Edit tour

Windows Analysis Report
DHL_29028263 documento de recibo de la compra,pdf.exe

Overview

General Information

Sample Name:	DHL_29028263 documento de recibo de la compra,pdf.exe
Analysis ID:	626596
MD5:	87a264aa9aec9ce66f4b092363dd5adc
SHA1:	64a0954e622afb6d5e2a0256f179d14f112ec723
SHA256:	eab5b352e41de89be099054e396f61a942401ab1518186496bc11be1c857242f
Tags:	AveMariaRATDHLexeRAT
Infos:

Detection

AveMaria, UACMe

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected UACMe UAC Bypass tool

Yara detected AveMaria stealer

Multi AV Scanner detection for dropped file

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Increases the number of concurrent connection per server for Internet Explorer

Contains functionality to hide user accounts

Contains functionality to steal e-mail passwords

Machine Learning detection for sample

Allocates memory in foreign processes

Binary or sample is protected by dotNetProtector

Contains functionality to steal Chrome passwords or cookies

Machine Learning detection for dropped file

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Contains functionality to inject threads in other processes

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Contains functionality to create new users

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to enumerate running services

Contains functionality to dynamically determine API calls

Creates processes with suspicious names

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Installs a raw input device (often for capturing keystrokes)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Checks if the current process is being debugged

Contains functionality to retrieve information about pressed keystrokes

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

DHL_29028263 documento de recibo de la compra,pdf.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" MD5: 87A264AA9AEC9CE66F4B092363DD5ADC)

DHL_29028263 documento de recibo de la compra,pdf.exe (PID: 6600 cmdline: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe MD5: 87A264AA9AEC9CE66F4B092363DD5ADC)

cmd.exe (PID: 6632 cmdline: C:\Windows\System32\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2208 cmdline: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 4992 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 6716 cmdline: cmd.exe" /C copy "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" "C:\Users\user\AppData\Roaming\window defender\window defender.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

window defender.exe (PID: 3668 cmdline: C:\Users\user\AppData\Roaming\window defender\window defender.exe MD5: 87A264AA9AEC9CE66F4B092363DD5ADC)

