380.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krtp
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372603205.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372516308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369779518.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: DHL Document.exe, 00000000.00000003.372603205.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.373065712.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372516308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.369779518.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372761903.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.372909291.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.coms
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: DHL Document.exe, 00000000.00000003.379576940.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.391081217.0000000005B38000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379746296.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.391161700.0000000005B38000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379221676.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.390737863.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.391283057.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.390882690.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.390961983.0000000005B38000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379399587.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379897961.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.de
Source: DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL Document.exe, 00000000.00000003.379576940.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379746296.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379221676.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379399587.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379897961.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deoV
Source: DHL Document.exe, 00000000.00000003.379576940.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.380052033.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379746296.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379221676.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379399587.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000003.379897961.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.depko
Source: DHL Document.exe, 00000000.00000003.370472567.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.417347780.0000000006D22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL Document.exe, 00000000.00000003.370472567.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn(
Source: DHL Document.exe, 00000000.00000003.370472567.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnTC
Source: DHL Document.exe, 00000000.00000003.370472567.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: DHL Document.exe, 00000000.00000002.412571459.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.DHL Document.exe.2c9da00.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.DHL Document.exe.2d1d508.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DHL Document.exe
Uses 32bit PE files
Source: DHL Document.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.DHL Document.exe.2c9da00.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.DHL Document.exe.2d1d508.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_01277268 0_2_01277268
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_01277278 0_2_01277278
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_012774BA 0_2_012774BA
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_012774C8 0_2_012774C8
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00408C8B 5_2_00408C8B
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00408C90 5_2_00408C90
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00402D87 5_2_00402D87
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05012D07 15_2_05012D07
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05011D55 15_2_05011D55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5B090 15_2_04F5B090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5841F 15_2_04F5841F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001002 15_2_05001002
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5D5E0 15_2_04F5D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72581 15_2_04F72581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_050120A8 15_2_050120A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F40D20 15_2_04F40D20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4F900 15_2_04F4F900
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05012B28 15_2_05012B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F66E30 15_2_04F66E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500DBD2 15_2_0500DBD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05011FF1 15_2_05011FF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7EBB0 15_2_04F7EBB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_050122AE 15_2_050122AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05012EF7 15_2_05012EF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC2FB0 15_2_02EC2FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC8C8B 15_2_02EC8C8B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC8C90 15_2_02EC8C90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC2D87 15_2_02EC2D87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC2D90 15_2_02EC2D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04F4B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004185F0 NtCreateFile, 5_2_004185F0
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004186A0 NtReadFile, 5_2_004186A0
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00418720 NtClose, 5_2_00418720
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004187D0 NtAllocateVirtualMemory, 5_2_004187D0
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004185EA NtCreateFile, 5_2_004185EA
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00418642 NtReadFile, 5_2_00418642
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0041869A NtReadFile, 5_2_0041869A
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004187CB NtAllocateVirtualMemory, 5_2_004187CB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89860 NtQuerySystemInformation,LdrInitializeThunk, 15_2_04F89860
