Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:623387
MD5:2beb53482de8f6a713deb6fa9f9e7267
SHA1:0959ea9b1697d980da699f8375f91ca1df8e0f56
SHA256:7ac7845621113c87e927eb2b582af6f1809e4866e4ee0f089dd1c6ab0042dd27
Tags:exe
Infos:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
PE / OLE file has an invalid certificate
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Abnormal high CPU Usage
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2BEB53482DE8F6A713DEB6FA9F9E7267)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://msdvc.com/oluwa_RcQBQnZSyJ230.bin"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.784726043.00000000030B0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Found malware configuration
    Source: 00000000.00000002.784726043.00000000030B0000.00000040.00001000.00020000.00000000.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://msdvc.com/oluwa_RcQBQnZSyJ230.bin"}
    Multi AV Scanner detection for submitted file
    Source: file.exeVirustotal: Detection: 26%Perma Link
    Source: file.exeReversingLabs: Detection: 21%
    Antivirus detection for URL or domain
    Source: https://msdvc.com/oluwa_RcQBQnZSyJ230.binAvira URL Cloud: Label: malware
    Multi AV Scanner detection for domain / URL
    Source: https://msdvc.com/oluwa_RcQBQnZSyJ230.binVirustotal: Detection: 5%Perma Link
    Source: file.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: file.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
    Source: Binary string: D:\SourceCode\ScenarioProfile\production_V4.2\ScenarioProfileFrameWork\Service\Config_Editor\obj\Release\ConfigXML_ScenarioProfile.pdb, source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.dr
    Source: Binary string: D:\SourceCode\ScenarioProfile\production_V4.2\ScenarioProfileFrameWork\Service\Config_Editor\obj\Release\ConfigXML_ScenarioProfile.pdb source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.dr
    Source: Binary string: MsMpCom.pdb source: file.exe, 00000000.00000002.783091463.000000000040A000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.261521429.00000000027ED000.00000004.00000800.00020000.00000000.sdmp, MsMpCom.dll.0.dr
    Source: Binary string: MsMpCom.pdbGCTL source: file.exe, 00000000.00000002.783091463.000000000040A000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.261521429.00000000027ED000.00000004.00000800.00020000.00000000.sdmp, MsMpCom.dll.0.dr
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040683D FindFirstFileW,FindClose,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040290B FindFirstFileW,

    Networking

    barindex
    C2 URLs / IPs found in malware configuration
    Source: Malware configuration extractorURLs: https://msdvc.com/oluwa_RcQBQnZSyJ230.bin
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl.globalsign.com/root.crl0G
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: file.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://ocsp.digicert.com0O
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://ocsp.globalsign.com/rootr103
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: https://www.digicert.com/CPS0
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.drString found in binary or memory: https://www.globalsign.com/repository/0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004056A8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,
    Source: file.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameConfigXML_ScenarioProfile.dllT vs file.exe
    Source: file.exe, 00000000.00000003.261521429.00000000027ED000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpCom.dllj% vs file.exe
    Source: file.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00406BFE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_72E61BFF
    Source: file.exeStatic PE information: invalid certificate
    Source: C:\Users\user\Desktop\file.exeProcess Stats: CPU usage > 98%
    Source: file.exeVirustotal: Detection: 26%
    Source: file.exeReversingLabs: Detection: 21%
    Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
    Source: file.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nssEAB6.tmpJump to behavior
    Source: classification engineClassification label: mal88.troj.evad.winEXE@1/6@0/0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004021AA CoCreateInstance,
    Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404954 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,
    Source: file.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
    Source: Binary string: D:\SourceCode\ScenarioProfile\production_V4.2\ScenarioProfileFrameWork\Service\Config_Editor\obj\Release\ConfigXML_ScenarioProfile.pdb, source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.dr
    Source: Binary string: D:\SourceCode\ScenarioProfile\production_V4.2\ScenarioProfileFrameWork\Service\Config_Editor\obj\Release\ConfigXML_ScenarioProfile.pdb source: file.exe, 00000000.00000003.260908380.00000000027E8000.00000004.00000800.00020000.00000000.sdmp, ConfigXML_ScenarioProfile.dll.0.dr
    Source: Binary string: MsMpCom.pdb source: file.exe, 00000000.00000002.783091463.000000000040A000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.261521429.00000000027ED000.00000004.00000800.00020000.00000000.sdmp, MsMpCom.dll.0.dr
    Source: Binary string: MsMpCom.pdbGCTL source: file.exe, 00000000.00000002.783091463.000000000040A000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.261521429.00000000027ED000.00000004.00000800.00020000.00000000.sdmp, MsMpCom.dll.0.dr