cleanup

Malware Configuration

Threatname: AveMaria

{"C2 url": "37.0.14.197", "port": 1997}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x7c0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x35c8:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x7c0:$c1: Elevation:Administrator!new: 0x35c8:$c1: Elevation:Administrator!new:
00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x18e10:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x18e10:$c1: Elevation:Administrator!new:
00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x7c0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x35c8:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x7c0:$c1: Elevation:Administrator!new: 0x35c8:$c1: Elevation:Administrator!new:
00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1b360:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x37780:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1b360:$c1: Elevation:Administrator!new: 0x37780:$c1: Elevation:Administrator!new:
00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 7092	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 7092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 6600	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 6600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 77 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x2318:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x2318:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x2318:$c1: Elevation:Administrator!new:
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new:
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x2318:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x2318:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x2318:$c1: Elevation:Administrator!new:
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new:
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x17ff0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x17ff0:$c1: Elevation:Administrator!new:
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x138e8:$a1: \Opera Software\Opera Stable\Login Data 0x13c10:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13558:$a3: \Google\Chrome\User Data\Default\Login Data
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x15add:$r1: Classes\Folder\shell\open\command 0x15b00:$k1: DelegateExecute
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x154e4:$s1: RDPClip 0x15bcc:$s2: Grabber 0x156e0:$s3: Ave_Maria Stealer OpenSource 0x157e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x15516:$s5: @\cmd.exe 0x18110:$s6: /n:%temp%\ellocnak.xml 0x18140:$s7: Hey I'm Admin 0x13050:$s8: warzone160
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack	AveMaria_WarZone	unknown	unknown	0x15a30:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1580c:$str2: MsgBox.exe 0x15a9c:$str4: \System32\cmd.exe 0x156e0:$str6: Ave_Maria 0x14f78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14278:$str8: SMTP Password 0x13558:$str11: \Google\Chrome\User Data\Default\Login Data 0x14f44:$str12: \sqlmap.dll 0x17ff0:$str16: Elevation:Administrator!new 0x18110:$str17: /n:%temp%
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new:
3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1d1a0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xd80:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1d1a0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xd80:$c1: Elevation:Administrator!new: 0x1d1a0:$c1: Elevation:Administrator!new:
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x18498:$a1: \Opera Software\Opera Stable\Login Data 0x187c0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x18108:$a3: \Google\Chrome\User Data\Default\Login Data
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x1a68d:$r1: Classes\Folder\shell\open\command 0x1a6b0:$k1: DelegateExecute
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x1a094:$s1: RDPClip 0x1a77c:$s2: Grabber 0x1a290:$s3: Ave_Maria Stealer OpenSource 0x1a390:$s4: \MidgetPorn\workspace\MsgBox.exe 0x1a0c6:$s5: @\cmd.exe 0xea0:$s6: /n:%temp%\ellocnak.xml 0x1d2c0:$s6: /n:%temp%\ellocnak.xml 0xed0:$s7: Hey I'm Admin 0x1d2f0:$s7: Hey I'm Admin 0x17c00:$s8: warzone160
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack	AveMaria_WarZone	unknown	unknown	0x1a5e0:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1a3bc:$str2: MsgBox.exe 0x1a64c:$str4: \System32\cmd.exe 0x1a290:$str6: Ave_Maria 0x19b28:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x18e28:$str8: SMTP Password 0x18108:$str11: \Google\Chrome\User Data\Default\Login Data 0x19af4:$str12: \sqlmap.dll 0xd80:$str16: Elevation:Administrator!new 0x1d1a0:$str16: Elevation:Administrator!new 0xea0:$str17: /n:%temp% 0x1d2c0:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new:
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x167cc:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x13c50:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp%
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x150e8:$a1: \Opera Software\Opera Stable\Login Data 0x15410:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14d58:$a3: \Google\Chrome\User Data\Default\Login Data
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x172dd:$r1: Classes\Folder\shell\open\command 0x17300:$k1: DelegateExecute
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x16ce4:$s1: RDPClip 0x173cc:$s2: Grabber 0x16ee0:$s3: Ave_Maria Stealer OpenSource 0x16fe0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16d16:$s5: @\cmd.exe 0x14850:$s8: warzone160
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack	AveMaria_WarZone	unknown	unknown	0x17230:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1700c:$str2: MsgBox.exe 0x1729c:$str4: \System32\cmd.exe 0x16ee0:$str6: Ave_Maria 0x16778:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x15a78:$str8: SMTP Password 0x14d58:$str11: \Google\Chrome\User Data\Default\Login Data 0x16744:$str12: \sqlmap.dll
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	Codoso_Gh0st_2	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x35610:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x191f0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x35610:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x191f0:$c1: Elevation:Administrator!new: 0x35610:$c1: Elevation:Administrator!new:
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x144e8:$a1: \Opera Software\Opera Stable\Login Data 0x30908:$a1: \Opera Software\Opera Stable\Login Data 0x14810:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x30c30:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x14158:$a3: \Google\Chrome\User Data\Default\Login Data 0x30578:$a3: \Google\Chrome\User Data\Default\Login Data
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x166dd:$r1: Classes\Folder\shell\open\command 0x32afd:$r1: Classes\Folder\shell\open\command 0x16700:$k1: DelegateExecute 0x32b20:$k1: DelegateExecute
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	MALWARE_Win_WarzoneRAT	Detects AveMaria/WarzoneRAT	ditekSHen	0x160e4:$s1: RDPClip 0x32504:$s1: RDPClip 0x167cc:$s2: Grabber 0x32bec:$s2: Grabber 0x162e0:$s3: Ave_Maria Stealer OpenSource 0x32700:$s3: Ave_Maria Stealer OpenSource 0x163e0:$s4: \MidgetPorn\workspace\MsgBox.exe 0x32800:$s4: \MidgetPorn\workspace\MsgBox.exe 0x16116:$s5: @\cmd.exe 0x32536:$s5: @\cmd.exe 0x19310:$s6: /n:%temp%\ellocnak.xml 0x35730:$s6: /n:%temp%\ellocnak.xml 0x19340:$s7: Hey I'm Admin 0x35760:$s7: Hey I'm Admin 0x13c50:$s8: warzone160 0x30070:$s8: warzone160
1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack	AveMaria_WarZone	unknown	unknown	0x16630:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x32a50:$str1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1640c:$str2: MsgBox.exe 0x3282c:$str2: MsgBox.exe 0x1669c:$str4: \System32\cmd.exe 0x32abc:$str4: \System32\cmd.exe 0x162e0:$str6: Ave_Maria 0x32700:$str6: Ave_Maria 0x15b78:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x31f98:$str7: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 0x14e78:$str8: SMTP Password 0x31298:$str8: SMTP Password 0x14158:$str11: \Google\Chrome\User Data\Default\Login Data 0x30578:$str11: \Google\Chrome\User Data\Default\Login Data 0x15b44:$str12: \sqlmap.dll 0x31f64:$str12: \sqlmap.dll 0x191f0:$str16: Elevation:Administrator!new 0x35610:$str16: Elevation:Administrator!new 0x19310:$str17: /n:%temp% 0x35730:$str17: /n:%temp%
Click to see the 160 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack