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89840 NtDelayExecution,LdrInitializeThunk, 15_2_04F89840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F895D0 NtClose,LdrInitializeThunk, 15_2_04F895D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F899A0 NtCreateSection,LdrInitializeThunk, 15_2_04F899A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89540 NtReadFile,LdrInitializeThunk, 15_2_04F89540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89910 NtAdjustPrivilegesToken,LdrInitializeThunk, 15_2_04F89910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F896E0 NtFreeVirtualMemory,LdrInitializeThunk, 15_2_04F896E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F896D0 NtCreateKey,LdrInitializeThunk, 15_2_04F896D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89660 NtAllocateVirtualMemory,LdrInitializeThunk, 15_2_04F89660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89650 NtQueryValueKey,LdrInitializeThunk, 15_2_04F89650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89A50 NtCreateFile,LdrInitializeThunk, 15_2_04F89A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89FE0 NtCreateMutant,LdrInitializeThunk, 15_2_04F89FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89780 NtMapViewOfSection,LdrInitializeThunk, 15_2_04F89780
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89710 NtQueryInformationToken,LdrInitializeThunk, 15_2_04F89710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F898F0 NtReadVirtualMemory, 15_2_04F898F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F898A0 NtWriteVirtualMemory, 15_2_04F898A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8B040 NtSuspendThread, 15_2_04F8B040
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89820 NtEnumerateKey, 15_2_04F89820
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F895F0 NtQueryInformationFile, 15_2_04F895F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F899D0 NtCreateProcessEx, 15_2_04F899D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89560 NtWriteFile, 15_2_04F89560
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89950 NtQueueApcThread, 15_2_04F89950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8AD30 NtSetContextThread, 15_2_04F8AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89520 NtWaitForSingleObject, 15_2_04F89520
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89A80 NtOpenDirectoryObject, 15_2_04F89A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89670 NtQueryInformationProcess, 15_2_04F89670
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89A20 NtResumeThread, 15_2_04F89A20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89610 NtEnumerateValueKey, 15_2_04F89610
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89A10 NtQuerySection, 15_2_04F89A10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89A00 NtProtectVirtualMemory, 15_2_04F89A00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8A3B0 NtGetContextThread, 15_2_04F8A3B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F897A0 NtUnmapViewOfSection, 15_2_04F897A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89770 NtSetInformationFile, 15_2_04F89770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8A770 NtOpenThread, 15_2_04F8A770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89760 NtOpenProcess, 15_2_04F89760
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89730 NtQueryVirtualMemory, 15_2_04F89730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8A710 NtOpenProcessToken, 15_2_04F8A710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F89B00 NtSetValueKey, 15_2_04F89B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED86A0 NtReadFile, 15_2_02ED86A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED87D0 NtAllocateVirtualMemory, 15_2_02ED87D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED8720 NtClose, 15_2_02ED8720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED85F0 NtCreateFile, 15_2_02ED85F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED869A NtReadFile, 15_2_02ED869A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED8642 NtReadFile, 15_2_02ED8642
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED87CB NtAllocateVirtualMemory, 15_2_02ED87CB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED85EA NtCreateFile, 15_2_02ED85EA
Sample file is different than original file name gathered from version info
Source: DHL Document.exe, 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.412348477.00000000007D8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCultureNameResourceSetPa.exe4 vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.418429951.0000000007C00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413494042.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.412571459.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413419907.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCultureNameResourceSetPa.exe4 vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413419907.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs DHL Document.exe
Source: DHL Document.exe, 00000000.00000002.413419907.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: i,\\StringFileInfo\\000004B0\\OriginalFilename vs DHL Document.exe
Source: DHL Document.exe, 00000005.00000000.410179466.0000000000AB8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCultureNameResourceSetPa.exe4 vs DHL Document.exe
Source: DHL Document.exe, 00000005.00000002.489403088.00000000033E3000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamecolorcpl.exej% vs DHL Document.exe
Source: DHL Document.exe, 00000005.00000003.412733392.000000000139F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs DHL Document.exe
Source: DHL Document.exe, 00000005.00000002.488936752.00000000016CF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs DHL Document.exe
Source: DHL Document.exe, 00000005.00000002.488674314.000000000153F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs DHL Document.exe
Source: C:\Users\user\Desktop\DHL Document.exe File read: C:\Users\user\Desktop\DHL Document.exe:Zone.Identifier Jump to behavior
Source: DHL Document.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL Document.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL Document.exe "C:\Users\user\Desktop\DHL Document.exe"