    Data Obfuscation

    barindex
    Yara detected GuLoader
    Source: Yara matchFile source: 00000000.00000002.784726043.00000000030B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_72E630C0 push eax; ret
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_72E61BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,
    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\MsMpCom.dllJump to dropped file
    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\ConfigXML_ScenarioProfile.dllJump to dropped file
    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsaF229.tmp\System.dllJump to dropped file
    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Tries to detect virtualization through RDTSC time measurements
    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000030BD9E3 second address: 00000000030BD9E3 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FD358363427h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 cmp ax, dx 0x0000000b rdtsc
    Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MsMpCom.dllJump to dropped file
    Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ConfigXML_ScenarioProfile.dllJump to dropped file
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040683D FindFirstFileW,FindClose,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040290B FindFirstFileW,
    Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end node
    Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end node
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_72E61BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts1
    Native API    		Path Interception1
    Access Token Manipulation    		1
    Access Token Manipulation    		OS Credential Dumping1
    Security Software Discovery    		Remote Services1
    Archive Collected Data    		Exfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    System Shutdown/Reboot
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    Obfuscated Files or Information    		LSASS Memory2
    File and Directory Discovery    		Remote Desktop Protocol1
    Clipboard Data    		Exfiltration Over Bluetooth1
    Application Layer Protocol    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager13
    System Information Discovery    		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    file.exe26%VirustotalBrowse
    file.exe22%ReversingLabsWin32.Downloader.GuLoader

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\ConfigXML_ScenarioProfile.dll0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\ConfigXML_ScenarioProfile.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MsMpCom.dll0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\MsMpCom.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\nsaF229.tmp\System.dll0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\nsaF229.tmp\System.dll0%MetadefenderBrowse
    C:\Users\user\AppData\Local\Temp\nsaF229.tmp\System.dll0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://msdvc.com/oluwa_RcQBQnZSyJ230.bin5%VirustotalBrowse
    https://msdvc.com/oluwa_RcQBQnZSyJ230.bin100%Avira URL Cloudmalware

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    https://msdvc.com/oluwa_RcQBQnZSyJ230.bintrue
    • 5%, Virustotal, Browse
    • Avira URL Cloud: malware
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://nsis.sf.net/NSIS_ErrorErrorfile.exefalse
      		high

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox Version:34.0.0 Boulder Opal
      Analysis ID:623387
      Start date and time: 10/05/202213:14:282022-05-10 13:14:28 +02:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 7m 31s
      Hypervisor based Inspection enabled:false
      Report type:light
      Sample file name:file.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:19
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal88.troj.evad.winEXE@1/6@0/0
      EGA Information:
      • Successful, ratio: 100%
      HDC Information:
      • Successful, ratio: 85.8% (good quality ratio 84.6%)
      • Quality average: 87.5%
      • Quality standard deviation: 21.4%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Adjust boot time
      • Enable AMSI
      • Override analysis time to 240s for sample files taking high CPU consumption

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 52.242.101.226, 20.54.89.106, 20.223.24.244
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
      • Not all processes where analyzed, report is missing behavior information

      Simulations

      Behavior and APIs

      ⊘No simulations

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      C:\Users\user\AppData\Local\Temp\Aqua_3.bmp