Malware Configuration Extractor: AveMaria {"C2 url": "37.0.14.197", "port": 1997}

Multi AV Scanner detection for submitted file

Source: DHL_29028263 documento de recibo de la compra,pdf.exe	Virustotal: Detection: 33%			Perma Link
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	ReversingLabs: Detection: 51%

Yara detected AveMaria stealer

Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe

ReversingLabs: Detection: 51%

Machine Learning detection for sample

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe

Joe Sandbox ML: detected

Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	Avira: Label: TR/Redcap.ghjpt

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040B15E lstrlenA,CryptStringToBinaryA,lstrcpyA,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040CAFC CryptUnprotectData,LocalAlloc,LocalFree,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040CC54 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040CCB4 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040A632 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040CF58 LocalAlloc,BCryptDecrypt,LocalFree,

Exploits

Yara detected UACMe UAC Bypass tool

Source: Yara match	File source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 6600, type: MEMORYSTR

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Directory created: C:\Program Files\Microsoft DN1

Jump to behavior

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: DHL_29028263 documento de recibo de la compra,pdf.exe, window defender.exe.10.dr
Source:	Binary string: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr source: DHL_29028263 documento de recibo de la compra,pdf.exe, window defender.exe.10.dr

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00409DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040FF27 FindFirstFileW,FindNextFileW,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0041002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 37.0.14.197

Source: Joe Sandbox View

ASN Name: WKD-ASIE WKD-ASIE

Source: global traffic

TCP traffic: 192.168.2.7:49755 -> 37.0.14.197:1997

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004027D3 URLDownloadToFileW,ShellExecuteW,

Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197
Source: unknown	TCP traffic detected without corresponding DNS query: 37.0.14.197

Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040D0A3 recv,

Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.443037764.00000000013FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004089D5 GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx,

E-Banking Fraud

Yara detected AveMaria stealer

Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL_29028263 documento de recibo de la compra,pdf.exe

Executable has a suspicious name (potential lure to open the executable)

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static file information: Suspicious name

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.3218090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d02b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.0.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.3.DHL_29028263 documento de recibo de la compra,pdf.exe.12d1848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_01370448
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_0137D15C
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_01370438
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00411BF8
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05155760
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_051593CC
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05155750
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0515AE2C
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0515AE90
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0515AEA0
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05150006
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05150040
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05205913
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05200040
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_052157E0
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05200007
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05215766
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_052157D0

