Windows Analysis Report
QUOTATION PDF_SCAN_COPY.exe

Overview

General Information

Sample Name:	QUOTATION PDF_SCAN_COPY.exe
Analysis ID:	563220
MD5:	5e9af5b2056e4da639a9459e3b36193c
SHA1:	b779402e9a6ecbbef6b68817814991bbcade12df
SHA256:	35147128936c2e79548e5c0a2bbd70cd5a29c1b01dfa1ac2515fa5becb7efa6d
Tags:	exeformbook
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

Machine Learning detection for sample

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Powershell Defender Exclusion

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Adds a directory exclusion to Windows Defender

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to read the PEB

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Signatures

AV Detection

Found malware configuration

Source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.faireez.club/n2t4/"], "decoy": ["livingthroughthechaos.net", "videobuzzmedia.com", "felineformulas.com", "theorganicbees.com", "bizoeflow.com", "gtbcked.com", "immortalapenft.com", "pacherasrl.com", "defunddrip.black", "fromefarm.com", "newmedicalnetwork.com", "nikosblue.com", "kaecfu.online", "arcane-stylish.com", "7ox.info", "osamaabuzawayed.com", "noemielatour.com", "baccaratjava.com", "latinfoodandwinefestival.com", "magiclandstudios.com", "shazpe.com", "businessmanbazar.com", "lifewithkatiewright.com", "themarketingideascatalog.com", "nickbrizhoops.com", "esportsgamertv.com", "delinointeriores.com", "connotatetechnologies.net", "cybomatic.cloud", "correctmakling.site", "thammydora.com", "ageingwellhomecare.com", "fleetwoodjobshop.site", "jakulo.com", "drbaren.com", "newpointstudio.com", "yxuqamnj.com", "spiritsyncing.net", "hy963app.com", "rnp-trading-lukoil.com", "bowlesuniverse.com", "fumigacionesecouniversal.com", "vulvip.com", "heppi.pro", "preetiplease.com", "gemini-hk.icu", "allyazek24.xyz", "blackbratapparelcompany.com", "immersivenm.com", "mystoragewarehouse.com", "dvjdob.icu", "mecanicadesuelosrancagua.one", "cayugacommunitysolar.com", "parizes.site", "vpsincnas.com", "tattoo-marketplace.online", "garadapatngklgamazon.com", "signa.info", "simplegourmetpa.com", "quintanaroopt.com", "studio-goettingen.com", "brimhi.com", "fabula-glass.com", "1049hubertrd.com"]}

Multi AV Scanner detection for submitted file

Source: QUOTATION PDF_SCAN_COPY.exe	Virustotal: Detection: 42%	Perma Link
Source: QUOTATION PDF_SCAN_COPY.exe	Metadefender: Detection: 29%	Perma Link
Source: QUOTATION PDF_SCAN_COPY.exe	ReversingLabs: Detection: 32%

Yara detected FormBook

Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\KHDScDG.exe	Metadefender: Detection: 29%			Perma Link
Source: C:\Users\user\AppData\Roaming\KHDScDG.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Source: QUOTATION PDF_SCAN_COPY.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\KHDScDG.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance

Uses 32bit PE files

Source: QUOTATION PDF_SCAN_COPY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: QUOTATION PDF_SCAN_COPY.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000003.744424237.0000000000E20000.00000004.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.836130531.00000000010DF000.00000040.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.835752890.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000013.00000002.981500601.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000013.00000002.981764982.00000000035DF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000003.744424237.0000000000E20000.00000004.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.836130531.00000000010DF000.00000040.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.835752890.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000013.00000002.981500601.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000013.00000002.981764982.00000000035DF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wlanext.pdb source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.838690431.00000000030C0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: zrsmwUxCy\src\obj\Debug\Regist.pdb source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745031177.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\lzrsmwUxCy\src\obj\Debug\Regist.pdb source: QUOTATION PDF_SCAN_COPY.exe, KHDScDG.exe.1.dr
Source:	Binary string: wlanext.pdbGCTL source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.838690431.00000000030C0000.00000040.10000000.00040000.00000000.sdmp

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 4x nop then pop edi	11_2_00416CDE
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 4x nop then pop edi	11_2_00417D51
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop edi	19_2_03287D51
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop edi	19_2_03286CDE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.faireez.club/n2t4/

Source: explorer.exe, 0000001A.00000002.976108228.00000000080F2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000000.948419680.00000000080F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.746575972.0000000002B82000.00000004.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745478312.00000000011C7000.00000004.00000020.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.750662294.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2ae091c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2b961c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: QUOTATION PDF_SCAN_COPY.exe
Source: initial sample	Static PE information: Filename: QUOTATION PDF_SCAN_COPY.exe