Source: C:\Users\user\Desktop\DHL Document.exe Process created: C:\Users\user\Desktop\DHL Document.exe C:\Users\user\Desktop\DHL Document.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Document.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Users\user\Desktop\DHL Document.exe Process created: C:\Users\user\Desktop\DHL Document.exe C:\Users\user\Desktop\DHL Document.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Document.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Document.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/2@0/0
Source: C:\Windows\explorer.exe File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_01
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe
Source: DHL Document.exe, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: DHL Document.exe, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Document.exe.710000.0.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Document.exe.710000.0.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.DHL Document.exe.710000.0.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.DHL Document.exe.710000.0.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.1.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.1.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.9.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.9.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.3.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.DHL Document.exe.9f0000.3.unpack, oz/RT.cs Cryptographic APIs: 'CreateDecryptor'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\DHL Document.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: DHL Document.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL Document.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: DHL Document.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: CultureNameResourceSetPa.pdb source: DHL Document.exe
Source: Binary string: colorcpl.pdbGCTL source: DHL Document.exe, 00000005.00000002.489364104.00000000033E0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: DHL Document.exe, 00000005.00000002.489364104.00000000033E0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: DHL Document.exe, 00000005.00000002.488054555.0000000001420000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000002.488674314.000000000153F000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000003.412367442.0000000001280000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.644486032.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.645100478.000000000503F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: DHL Document.exe, 00000005.00000002.488054555.0000000001420000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000002.488674314.000000000153F000.00000040.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000005.00000003.412367442.0000000001280000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 0000000F.00000002.644486032.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.645100478.000000000503F000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: DHL Document.exe, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.DHL Document.exe.710000.0.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.DHL Document.exe.710000.0.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.1.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.9.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.3.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.5.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.0.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.2.DHL Document.exe.9f0000.1.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.2.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.DHL Document.exe.9f0000.7.unpack, Xk/H7.cs .Net Code: bON System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: DHL Document.exe, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.DHL Document.exe.710000.0.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.DHL Document.exe.710000.0.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.1.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.9.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.3.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.5.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.0.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.2.DHL Document.exe.9f0000.1.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.2.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.DHL Document.exe.9f0000.7.unpack, oz/RT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_07D6BAF5 push FFFFFF8Bh; iretd 0_2_07D6BAF7
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0041B832 push eax; ret 5_2_0041B838
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0041B83B push eax; ret 5_2_0041B8A2
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0041B89C push eax; ret 5_2_0041B8A2
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0040825A push ecx; retf 5_2_0040825B
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0040C38A pushfd ; ret 5_2_0040C3A0
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00415CC4 push FFFFFFDFh; iretd 5_2_00415CDA
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_0041B7E5 push eax; ret 5_2_0041B838
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F9D0D1 push ecx; ret 15_2_04F9D0E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EC825A push ecx; retf 15_2_02EC825B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ECC38A pushfd ; ret 15_2_02ECC3A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EDB89C push eax; ret 15_2_02EDB8A2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EDB83B push eax; ret 15_2_02EDB8A2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EDB832 push eax; ret 15_2_02EDB838
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02EDB7E5 push eax; ret 15_2_02EDB838
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_02ED5CC4 push FFFFFFDFh; iretd 15_2_02ED5CDA

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: /c del "C:\Users\user\Desktop\DHL Document.exe"