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: String function: 004035E5 appears 40 times
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: String function: 00410969 appears 47 times

Source: C:\Windows\SysWOW64\cmd.exe

Process Stats: CPU usage > 98%

Source: DHL_29028263 documento de recibo de la compra,pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: window defender.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DHL_29028263 documento de recibo de la compra,pdf.exe	Virustotal: Detection: 33%
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

File read: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Jump to behavior

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe"
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" "C:\Users\user\AppData\Roaming\window defender\window defender.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\window defender\window defender.exe C:\Users\user\AppData\Roaming\window defender\window defender.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" "C:\Users\user\AppData\Roaming\window defender\window defender.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040F619 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

File created: C:\Users\user\AppData\Roaming\window defender

Jump to behavior

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winEXE@15/3@0/1

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0041290F CoInitialize,CoCreateInstance,VariantInit,CoUninitialize,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040D49C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004120B8 RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4468:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_01

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004130B3 LoadResource,SizeofResource,LockResource,GetTempPathA,GetTempPathA,lstrcatA,lstrcatA,GetTempPathA,lstrcatA,CreateFileA,WriteFile,CloseHandle,wsprintfA,ShellExecuteExA,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

File created: C:\Program Files\Microsoft DN1

Jump to behavior

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Directory created: C:\Program Files\Microsoft DN1

Jump to behavior

Source: DHL_29028263 documento de recibo de la compra,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: DHL_29028263 documento de recibo de la compra,pdf.exe, window defender.exe.10.dr
Source:	Binary string: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr source: DHL_29028263 documento de recibo de la compra,pdf.exe, window defender.exe.10.dr

Data Obfuscation

Binary or sample is protected by dotNetProtector

Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000000.351923499.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000000.351923499.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.441844535.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.441844535.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.414174812.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.414174812.00000000002E2000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.631371888.0000000003293000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.631371888.0000000003293000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: window defender.exe	String found in binary or memory: dotNetProtector
Source: window defender.exe, 00000010.00000000.562468843.0000000000E92000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: dotNetProtector
Source: window defender.exe, 00000010.00000000.562468843.0000000000E92000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: window defender.exe, 00000010.00000002.622503636.0000000000E92000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: dotNetProtector
Source: window defender.exe, 00000010.00000002.622503636.0000000000E92000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: dotNetProtector
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr
Source: window defender.exe.10.dr	String found in binary or memory: dotNetProtector
Source: window defender.exe.10.dr	String found in binary or memory: ]"oBytesReversedLoGetDynamicILInfoEhCatchEndAddrFieldInfoRuntimeMethodInfoLocalSymInfostartupInfoMemberInfoParameterInfoProcessStartInfoDirectoryInfoNearNegativeZeroSleepsdgpsfgpSetloopinextpFilterApplyPrefixLookupSystem.Linqset_ShowInTaskbarInternalGetNextCharValueMemberset_NumberMagicNumberBuildNumberMD5CryptoServiceProviderTripleDESCryptoServiceProviderMethodBuilderModuleBuilderTypeNameBuilderTypeBuilderAssemblyBuilderSpecialFolderBufferlpBfdsdhsdsdsfufferResourceManagerDomainManagerDebuggerdnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandlerRemoveEventHandlerStrongNameSignerGregorianCalendarHelperICustomAttributeWriterHelperSeqPointsHelperTypeSpecUserget_IsPointerBitConverterSerializationFormatterSet_IsSetterITokenResolverGetTokenForFloorset_RedirectStandardError.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorIntPtrewr

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_002EA91C push edi; retf
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_002E5167 push ecx; retf
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 1_2_002E5B7B pushad ; ret
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_002EA91C push edi; retf
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_002E5167 push ecx; retf
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_002E5B7B pushad ; ret
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00401190 push eax; ret
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00401190 push eax; ret
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_004144B1 push ebp; retf
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00414550 push ebp; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_00E95167 push ecx; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_00E95B7B pushad ; ret
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_00E9A91C push edi; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0520552B pushad ; iretd
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0520A907 push ebx; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0520AF9B push 00000006h; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0520A88C push ebx; retf
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_0520A6CB push cs; iretd
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_05210E7E pushad ; ret
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Code function: 16_2_052154EE pushad ; ret

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040FA42 LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040D418 NetUserAdd,NetLocalGroupAddMembers,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	File created: \dhl_29028263 documento de recibo de la compra,pdf.exe

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\window defender\window defender.exe

Jump to dropped file

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004027D3 URLDownloadToFileW,ShellExecuteW,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040AC0A lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040A6C8 GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040D508 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

File opened: C:\Users\user\Desktop\:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe TID: 2972	Thread sleep count: 48 > 30
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe TID: 2972	Thread sleep time: -48000s >= -30000s
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe TID: 6240	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe TID: 6616	Thread sleep count: 60 > 30
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe TID: 6616	Thread sleep time: -65000s >= -30000s

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00409DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0040FF27 FindFirstFileW,FindNextFileW,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0041002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	API call chain: ExitProcess graph end node

Source: DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.623073837.00000000012A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040FA42 LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_00401085 GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_0041094E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00419172 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00410619 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00410620 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: 8E0000
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: 940000

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 8E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 940000 protect: page read and write

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Thread created: C:\Windows\SysWOW64\cmd.exe EIP: 8E010E

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_00411FD8 RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: 3_2_004079E8 OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" "C:\Users\user\AppData\Roaming\window defender\window defender.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_004118BA InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040F56D AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid,

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe VolumeInformation
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Queries volume information: C:\Users\user\AppData\Roaming\window defender\window defender.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\window defender\window defender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040F93F cpuid

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Code function: 3_2_0040882F GetModuleHandleA,SHGetFolderPathW,lstrcatW,lstrcatW,GetLocalTime,wsprintfW,lstrcatW,CreateFileW,CloseHandle,GetMessageA,TranslateMessage,DispatchMessageA,GetMessageA,

Lowering of HIPS / PFW / Operating System Security Settings

Increases the number of concurrent connection per server for Internet Explorer

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10

Jump to behavior

Stealing of Sensitive Information

Yara detected AveMaria stealer

Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Contains functionality to steal e-mail passwords

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: POP3 Password
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: SMTP Password
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: IMAP Password

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: \Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe	Code function: \Chromium\User Data\Default\Login Data

Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_29028263 documento de recibo de la compra,pdf.exe PID: 6600, type: MEMORYSTR

Remote Access Functionality

Yara detected AveMaria stealer

Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.41435e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DHL_29028263 documento de recibo de la compra,pdf.exe.412b170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 Create Account	1 Access Token Manipulation	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	21 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Endpoint Denial of Service
Default Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	31 Input Capture	1 System Service Discovery	Remote Desktop Protocol	31 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	1 Scheduled Task/Job	421 Process Injection	2 Obfuscated Files or Information	1 Credentials In Files	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Scheduled Task/Job	1 Software Packing	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	421 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Users	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL_29028263 documento de recibo de la compra,pdf.exe	33%	Virustotal		Browse
DHL_29028263 documento de recibo de la compra,pdf.exe	51%	ReversingLabs	ByteCode-MSIL.Trojan.FormBook
DHL_29028263 documento de recibo de la compra,pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\window defender\window defender.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\window defender\window defender.exe	51%	ReversingLabs	ByteCode-MSIL.Trojan.FormBook