Uses 32bit PE files

Source: QUOTATION PDF_SCAN_COPY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2ae091c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2b961c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.741535276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.835174756.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.981277393.0000000003270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000000.775484148.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.980171637.0000000000950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.741938582.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000000.794471211.000000000DADA000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.980875419.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.834375246.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.834839904.0000000000B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Detected potential crypto function

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_00774D5B	1_2_00774D5B
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_0116E6B0	1_2_0116E6B0
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_0116C254	1_2_0116C254
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_0116E6A0	1_2_0116E6A0
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_00401030	11_2_00401030
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041E0E3	11_2_0041E0E3
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041DABE	11_2_0041DABE
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_00402D90	11_2_00402D90
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041E640	11_2_0041E640
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_00409E50	11_2_00409E50
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041E61E	11_2_0041E61E
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041D722	11_2_0041D722
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_00402FB0	11_2_00402FB0
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_005A4D5B	11_2_005A4D5B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0350AB40	19_2_0350AB40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B2B28	19_2_035B2B28
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035A03DA	19_2_035A03DA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035ADBD2	19_2_035ADBD2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0351EBB0	19_2_0351EBB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0359FA2B	19_2_0359FA2B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B22AE	19_2_035B22AE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_034EF900	19_2_034EF900
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03504120	19_2_03504120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035A1002	19_2_035A1002
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035BE824	19_2_035BE824
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B28EC	19_2_035B28EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_034FB090	19_2_034FB090
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035120A0	19_2_035120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B20A8	19_2_035B20A8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035BDFCE	19_2_035BDFCE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B1FF1	19_2_035B1FF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035AD616	19_2_035AD616
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03506E30	19_2_03506E30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B2EF7	19_2_035B2EF7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B1D55	19_2_035B1D55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B2D07	19_2_035B2D07
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_034E0D20	19_2_034E0D20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035B25DD	19_2_035B25DD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_034FD5E0	19_2_034FD5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03512581	19_2_03512581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035AD466	19_2_035AD466
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_034F841F	19_2_034F841F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328E0A1	19_2_0328E0A1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328E0BA	19_2_0328E0BA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328E0DB	19_2_0328E0DB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03272FB0	19_2_03272FB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328E61E	19_2_0328E61E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328E640	19_2_0328E640
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03279E50	19_2_03279E50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03272D90	19_2_03272D90

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\wlanext.exe

Code function: String function: 034EB150 appears 48 times

Contains functionality to call native functions

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A350 NtCreateFile,	11_2_0041A350
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A400 NtReadFile,	11_2_0041A400
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A480 NtClose,	11_2_0041A480
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A530 NtAllocateVirtualMemory,	11_2_0041A530
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A34A NtCreateFile,	11_2_0041A34A
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A484 NtClose,	11_2_0041A484
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041A52D NtAllocateVirtualMemory,	11_2_0041A52D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529A50 NtCreateFile,LdrInitializeThunk,	19_2_03529A50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529910 NtAdjustPrivilegesToken,LdrInitializeThunk,	19_2_03529910
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035299A0 NtCreateSection,LdrInitializeThunk,	19_2_035299A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529840 NtDelayExecution,LdrInitializeThunk,	19_2_03529840
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529860 NtQuerySystemInformation,LdrInitializeThunk,	19_2_03529860
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529710 NtQueryInformationToken,LdrInitializeThunk,	19_2_03529710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529FE0 NtCreateMutant,LdrInitializeThunk,	19_2_03529FE0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529780 NtMapViewOfSection,LdrInitializeThunk,	19_2_03529780
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529650 NtQueryValueKey,LdrInitializeThunk,	19_2_03529650
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529660 NtAllocateVirtualMemory,LdrInitializeThunk,	19_2_03529660
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035296D0 NtCreateKey,LdrInitializeThunk,	19_2_035296D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035296E0 NtFreeVirtualMemory,LdrInitializeThunk,	19_2_035296E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529540 NtReadFile,LdrInitializeThunk,	19_2_03529540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035295D0 NtClose,LdrInitializeThunk,	19_2_035295D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529B00 NtSetValueKey,	19_2_03529B00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0352A3B0 NtGetContextThread,	19_2_0352A3B0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529A10 NtQuerySection,	19_2_03529A10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529A00 NtProtectVirtualMemory,	19_2_03529A00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529A20 NtResumeThread,	19_2_03529A20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529A80 NtOpenDirectoryObject,	19_2_03529A80
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529950 NtQueueApcThread,	19_2_03529950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035299D0 NtCreateProcessEx,	19_2_035299D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0352B040 NtSuspendThread,	19_2_0352B040
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529820 NtEnumerateKey,	19_2_03529820
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035298F0 NtReadVirtualMemory,	19_2_035298F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035298A0 NtWriteVirtualMemory,	19_2_035298A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0352A770 NtOpenThread,	19_2_0352A770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529770 NtSetInformationFile,	19_2_03529770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529760 NtOpenProcess,	19_2_03529760
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0352A710 NtOpenProcessToken,	19_2_0352A710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529730 NtQueryVirtualMemory,	19_2_03529730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035297A0 NtUnmapViewOfSection,	19_2_035297A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529670 NtQueryInformationProcess,	19_2_03529670
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529610 NtEnumerateValueKey,	19_2_03529610
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529560 NtWriteFile,	19_2_03529560
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0352AD30 NtSetContextThread,	19_2_0352AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03529520 NtWaitForSingleObject,	19_2_03529520
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_035295F0 NtQueryInformationFile,	19_2_035295F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A350 NtCreateFile,	19_2_0328A350
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A530 NtAllocateVirtualMemory,	19_2_0328A530
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A400 NtReadFile,	19_2_0328A400
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A480 NtClose,	19_2_0328A480
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A34A NtCreateFile,	19_2_0328A34A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A52D NtAllocateVirtualMemory,	19_2_0328A52D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328A484 NtClose,	19_2_0328A484