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: /c del "C:\Users\user\Desktop\DHL Document.exe" Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.DHL Document.exe.2c9da00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.2d1d508.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.413494042.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL Document.exe PID: 6900, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DHL Document.exe, 00000000.00000002.413494042.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: DHL Document.exe, 00000000.00000002.413494042.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\DHL Document.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DHL Document.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002EC8614 second address: 0000000002EC861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002EC89AE second address: 0000000002EC89B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL Document.exe TID: 6904 Thread sleep time: -41116s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe TID: 6948 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\colorcpl.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004088E0 rdtsc 5_2_004088E0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL Document.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 0_2_00718B05 sldt word ptr [eax] 0_2_00718B05
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 9.7 %
Source: C:\Users\user\Desktop\DHL Document.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Thread delayed: delay time: 41116 Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000008.00000000.447637801.00000000083E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000001B.00000000.623961064.000000000697B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000001B.00000003.611640671.000000000697B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Z
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000001B.00000003.586610331.0000000006DF9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001B.00000000.626703720.0000000006B57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: explorer.exe, 0000001B.00000000.626112232.0000000006B19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000001B.00000000.626703720.0000000006B57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001B.00000000.628126302.0000000006DA7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
Source: explorer.exe, 0000001B.00000000.628126302.0000000006DA7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'g
Source: explorer.exe, 00000008.00000000.447469758.00000000082E2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 0000001B.00000003.586646860.0000000006E0F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e
Source: explorer.exe, 0000001B.00000000.628126302.0000000006DA7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}57
Source: explorer.exe, 0000001B.00000000.625850311.0000000006AD3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: od_vmware_sata_cd00#5&280b647&0&000000#{53f563f-8
Source: explorer.exe, 0000001B.00000000.616115408.0000000000A58000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000008.00000000.468364541.0000000008430000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: DHL Document.exe, 00000000.00000002.413281516.0000000002C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000008.00000000.516000007.000000000095C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 0000001B.00000003.611589319.0000000006956000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000@v

Anti Debugging
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_004088E0 rdtsc 5_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\DHL Document.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6CF0 mov eax, dword ptr fs:[00000030h] 15_2_04FC6CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6CF0 mov eax, dword ptr fs:[00000030h] 15_2_04FC6CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6CF0 mov eax, dword ptr fs:[00000030h] 15_2_04FC6CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F458EC mov eax, dword ptr fs:[00000030h] 15_2_04F458EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov eax, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov ecx, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov eax, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov eax, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov eax, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDB8D0 mov eax, dword ptr fs:[00000030h] 15_2_04FDB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018D34 mov eax, dword ptr fs:[00000030h] 15_2_05018D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7F0BF mov ecx, dword ptr fs:[00000030h] 15_2_04F7F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7F0BF mov eax, dword ptr fs:[00000030h] 15_2_04F7F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7F0BF mov eax, dword ptr fs:[00000030h] 15_2_04F7F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F890AF mov eax, dword ptr fs:[00000030h] 15_2_04F890AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F720A0 mov eax, dword ptr fs:[00000030h] 15_2_04F720A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5849B mov eax, dword ptr fs:[00000030h] 15_2_04F5849B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49080 mov eax, dword ptr fs:[00000030h] 15_2_04F49080
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC3884 mov eax, dword ptr fs:[00000030h] 15_2_04FC3884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC3884 mov eax, dword ptr fs:[00000030h] 15_2_04FC3884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6746D mov eax, dword ptr fs:[00000030h] 15_2_04F6746D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F60050 mov eax, dword ptr fs:[00000030h] 15_2_04F60050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F60050 mov eax, dword ptr fs:[00000030h] 15_2_04F60050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDC450 mov eax, dword ptr fs:[00000030h] 15_2_04FDC450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDC450 mov eax, dword ptr fs:[00000030h] 15_2_04FDC450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_050105AC mov eax, dword ptr fs:[00000030h] 15_2_050105AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_050105AC mov eax, dword ptr fs:[00000030h] 15_2_050105AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A44B mov eax, dword ptr fs:[00000030h] 15_2_04F7A44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7002D mov eax, dword ptr fs:[00000030h] 15_2_04F7002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7002D mov eax, dword ptr fs:[00000030h] 15_2_04F7002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7002D