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.7.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.13.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.5.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.16.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.2.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.1.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.19.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.11.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.22.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
3.0.DHL_29028263 documento de recibo de la compra,pdf.exe.400000.9.unpack	100%	Avira	TR/Redcap.ghjpt	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
37.0.14.197	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
37.0.14.197	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/syohex/java-simple-mine-sweeperC:	DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, DHL_29028263 documento de recibo de la compra,pdf.exe, 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/syohex/java-simple-mine-sweeper	DHL_29028263 documento de recibo de la compra,pdf.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.0.14.197	unknown	Netherlands		198301	WKD-ASIE	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626596
Start date and time: 14/05/202215:11:11	2022-05-14 15:11:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	DHL_29028263 documento de recibo de la compra,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winEXE@15/3@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 93% (good quality ratio 92.1%) Quality average: 89.1% Quality standard deviation: 18.6%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, fp-vp.azureedge.net, ctldl.windowsupdate.com, arc.msn.com, b-ring.msedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:13:00	Task Scheduler	Run new task: Nafifas path: "C:\Users\user\AppData\Roaming\window defender\window defender.exe"

Process:	C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.356708753875314
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzd
MD5:	3197B1D4714B56F2A6AC9E83761739AE
SHA1:	3B38010F0DF51C1D4D2C020138202DABB686741D
SHA-256:	40586572180B85042FEFED9F367B43831C5D269751D9F3940BBC29B41E18E9F6
SHA-512:	58EC975A53AD9B19B425F6C6843A94CC280F794D436BBF3D29D8B76CA1E8C2D8883B3E754F9D4F2C9E9387FE88825CCD9919369A5446B1AFF73EDBE07FA94D88
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\window defender\window defender.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	411136
Entropy (8bit):	6.317346244576242
Encrypted:	false
SSDEEP:	6144:fTMhHqjnw6E7SHrJxLY19rS/heoPYtO2LXQOuh23Ta7UEbS2RuLmDtzJ:rsH6E7GPw01YUwsf7UwuLmDtzJ
MD5:	87A264AA9AEC9CE66F4B092363DD5ADC
SHA1:	64A0954E622AFB6D5E2A0256F179D14F112EC723
SHA-256:	EAB5B352E41DE89BE099054E396F61A942401AB1518186496BC11BE1C857242F
SHA-512:	C427A4F1822EB62B75AA346FA891A69F6A712FABAF7C126BC51D49729226EE92A0EB8DAAB649CAAE96E77EC95F415771B2EDF60CA4FDB3A6F56C65F82C33695C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.~b................................. ........@.. ...............................$....@.....................................O.......B............................................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc...............D..............@..B........................H.......p...,.......9....9................................................(......,.~&...(....&~'...rMK.p(....~'...r]K.p(......-.(....&2~.....(......(.......{......{....:~.......(......{......{....:~.......(......{....6~......(......{......{......{......(.......#.%.L...A#...V...A(w...X(r...Zeff. .;.. ..6`aiZ}......{......{.....~....(......{....B.(......ee}......{.....~....(......{......{......{.....~,...(......{....*....0...............#.......@#

C:\Users\user\AppData\Roaming\window defender\window defender.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.317346244576242
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	DHL_29028263 documento de recibo de la compra,pdf.exe
File size:	411136
MD5:	87a264aa9aec9ce66f4b092363dd5adc
SHA1:	64a0954e622afb6d5e2a0256f179d14f112ec723
SHA256:	eab5b352e41de89be099054e396f61a942401ab1518186496bc11be1c857242f
SHA512:	c427a4f1822eb62b75aa346fa891a69f6a712fabaf7c126bc51d49729226ee92a0eb8daab649caae96e77ec95f415771b2edf60ca4fdb3a6f56c65f82c33695c
SSDEEP:	6144:fTMhHqjnw6E7SHrJxLY19rS/heoPYtO2LXQOuh23Ta7UEbS2RuLmDtzJ:rsH6E7GPw01YUwsf7UwuLmDtzJ
TLSH:	DB94EB9C7B410E72ED2D913845130A24BB620EB36A44998557CB3DC987FEAFD1F05E8B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.~b................................. ........@.. ...............................$....@................................