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
      Category:dropped
      Size (bytes):5004
      Entropy (8bit):7.815894782719166
      Encrypted:false
      SSDEEP:96:BSTzRE92lvCfr4Y6hXqlvrfgAbJyLDLA4S+YrQslx:oXRnlKfrZ6h6lvncASiP
      MD5:12C11AD60C15E44F8297C052CFBAA434
      SHA1:3849A2C99770D1BB104AF27D34DCD95E8B4986A5
      SHA-256:71792E7507EE62E8EBC9BC1230947A8A4E2A5CAC57CD43DF1E379D91F5E3FDA2
      SHA-512:E91B30CFAFD4B651852D4F12E6A3BEF92A528C14C56FD195F6EA5EAF1D82308704BDD7373AA9DD63CE606BB25EAD7A33D29C8B068B843E0F1225177AA2F35E72
      Malicious:false
      Reputation:low
      Preview:......JFIF.....d.d.....:Exif..MM.*......Q...........Q..........aQ..........a.......C....................................................................C.......................................................................n.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(.......|2._......&..?.i...x....o....xCB ..N..'.O..M..FW.o...C....+...,-.....~.............2.[....'..U.._.....]n..T......."....>O.*.Z....j_...&|..............>.;q..B...L?.Mj^.bC..+k....)..M(.......#.G..S....|7.oc:..o............I.g.;]...../..I....U.>.`.:._;...(....]...Y..=.....U'w..o......%.3...

      C:\Users\user\AppData\Local\Temp\ConfigXML_ScenarioProfile.dll

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
      Category:dropped
      Size (bytes):48360
      Entropy (8bit):5.965995469374706
      Encrypted:false
      SSDEEP:768:nd5SYvW5+CSHhidc/bBIa5bEd/w+D0OLzfmIHlsCdcAtpz3bi0M2X9DhH:d5xvFCwoMbGObqw20oBzbv
      MD5:81B2D0C87D9BE5FF6BBC1496BFEDFB4D
      SHA1:25D20CB862DC6690579513F1E9976FC03FC310E3
      SHA-256:B29472664E91D182B26F2BF2BD2171A4ADDB7132417C644DBD2CCE446A86923C
      SHA-512:F5769BF4981ED6E6DBE48D853A4951A800EB010350B3D2F79020CD9C9957EC193CF00BFD146FCB3CCAAE8C4EF2E5A25AA99C9314168EE6F432376CE410B74F7C
      Malicious:false
      Antivirus:
      • Antivirus: Virustotal, Detection: 0%, Browse
      • Antivirus: ReversingLabs, Detection: 0%
      Reputation:low
      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.........." ..0.............V.... ........... ....................................`.....................................O................................................................................... ............... ..H............text...\.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................8.......H.......xX..TZ...........................................................0...........{....o.....{.....6......{.....(....&(.....o......8...o....r...p....+A.......~....(....,....(.....+..r...po....-..{.....o ...r...p...X....i2..{....*.0...........{....o.....{.....6.......{.....(....&(.....o....&(!....o......8...o".....8...o.......+B.....r...po....-7...8...%..=.o.........i.3........{......o .....X....i2..{....*..0.."....... ....s#........ .....(....&.o$...*...0../.......s%...&.r