mov eax, dword ptr fs:[00000030h] 15_2_04F7002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7002D mov eax, dword ptr fs:[00000030h] 15_2_04F7002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7002D mov eax, dword ptr fs:[00000030h] 15_2_04F7002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7BC2C mov eax, dword ptr fs:[00000030h] 15_2_04F7BC2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5B02A mov eax, dword ptr fs:[00000030h] 15_2_04F5B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5B02A mov eax, dword ptr fs:[00000030h] 15_2_04F5B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5B02A mov eax, dword ptr fs:[00000030h] 15_2_04F5B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5B02A mov eax, dword ptr fs:[00000030h] 15_2_04F5B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500FDE2 mov eax, dword ptr fs:[00000030h] 15_2_0500FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500FDE2 mov eax, dword ptr fs:[00000030h] 15_2_0500FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500FDE2 mov eax, dword ptr fs:[00000030h] 15_2_0500FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500FDE2 mov eax, dword ptr fs:[00000030h] 15_2_0500FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7016 mov eax, dword ptr fs:[00000030h] 15_2_04FC7016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7016 mov eax, dword ptr fs:[00000030h] 15_2_04FC7016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7016 mov eax, dword ptr fs:[00000030h] 15_2_04FC7016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6C0A mov eax, dword ptr fs:[00000030h] 15_2_04FC6C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6C0A mov eax, dword ptr fs:[00000030h] 15_2_04FC6C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6C0A mov eax, dword ptr fs:[00000030h] 15_2_04FC6C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6C0A mov eax, dword ptr fs:[00000030h] 15_2_04FC6C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001C06 mov eax, dword ptr fs:[00000030h] 15_2_05001C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0501740D mov eax, dword ptr fs:[00000030h] 15_2_0501740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0501740D mov eax, dword ptr fs:[00000030h] 15_2_0501740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0501740D mov eax, dword ptr fs:[00000030h] 15_2_0501740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FF8DF1 mov eax, dword ptr fs:[00000030h] 15_2_04FF8DF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05014015 mov eax, dword ptr fs:[00000030h] 15_2_05014015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05014015 mov eax, dword ptr fs:[00000030h] 15_2_05014015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4B1E1 mov eax, dword ptr fs:[00000030h] 15_2_04F4B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4B1E1 mov eax, dword ptr fs:[00000030h] 15_2_04F4B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4B1E1 mov eax, dword ptr fs:[00000030h] 15_2_04F4B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FD41E8 mov eax, dword ptr fs:[00000030h] 15_2_04FD41E8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5D5E0 mov eax, dword ptr fs:[00000030h] 15_2_04F5D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5D5E0 mov eax, dword ptr fs:[00000030h] 15_2_04F5D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov eax, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov eax, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov eax, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov ecx, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov eax, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC6DC9 mov eax, dword ptr fs:[00000030h] 15_2_04FC6DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F71DB5 mov eax, dword ptr fs:[00000030h] 15_2_04F71DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F71DB5 mov eax, dword ptr fs:[00000030h] 15_2_04F71DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F71DB5 mov eax, dword ptr fs:[00000030h] 15_2_04F71DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC51BE mov eax, dword ptr fs:[00000030h] 15_2_04FC51BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC51BE mov eax, dword ptr fs:[00000030h] 15_2_04FC51BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC51BE mov eax, dword ptr fs:[00000030h] 15_2_04FC51BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC51BE mov eax, dword ptr fs:[00000030h] 15_2_04FC51BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F735A1 mov eax, dword ptr fs:[00000030h] 15_2_04F735A1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F761A0 mov eax, dword ptr fs:[00000030h] 15_2_04F761A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F761A0 mov eax, dword ptr fs:[00000030h] 15_2_04F761A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC69A6 mov eax, dword ptr fs:[00000030h] 15_2_04FC69A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72990 mov eax, dword ptr fs:[00000030h] 15_2_04F72990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7FD9B mov eax, dword ptr fs:[00000030h] 15_2_04F7FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7FD9B mov eax, dword ptr fs:[00000030h] 15_2_04F7FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A185 mov eax, dword ptr fs:[00000030h] 15_2_04F7A185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05002073 mov eax, dword ptr fs:[00000030h] 15_2_05002073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6C182 mov eax, dword ptr fs:[00000030h] 15_2_04F6C182
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05011074 mov eax, dword ptr fs:[00000030h] 15_2_05011074