File Icon


Icon Hash:	d9b7c5d1c5c9c1c3

Static PE Info

General

Entrypoint:	0x45c4ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x627E2E4D [Fri May 13 10:09:17 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c49c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x9b42	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5a4f4	0x5a600	False	0.519050397649	data	6.258266814	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x5e000	0x9b42	0x9c00	False	0.51519931891	data	6.01042834164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x68000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AAKMS	0x5f9a4	0xd	ASCII text, with no line terminators	English	United States
ABDAA	0x5f9b4	0xd	ASCII text, with no line terminators	English	United States
AHDLM	0x5f9c4	0xd	ASCII text, with no line terminators	English	United States
AKOMH	0x5f9d4	0xd	ASCII text, with no line terminators	English	United States
AMMMI	0x5f9e4	0xd	ASCII text, with no line terminators	English	United States
ANEMF	0x5f9f4	0xd	ASCII text, with no line terminators	English	United States
ANKOM	0x5fa04	0xd	ASCII text, with no line terminators	English	United States
ARIIL	0x5fa14	0xd	ASCII text, with no line terminators	English	United States
BKAMK	0x5fa24	0xd	ASCII text, with no line terminators	English	United States
BKDCA	0x5fa34	0xd	ASCII text, with no line terminators	English	United States
BNCDG	0x5fa44	0xd	ASCII text, with no line terminators	English	United States
CMDAB	0x5fa54	0xd	ASCII text, with no line terminators	English	United States
CMRRI	0x5fa64	0xd	ASCII text, with no line terminators	English	United States
CRKLI	0x5fa74	0xd	ASCII text, with no line terminators	English	United States
DCANJ	0x5fa84	0xd	ASCII text, with no line terminators	English	United States
DEBAM	0x5fa94	0xd	ASCII text, with no line terminators	English	United States
DIMDA	0x5faa4	0xd	ASCII text, with no line terminators	English	United States
DJFFF	0x5fab4	0xd	ASCII text, with no line terminators	English	United States
DMFMH	0x5fac4	0xd	ASCII text, with no line terminators	English	United States
DOPDK	0x5fad4	0xd	ASCII text, with no line terminators	English	United States
EFMDR	0x5fae4	0xd	ASCII text, with no line terminators	English	United States
ENBPG	0x5faf4	0xd	ASCII text, with no line terminators	English	United States
FDENR	0x5fb04	0xd	ASCII text, with no line terminators	English	United States
FDKIK	0x5fb14	0xd	ASCII text, with no line terminators	English	United States
FHDFS	0x5fb24	0xd	ASCII text, with no line terminators	English	United States
FNBFO	0x5fb34	0xd	ASCII text, with no line terminators	English	United States
FOJMK	0x5fb44	0xd	ASCII text, with no line terminators	English	United States
FRADI	0x5fb54	0xd	ASCII text, with no line terminators	English	United States
GAIPJ	0x5fb64	0xd	ASCII text, with no line terminators	English	United States
GFIPH	0x5fb74	0xd	ASCII text, with no line terminators	English	United States
GMFMI	0x5fb84	0xd	ASCII text, with no line terminators	English	United States
GPIFK	0x5fb94	0xd	ASCII text, with no line terminators	English	United States
HKDBJ	0x5fba4	0xd	ASCII text, with no line terminators	English	United States
HMMEG	0x5fbb4	0xd	ASCII text, with no line terminators	English	United States
HPDEG	0x5fbc4	0xd	ASCII text, with no line terminators	English	United States
HRHBL	0x5fbd4	0xd	ASCII text, with no line terminators	English	United States
ICIDF	0x5fbe4	0xd	ASCII text, with no line terminators	English	United States
IFDKF	0x5fbf4	0xd	ASCII text, with no line terminators	English	United States
IFFIF	0x5fc04	0xd	ASCII text, with no line terminators	English	United States
IGKNK	0x5fc14	0xd	ASCII text, with no line terminators	English	United States