      C:\Users\user\AppData\Local\Temp\MsMpCom.dll

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
      Category:dropped
      Size (bytes):88912
      Entropy (8bit):5.81677879181799
      Encrypted:false
      SSDEEP:1536:dRN1t8CahRmSzbibA1i552+B4KTeloLYlUY4GCmatsSR4P1:ft8oA1U2+mKTeCWJCmatsSmN
      MD5:B26386F33FAA0FC72A8077622ACC31B8
      SHA1:C9ECDB2123AB56818E999BB24B11A704462B290B
      SHA-256:C469ED974F4CC5DAA6EE7607927D2DE4500EAEAAEE66B267254FE6742F064BEB
      SHA-512:04E91D57F6DA63CB8196163EFD6D5726EE216DF1C649FFDB62E93450B92ED09CBC032DAC3CD62D8FB723AA40E08727784256AF54BC9847C095B6BCBCD0A45AF2
      Malicious:false
      Antivirus:
      • Antivirus: Virustotal, Detection: 0%, Browse
      • Antivirus: ReversingLabs, Detection: 0%
      Reputation:low
      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H.............................................................................i.............Rich............PE..d.../*.$.........." ...........................e.............................p............`A................................................D........@.......0..4....:..P!...`..`.......T.......................(...................................................text...?........................... ..`.rdata...g.......h..................@..@.data...............................@....pdata..4....0......................@..@.rsrc........@......................@..@.reloc..`....`.......6..............@..B................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\Ottawas.bmp

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:PC bitmap, Windows 3.x format, 312 x 145 x 24
      Category:dropped
      Size (bytes):135774
      Entropy (8bit):6.91313068400418
      Encrypted:false
      SSDEEP:1536:GwfOK0U3CPBrtIu5/o0mrtd/Cl+DjS8Bn2C17WQ0SCoTsjwTxvXC0ntc9pKOIa58:LfObUqR2f7WQDTTxvXC0ntceOv7Wp
      MD5:3EEF656CBCA1AD683C0D205B8102AEEB
      SHA1:3601D8AEB56DA26777CFC229EDFB861A572CE78A
      SHA-256:A58CD5F1E7A2D07754798201CC1AC52E2BBC95AB2DA27E6F3556CCF50C719C2F
      SHA-512:F47676C91FD15160FB94C169FB9DC3361FE11F3E6C83AC2C6AFAF213DBAFD5875778C30A259E68CB491AE0EE99FA78EE6F68E60EC3094F4E09F8B83DD047D6CF
      Malicious:false
      Reputation:low
      Preview:BM^.......6...(...8...............(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\nsaF229.tmp\System.dll

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      Category:dropped
      Size (bytes):12288
      Entropy (8bit):5.814115788739565
      Encrypted:false
      SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
      MD5:CFF85C549D536F651D4FB8387F1976F2
      SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
      SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
      SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
      Malicious:false
      Antivirus:
      • Antivirus: Virustotal, Detection: 0%, Browse
      • Antivirus: Metadefender, Detection: 0%, Browse
      • Antivirus: ReversingLabs, Detection: 0%
      Reputation:moderate, very likely benign file
      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\touchpad-disabled-symbolic.svg

      Download File
      Process:C:\Users\user\Desktop\file.exe
      File Type:SVG Scalable Vector Graphics image
      Category:dropped
      Size (bytes):786
      Entropy (8bit):5.0885849275192205
      Encrypted:false
      SSDEEP:12:t4C8glnVOtgVbYc7nz6F0EcWLjD8Gok9kXYJOhz4AeWrGDT2Kd3ztU7jcd/M:t4CjlQ2d7+5f4YLJw4AeWrGDT/nvd0
      MD5:B87E230E52E6179805CA646953B97596
      SHA1:DBE5466CA50A929245C5A09E003392B791A9C075
      SHA-256:D04DC1EDF72A3DE271177575A7F552FB3FFF450D9F1D2A6316D0FC953E78739E
      SHA-512:68572EFFC6200DD8F5395F659686F9C7F33DBF3864E445DC4FD8088A25784E256EAC10B75965B10E03B2B634BD4E0E78A09EBAAFAF5447CA3A00AB0B25DD36F7
      Malicious:false
      Reputation:low
      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">. <g fill="#2e3436">. <path d="M3.031 1a3 3 0 00-1.576.455l1.55 1.55c.01 0 .017-.005.026-.005h8.938C12.565 3 13 3.435 13 4.03V10h-3l1 1h2v.969c0 .298-.11.555-.293.738l1.402 1.402c.55-.549.891-1.306.891-2.14V4.03A3.038 3.038 0 0011.969 1zM.29 2.762C.11 3.149 0 3.577 0 4.032v7.937A3.038 3.038 0 003.031 15h8.938c.173 0 .34-.025.506-.053L10.527 13H8v-2h.527l-1-1H2V4.473zM2 11h5v2H3.031C2.435 13 2 12.565 2 11.969z" style="line-height:normal;-inkscape-font-specification:Sans;text-indent:0;text-align:start;text-decoration-line:none;text-transform:none;marker:none" color="#bebebe" font-weight="400" font-family="Sans" overflow="visible"/>. <path d="M1.531.469L.47 1.53l14 14 1.062-1.062z"/>. </g>.</svg>.