Sample file is different than original file name gathered from version info

Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.748414866.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.744721256.00000000007F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRegist.exe> vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.751804560.0000000007290000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745031177.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRegist.exe> vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.746575972.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.837055363.000000000126F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000000.740634191.0000000000626000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRegist.exe> vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.836130531.00000000010DF000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000003.745342764.0000000000F3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe, 0000000B.00000002.838741595.00000000030D2000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamewlanext.exej% vs QUOTATION PDF_SCAN_COPY.exe
Source: QUOTATION PDF_SCAN_COPY.exe	Binary or memory string: OriginalFilenameRegist.exe> vs QUOTATION PDF_SCAN_COPY.exe

Source: QUOTATION PDF_SCAN_COPY.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: KHDScDG.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: QUOTATION PDF_SCAN_COPY.exe	Virustotal: Detection: 42%
Source: QUOTATION PDF_SCAN_COPY.exe	Metadefender: Detection: 29%
Source: QUOTATION PDF_SCAN_COPY.exe	ReversingLabs: Detection: 32%

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe

File read: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe:Zone.Identifier

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe "C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe"
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\KHDScDG.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHDScDG" /XML "C:\Users\user\AppData\Local\Temp\tmp2DBB.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\KHDScDG.exe	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHDScDG" /XML "C:\Users\user\AppData\Local\Temp\tmp2DBB.tmp	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process created: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4680:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3220:120:WilError_01

Source: QUOTATION PDF_SCAN_COPY.exe, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: KHDScDG.exe.1.dr, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.0.QUOTATION PDF_SCAN_COPY.exe.770000.0.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.2.QUOTATION PDF_SCAN_COPY.exe.770000.0.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.5a0000.7.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.5a0000.3.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.2.QUOTATION PDF_SCAN_COPY.exe.5a0000.1.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.5a0000.5.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.5a0000.9.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.QUOTATION PDF_SCAN_COPY.exe.5a0000.1.unpack, LineNumberInfo/FormControl.cs	.Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_00773F6D push es; ret	1_2_00773F74
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 1_2_00773F43 push es; retn 0000h	1_2_00773F4A
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_00416971 push 0622FF2Ah; iretd	11_2_0041697B
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041D4F2 push eax; ret	11_2_0041D4F8
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041D4FB push eax; ret	11_2_0041D562
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041D4A5 push eax; ret	11_2_0041D4F8
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_0041D55C push eax; ret	11_2_0041D562
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_005A3F43 push es; retn 0000h	11_2_005A3F4A
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Code function: 11_2_005A3F6D push es; ret	11_2_005A3F74
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0353D0D1 push ecx; ret	19_2_0353D0E4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328DB3B pushfd ; retf	19_2_0328DB41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_03286971 push 0622FF2Ah; iretd	19_2_0328697B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328D55C push eax; ret	19_2_0328D562
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328D4A5 push eax; ret	19_2_0328D4F8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328D4FB push eax; ret	19_2_0328D562
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 19_2_0328D4F2 push eax; ret	19_2_0328D4F8

Source: initial sample	Static PE information: section name: .text entropy: 7.40361532396
Source: initial sample	Static PE information: section name: .text entropy: 7.40361532396

Source: C:\Windows\SysWOW64\wlanext.exe	Process created: /c del "C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe"
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: /c del "C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe"			Jump to behavior

Source: Yara match	File source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2ae091c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.QUOTATION PDF_SCAN_COPY.exe.2b961c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.746575972.0000000002B82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION PDF_SCAN_COPY.exe PID: 6844, type: MEMORYSTR

Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.746575972.0000000002B82000.00000004.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.746575972.0000000002B82000.00000004.00000800.00020000.00000000.sdmp, QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 0000000003279904 second address: 000000000327990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 0000000003279B6E second address: 0000000003279B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe TID: 6840	Thread sleep time: -40434s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe TID: 6992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6452	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7155			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1220			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Thread delayed: delay time: 40434	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 0000001A.00000002.976202611.0000000008135000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000000D.00000000.822859782.0000000004791000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA
Source: explorer.exe, 0000001A.00000002.976202611.0000000008135000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}/
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000001A.00000002.976202611.0000000008135000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.759263988.000000000A897000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 0000001A.00000002.973762856.0000000004514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000001A.00000002.976202611.0000000008135000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000D.00000000.753506570.0000000006650000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.757508985.000000000A60E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001A.00000002.973762856.0000000004514000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 0000000D.00000000.772378889.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 0000001A.00000002.976202611.0000000008135000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}KTOP
Source: explorer.exe, 0000001A.00000000.948419680.00000000080F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000001A.00000000.946402054.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000b
Source: explorer.exe, 0000000D.00000000.751020546.0000000004710000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 0000000D.00000000.772378889.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 0000000D.00000000.760746983.000000000FD2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 63}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&d
Source: explorer.exe, 0000000D.00000000.772627409.000000000A784000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 0000001A.00000002.975771348.0000000007F9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000s
Source: QUOTATION PDF_SCAN_COPY.exe, 00000001.00000002.745531520.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: unknown protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION PDF_SCAN_COPY.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Thread register set: target process: 3424	Jump to behavior

Windows Analysis Report QUOTATION PDF_SCAN_COPY.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted URLs

Windows Analysis Report
QUOTATION PDF_SCAN_COPY.exe

Source: explorer.exe, 0000001A.00000000.933779947.00000000004C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.972145544.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GProgman
Source: explorer.exe, 0000000D.00000000.748886888.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.815138402.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.764707107.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 0000000D.00000000.749118501.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.784309872.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.818058710.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.765010768.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000D.00000000.788437587.0000000005E50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.749118501.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.784309872.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.818058710.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.765010768.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001A.00000000.941915708.0000000004890000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.973945756.0000000004890000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000D.00000000.749118501.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.784309872.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.818058710.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.765010768.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001A.00000000.941915708.0000000004890000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.973945756.0000000004890000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000D.00000000.749118501.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.784309872.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.818058710.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.765010768.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000D.00000000.757932990.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.772378889.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd5D
Source: explorer.exe, 0000001A.00000000.939303003.0000000004549000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.918656126.000000000455D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.918996216.000000000455D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.973826164.0000000004549000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanR

ID:	563220
Product:	CloudBasic
Start time:	12:05:21
Start date:	31.01.2022
Sample:	QUOTATION PDF_SCAN_COPY.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5e9af5b2056e4da639a9459e3b36193c
SHA1:	b779402e9a6ecbbef6b68817814991bbcade12df
SHA256:	35147128936c2e79548e5c0a2bbd70cd5a29c1b01dfa1ac2515fa5becb7efa6d
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION PDF_SCAN_COPY.exe.log	ASCII text, with CRLF line terminators	FED34146BF2F2FA59DCF8702FCC8232E	B03BFEA175989D989850CF06FE5E7BBF56EAA00A	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	147498DB6C549710962BB6C1304E855E	7E5441D88801C466BC4A037E50D47D499BBA4EC9	858A4B512D4D9DF5E6A33FC26E8252C55BD267AF3BD56CE0781F3DBE4A773767
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0flfqeem.c1z.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0feqvz4.jvk.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmp2DBB.tmp	XML 1.0 document, ASCII text	AA21016D90C92A78024FA66167B4D7BE	97BF86E124F859760C7F463BEBF1A3E4FDDBE7D2	4F335E7DCD45F9C9295CA77E3071616BB592079059D0B0C93B474A20418C25BE
C:\Users\user\AppData\Roaming\KHDScDG.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	5E9AF5B2056E4DA639A9459E3B36193C	B779402E9A6ECBBEF6B68817814991BBCADE12DF	35147128936C2E79548E5C0A2BBD70CD5A29C1B01DFA1AC2515FA5BECB7EFA6D
C:\Users\user\AppData\Roaming\KHDScDG.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20220131\PowerShell_transcript.320946.ooSQevcZ.20220131120650.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	05E8711C62306DB9A0825BBF92E3E028	791C41350092092FA293623F35C70CD0B97EEC59	206403375AA38891911139183B7C118D025435E764A968E8114BA90646B34E9C