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72581 mov eax, dword ptr fs:[00000030h] 15_2_04F72581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72581 mov eax, dword ptr fs:[00000030h] 15_2_04F72581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72581 mov eax, dword ptr fs:[00000030h] 15_2_04F72581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72581 mov eax, dword ptr fs:[00000030h] 15_2_04F72581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F42D8A mov eax, dword ptr fs:[00000030h] 15_2_04F42D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F42D8A mov eax, dword ptr fs:[00000030h] 15_2_04F42D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F42D8A mov eax, dword ptr fs:[00000030h] 15_2_04F42D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F42D8A mov eax, dword ptr fs:[00000030h] 15_2_04F42D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F42D8A mov eax, dword ptr fs:[00000030h] 15_2_04F42D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6C577 mov eax, dword ptr fs:[00000030h] 15_2_04F6C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6C577 mov eax, dword ptr fs:[00000030h] 15_2_04F6C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4B171 mov eax, dword ptr fs:[00000030h] 15_2_04F4B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4B171 mov eax, dword ptr fs:[00000030h] 15_2_04F4B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4C962 mov eax, dword ptr fs:[00000030h] 15_2_04F4C962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F67D50 mov eax, dword ptr fs:[00000030h] 15_2_04F67D50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6B944 mov eax, dword ptr fs:[00000030h] 15_2_04F6B944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6B944 mov eax, dword ptr fs:[00000030h] 15_2_04F6B944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F83D43 mov eax, dword ptr fs:[00000030h] 15_2_04F83D43
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC3540 mov eax, dword ptr fs:[00000030h] 15_2_04FC3540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F53D34 mov eax, dword ptr fs:[00000030h] 15_2_04F53D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4AD30 mov eax, dword ptr fs:[00000030h] 15_2_04F4AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FCA537 mov eax, dword ptr fs:[00000030h] 15_2_04FCA537
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74D3B mov eax, dword ptr fs:[00000030h] 15_2_04F74D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74D3B mov eax, dword ptr fs:[00000030h] 15_2_04F74D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74D3B mov eax, dword ptr fs:[00000030h] 15_2_04F74D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7513A mov eax, dword ptr fs:[00000030h] 15_2_04F7513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7513A mov eax, dword ptr fs:[00000030h] 15_2_04F7513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 mov eax, dword ptr fs:[00000030h] 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 mov eax, dword ptr fs:[00000030h] 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 mov eax, dword ptr fs:[00000030h] 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 mov eax, dword ptr fs:[00000030h] 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F64120 mov ecx, dword ptr fs:[00000030h] 15_2_04F64120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018CD6 mov eax, dword ptr fs:[00000030h] 15_2_05018CD6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49100 mov eax, dword ptr fs:[00000030h] 15_2_04F49100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49100 mov eax, dword ptr fs:[00000030h] 15_2_04F49100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49100 mov eax, dword ptr fs:[00000030h] 15_2_04F49100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_050014FB mov eax, dword ptr fs:[00000030h] 15_2_050014FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0501070D mov eax, dword ptr fs:[00000030h] 15_2_0501070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0501070D mov eax, dword ptr fs:[00000030h] 15_2_0501070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72AE4 mov eax, dword ptr fs:[00000030h] 15_2_04F72AE4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F716E0 mov ecx, dword ptr fs:[00000030h] 15_2_04F716E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F576E2 mov eax, dword ptr fs:[00000030h] 15_2_04F576E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500131B mov eax, dword ptr fs:[00000030h] 15_2_0500131B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F736CC mov eax, dword ptr fs:[00000030h] 15_2_04F736CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72ACB mov eax, dword ptr fs:[00000030h] 15_2_04F72ACB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FFFEC0 mov eax, dword ptr fs:[00000030h] 15_2_04FFFEC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F88EC7 mov eax, dword ptr fs:[00000030h] 15_2_04F88EC7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5AAB0 mov eax, dword ptr fs:[00000030h] 15_2_04F5AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5AAB0 mov eax, dword ptr fs:[00000030h] 15_2_04F5AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7FAB0 mov eax, dword ptr fs:[00000030h] 15_2_04F7FAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F452A5 mov eax, dword ptr fs:[00000030h] 15_2_04F452A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F452A5 mov eax, dword ptr fs:[00000030h] 15_2_04F452A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F452A5 mov eax, dword ptr fs:[00000030h] 15_2_04F452A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F452A5 mov eax, dword ptr fs:[00000030h] 15_2_04F452A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F452A5 mov eax, dword ptr fs:[00000030h] 15_2_04F452A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018B58 mov eax, dword ptr fs:[00000030h] 15_2_05018B58
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC46A7 mov eax, dword ptr fs:[00000030h] 15_2_04FC46A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7D294 mov eax, dword ptr fs:[00000030h] 15_2_04F7D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7D294 mov eax, dword ptr fs:[00000030h] 15_2_04F7D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018F6A mov eax, dword ptr fs:[00000030h] 15_2_05018F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDFE87 mov eax, dword ptr fs:[00000030h] 15_2_04FDFE87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F8927A mov eax, dword ptr fs:[00000030h] 15_2_04F8927A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6AE73 mov eax, dword ptr fs:[00000030h] 15_2_04F6AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6AE73 mov eax, dword ptr fs:[00000030h] 15_2_04F6AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6AE73 mov eax, dword ptr fs:[00000030h] 15_2_04F6AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6AE73 mov eax, dword ptr fs:[00000030h] 15_2_04F6AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6AE73 mov eax, dword ptr fs:[00000030h] 15_2_04F6AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500138A mov eax, dword ptr fs:[00000030h] 15_2_0500138A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5766D mov eax, dword ptr fs:[00000030h] 15_2_04F5766D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FFB260 mov eax, dword ptr fs:[00000030h] 15_2_04FFB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FFB260 mov eax, dword ptr fs:[00000030h] 15_2_04FFB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05015BA5 mov eax, dword ptr fs:[00000030h] 15_2_05015BA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FD4257 mov eax, dword ptr fs:[00000030h] 15_2_04FD4257