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
      Entropy (8bit):5.79283030166378
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.96%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:file.exe
      File size:562640
      MD5:2beb53482de8f6a713deb6fa9f9e7267
      SHA1:0959ea9b1697d980da699f8375f91ca1df8e0f56
      SHA256:7ac7845621113c87e927eb2b582af6f1809e4866e4ee0f089dd1c6ab0042dd27
      SHA512:0484ee70dc3a77c36c4d6c846f3937cfbf116c4c6b7516e72660bbac8f6b3dcb01dac478c615f08fb180c27018e08ff023f11bdf46ae622b9b188956983c5d3a
      SSDEEP:12288:gNpIr3H1Fwz2KXE+7uAyZDSJSrF1v5/tLDD8W1qpwBaM8Af1:gNpIr3H1Fwz2KXE+7uAyZDcSrF1v5/t7
      TLSH:37C44B284B26D4E5CC8F2DB48C43B29F67922E50BAAD8253D53074E5EBFC366C7A5C11
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................f...*.....

      File Icon

      Icon Hash:00f0f8e0ece07082

      Static PE Info

      General

      Entrypoint:0x4034f7
      Entrypoint Section:.text
      Digitally signed:true
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Time Stamp:0x614F9AE5 [Sat Sep 25 21:55:49 2021 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6

      Authenticode Signature

      Signature Valid:false
      Signature Issuer:CN="TRUISH Metaphysis BINDSAALER COUNTERPLEAD ", O=Countermarching, L=Gask, S=Scotland, C=GB
      Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
      Error Number:-2146762487
      Not Before, Not After
      • 5/9/2022 4:04:21 PM 5/9/2023 4:04:21 PM
      Subject Chain
      • CN="TRUISH Metaphysis BINDSAALER COUNTERPLEAD ", O=Countermarching, L=Gask, S=Scotland, C=GB
      Version:3
      Thumbprint MD5:57E7BC9EC9D1474FF93F627A2D5F313A
      Thumbprint SHA-1:5C39BD33BBB4FB729C0C4634567294D7EDCB29F0
      Thumbprint SHA-256:C47A8A0C3B44E509CE176A357338FD2ADF724FE3389EA91AB0E6AB2804115F92
      Serial:07E4C4F966F11219

      Entrypoint Preview

      Instruction
      push ebp
      mov ebp, esp
      sub esp, 000003F4h
      push ebx
      push esi
      push edi
      push 00000020h
      pop edi
      xor ebx, ebx
      push 00008001h
      mov dword ptr [ebp-14h], ebx
      mov dword ptr [ebp-04h], 0040A2E0h
      mov dword ptr [ebp-10h], ebx
      call dword ptr [004080CCh]
      mov esi, dword ptr [004080D0h]
      lea eax, dword ptr [ebp-00000140h]
      push eax
      mov dword ptr [ebp-0000012Ch], ebx
      mov dword ptr [ebp-2Ch], ebx
      mov dword ptr [ebp-28h], ebx
      mov dword ptr [ebp-00000140h], 0000011Ch
      call esi
      test eax, eax
      jne 00007FD358730B0Ah
      lea eax, dword ptr [ebp-00000140h]
      mov dword ptr [ebp-00000140h], 00000114h
      push eax
      call esi
      mov ax, word ptr [ebp-0000012Ch]
      mov ecx, dword ptr [ebp-00000112h]
      sub ax, 00000053h
      add ecx, FFFFFFD0h
      neg ax
      sbb eax, eax
      mov byte ptr [ebp-26h], 00000004h
      not eax
      and eax, ecx
      mov word ptr [ebp-2Ch], ax
      cmp dword ptr [ebp-0000013Ch], 0Ah
      jnc 00007FD358730ADAh
      and word ptr [ebp-00000132h], 0000h
      mov eax, dword ptr [ebp-00000134h]
      movzx ecx, byte ptr [ebp-00000138h]
      mov dword ptr [0042A2D8h], eax
      xor eax, eax
      mov ah, byte ptr [ebp-0000013Ch]
      movzx eax, ax
      or eax, ecx
      xor ecx, ecx
      mov ch, byte ptr [ebp-2Ch]
      movzx ecx, cx
      shl eax, 10h
      or eax, ecx

      Rich Headers

      Programming Language:
      • [EXP] VC++ 6.0 SP5 build 8804

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x85040xa0.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x480000x58810.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x88f480x688.rsrc
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x65150x6600False0.661534926471data6.43970794855IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .rdata0x80000x139a0x1400False0.45data5.14577456407IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0xa0000x203380x600False0.499348958333data4.01369865045IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .ndata0x2b0000x1d0000x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .rsrc0x480000x588100x58a00False0.0791029398801data4.00672034737IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x483280x42028dBase III DBT, version number 0, next free block index 40EnglishUnited States
      RT_ICON0x8a3500x10828dBase III DBT, version number 0, next free block index 40EnglishUnited States
      RT_ICON0x9ab780x25a8dBase III DBT, version number 0, next free block index 40EnglishUnited States
      RT_ICON0x9d1200x10a8dBase III DBT, version number 0, next free block index 40EnglishUnited States
      RT_ICON0x9e1c80xea8dataEnglishUnited States
      RT_ICON0x9f0700x988dBase III DBT, version number 0, next free block index 40EnglishUnited States
      RT_ICON0x9f9f80x468GLS_BINARY_LSB_FIRSTEnglishUnited States
      RT_DIALOG0x9fe600x100dataEnglishUnited States
      RT_DIALOG0x9ff600x11cdataEnglishUnited States
      RT_DIALOG0xa00800xc4dataEnglishUnited States
      RT_DIALOG0xa01480x60dataEnglishUnited States
      RT_GROUP_ICON0xa01a80x68dataEnglishUnited States
      RT_VERSION0xa02100x2bcdataEnglishUnited States
      RT_MANIFEST0xa04d00x33eXML 1.0 document, ASCII text, with very long lines, with no line terminatorsEnglishUnited States

      Imports

      DLLImport
      ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
      SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
      ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
      COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
      USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
      GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
      KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

      Version Infos

      DescriptionData
      LegalCopyrightAshland Inc.
      FileVersion18.4.12
      CompanyNameCeridian Corp.
      LegalTrademarksEnron Corp.
      CommentsCinergy Corp.
      ProductNameInstallScript Setup Launcher
      FileDescriptionHovnanian Enterprises Inc.
      Translation0x0409 0x04b0

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      ⊘No network behavior found

      Statistics

      ⊘No statistics

      System Behavior

      General

      Target ID:0
      Start time:13:15:36
      Start date:10/05/2022
      Path:C:\Users\user\Desktop\file.exe
      Wow64 process (32bit):true
      Commandline:"C:\Users\user\Desktop\file.exe"
      Imagebase:0x400000
      File size:562640 bytes
      MD5 hash:2BEB53482DE8F6A713DEB6FA9F9E7267
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Yara matches:
      • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.784726043.00000000030B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
      Reputation:low

      Disassembly

      ⊘No disassembly