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49240 mov eax, dword ptr fs:[00000030h] 15_2_04F49240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49240 mov eax, dword ptr fs:[00000030h] 15_2_04F49240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49240 mov eax, dword ptr fs:[00000030h] 15_2_04F49240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F49240 mov eax, dword ptr fs:[00000030h] 15_2_04F49240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F57E41 mov eax, dword ptr fs:[00000030h] 15_2_04F57E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FFFE3F mov eax, dword ptr fs:[00000030h] 15_2_04FFFE3F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4E620 mov eax, dword ptr fs:[00000030h] 15_2_04F4E620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F84A2C mov eax, dword ptr fs:[00000030h] 15_2_04F84A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F84A2C mov eax, dword ptr fs:[00000030h] 15_2_04F84A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4AA16 mov eax, dword ptr fs:[00000030h] 15_2_04F4AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4AA16 mov eax, dword ptr fs:[00000030h] 15_2_04F4AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F45210 mov eax, dword ptr fs:[00000030h] 15_2_04F45210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F45210 mov ecx, dword ptr fs:[00000030h] 15_2_04F45210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F45210 mov eax, dword ptr fs:[00000030h] 15_2_04F45210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F45210 mov eax, dword ptr fs:[00000030h] 15_2_04F45210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F63A1C mov eax, dword ptr fs:[00000030h] 15_2_04F63A1C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A61C mov eax, dword ptr fs:[00000030h] 15_2_04F7A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A61C mov eax, dword ptr fs:[00000030h] 15_2_04F7A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4C600 mov eax, dword ptr fs:[00000030h] 15_2_04F4C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4C600 mov eax, dword ptr fs:[00000030h] 15_2_04F4C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4C600 mov eax, dword ptr fs:[00000030h] 15_2_04F4C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F78E00 mov eax, dword ptr fs:[00000030h] 15_2_04F78E00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F58A0A mov eax, dword ptr fs:[00000030h] 15_2_04F58A0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05001608 mov eax, dword ptr fs:[00000030h] 15_2_05001608
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F837F5 mov eax, dword ptr fs:[00000030h] 15_2_04F837F5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F703E2 mov eax, dword ptr fs:[00000030h] 15_2_04F703E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6DBE9 mov eax, dword ptr fs:[00000030h] 15_2_04F6DBE9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC53CA mov eax, dword ptr fs:[00000030h] 15_2_04FC53CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC53CA mov eax, dword ptr fs:[00000030h] 15_2_04FC53CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_0500EA55 mov eax, dword ptr fs:[00000030h] 15_2_0500EA55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74BAD mov eax, dword ptr fs:[00000030h] 15_2_04F74BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74BAD mov eax, dword ptr fs:[00000030h] 15_2_04F74BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F74BAD mov eax, dword ptr fs:[00000030h] 15_2_04F74BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F72397 mov eax, dword ptr fs:[00000030h] 15_2_04F72397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F58794 mov eax, dword ptr fs:[00000030h] 15_2_04F58794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018A62 mov eax, dword ptr fs:[00000030h] 15_2_05018A62
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7B390 mov eax, dword ptr fs:[00000030h] 15_2_04F7B390
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7794 mov eax, dword ptr fs:[00000030h] 15_2_04FC7794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7794 mov eax, dword ptr fs:[00000030h] 15_2_04FC7794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FC7794 mov eax, dword ptr fs:[00000030h] 15_2_04FC7794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F51B8F mov eax, dword ptr fs:[00000030h] 15_2_04F51B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F51B8F mov eax, dword ptr fs:[00000030h] 15_2_04F51B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FFD380 mov ecx, dword ptr fs:[00000030h] 15_2_04FFD380
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F73B7A mov eax, dword ptr fs:[00000030h] 15_2_04F73B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F73B7A mov eax, dword ptr fs:[00000030h] 15_2_04F73B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4DB60 mov ecx, dword ptr fs:[00000030h] 15_2_04F4DB60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5FF60 mov eax, dword ptr fs:[00000030h] 15_2_04F5FF60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05010EA5 mov eax, dword ptr fs:[00000030h] 15_2_05010EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05010EA5 mov eax, dword ptr fs:[00000030h] 15_2_05010EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05010EA5 mov eax, dword ptr fs:[00000030h] 15_2_05010EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4F358 mov eax, dword ptr fs:[00000030h] 15_2_04F4F358
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F4DB40 mov eax, dword ptr fs:[00000030h] 15_2_04F4DB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F5EF40 mov eax, dword ptr fs:[00000030h] 15_2_04F5EF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7E730 mov eax, dword ptr fs:[00000030h] 15_2_04F7E730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_05018ED6 mov eax, dword ptr fs:[00000030h] 15_2_05018ED6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F44F2E mov eax, dword ptr fs:[00000030h] 15_2_04F44F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F44F2E mov eax, dword ptr fs:[00000030h] 15_2_04F44F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F6F716 mov eax, dword ptr fs:[00000030h] 15_2_04F6F716
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDFF10 mov eax, dword ptr fs:[00000030h] 15_2_04FDFF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04FDFF10 mov eax, dword ptr fs:[00000030h] 15_2_04FDFF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A70E mov eax, dword ptr fs:[00000030h] 15_2_04F7A70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 15_2_04F7A70E mov eax, dword ptr fs:[00000030h] 15_2_04F7A70E
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\DHL Document.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\DHL Document.exe Code function: 5_2_00409B50 LdrLoadDll, 5_2_00409B50
Source: C:\Users\user\Desktop\DHL Document.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\DHL Document.exe Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: A90000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\DHL Document.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DHL Document.exe Memory written: C:\Users\user\Desktop\DHL Document.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\DHL Document.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\DHL Document.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3440 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL Document.exe Process created: C:\Users\user\Desktop\DHL Document.exe C:\Users\user\Desktop\DHL Document.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Document.exe" Jump to behavior
Source: explorer.exe, 00000008.00000000.442073157.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.430435016.00000000083E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.467254632.00000000083E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.457392051.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.417812385.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.447637801.00000000083E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.439449004.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.516286747.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.416826676.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.457392051.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.515897066.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.417812385.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.456927922.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.439449004.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.438839855.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.516286747.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001B.00000000.591089923.00000000059E0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000000.623101920.00000000059E0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.457392051.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.417812385.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.439449004.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.516286747.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000008.00000000.457392051.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.417812385.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.439449004.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.516286747.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000001B.00000000.616115408.0000000000A58000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman7
Source: explorer.exe, 0000001B.00000003.581864878.0000000004B41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.581966454.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000003.586230135.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanP

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Users\user\Desktop\DHL Document.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Document.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DHL Document.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DHL Document.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3df45d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Document.exe.3d9ddb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.409977263.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.639726248.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487657383.0000000001390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.413926760.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.487435815.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.471020130.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.409332272.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.450790503.000000000DD11000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.638592382.0000000002BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.637724743.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.485734016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562453 Sample: DHL Document.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 30 Found malware configuration 2->30 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus detection for URL or domain 2->34 36 9 other signatures 2->36 10 DHL Document.exe 3 2->10         started        process3 file4 28 C:\Users\user\...\DHL Document.exe.log, ASCII 10->28 dropped 46 Injects a PE file into a foreign processes 10->46 14 DHL Document.exe 10->14         started        signatures5 process6 signatures7 48 Modifies the context of a thread in another process (thread injection) 14->48 50 Maps a DLL or memory area into another process 14->50 52 Sample uses process hollowing technique 14->52 54 Queues an APC in another process (thread injection) 14->54 17 explorer.exe 14->17 injected process8 process9 19 colorcpl.exe 17->19         started        signatures10 38 Self deletion via cmd delete 19->38 40 Modifies the context of a thread in another process (thread injection) 19->40 42 Maps a DLL or memory area into another process 19->42 44 Tries to detect virtualization through RDTSC time measurements 19->44 22 cmd.exe 1 19->22         started        24 explorer.exe 150 19->24         started        process11 process12 26 conhost.exe 22->26         started       
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.floridanratraining.com/how6/ true
  • Avira URL Cloud: malware
 low