IHIMM	0x5fc24	0xd	ASCII text, with no line terminators	English	United States
IKRAM	0x5fc34	0xd	ASCII text, with no line terminators	English	United States
IMDOO	0x5fc44	0xd	ASCII text, with no line terminators	English	United States
IMKJA	0x5fc54	0xd	ASCII text, with no line terminators	English	United States
JAALL	0x5fc64	0xd	ASCII text, with no line terminators	English	United States
JFNMK	0x5fc74	0xd	ASCII text, with no line terminators	English	United States
JGIRF	0x5fc84	0xd	ASCII text, with no line terminators	English	United States
KAEES	0x5fc94	0xd	ASCII text, with no line terminators	English	United States
KAMOL	0x5fca4	0xd	ASCII text, with no line terminators	English	United States
KDNOK	0x5fcb4	0xd	ASCII text, with no line terminators	English	United States
LOALC	0x5fcc4	0xd	ASCII text, with no line terminators	English	United States
LOJLG	0x5fcd4	0xd	ASCII text, with no line terminators	English	United States
LRMBH	0x5fce4	0xd	ASCII text, with no line terminators	English	United States
MFCMI	0x5fcf4	0xd	ASCII text, with no line terminators	English	United States
MGOSL	0x5fd04	0xd	ASCII text, with no line terminators	English	United States
MJPDD	0x5fd14	0xd	ASCII text, with no line terminators	English	United States
MODGK	0x5fd24	0xd	ASCII text, with no line terminators	English	United States
MPIDD	0x5fd34	0xd	ASCII text, with no line terminators	English	United States
NAMDL	0x5fd44	0xd	ASCII text, with no line terminators	English	United States
NKHOD	0x5fd54	0xd	ASCII text, with no line terminators	English	United States
OFCHM	0x5fd64	0xd	ASCII text, with no line terminators	English	United States
OKBKR	0x5fd74	0xd	ASCII text, with no line terminators	English	United States
OMCKE	0x5fd84	0xd	ASCII text, with no line terminators	English	United States
PAEML	0x5fd94	0xd	ASCII text, with no line terminators	English	United States
PGHBJ	0x5fda4	0xd	ASCII text, with no line terminators	English	United States
PKDKB	0x5fdb4	0xd	ASCII text, with no line terminators	English	United States
PKMBI	0x5fdc4	0xd	ASCII text, with no line terminators	English	United States
RGKLE	0x5fdd4	0xd	ASCII text, with no line terminators	English	United States
SALMC	0x5fde4	0xd	ASCII text, with no line terminators	English	United States
SARND	0x5fdf4	0xd	ASCII text, with no line terminators	English	United States
SGBIH	0x5fe04	0xd	ASCII text, with no line terminators	English	United States
SPRMM	0x5fe14	0xd	ASCII text, with no line terminators	English	United States
RT_ICON	0x5fe24	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x6028c	0x988	data
RT_ICON	0x60c14	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294769916, next used block 4294835709
RT_ICON	0x61cbc	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x64264	0x34ad	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced
RT_GROUP_ICON	0x67714	0x4c	data
RT_VERSION	0x67760	0x1f8	data	English	United States
RT_MANIFEST	0x67958	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
LegalCopyright
FileVersion	, , ,
CompanyName
Comments
ProductName
ProductVersion	, , ,
FileDescription
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 15:13:04.056092978 CEST	49755	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:04.082940102 CEST	1997	49755	37.0.14.197	192.168.2.7
May 14, 2022 15:13:04.670289993 CEST	49755	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:04.695924997 CEST	1997	49755	37.0.14.197	192.168.2.7
May 14, 2022 15:13:05.373480082 CEST	49755	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:05.399058104 CEST	1997	49755	37.0.14.197	192.168.2.7
May 14, 2022 15:13:10.406867981 CEST	49759	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:10.433067083 CEST	1997	49759	37.0.14.197	192.168.2.7
May 14, 2022 15:13:10.967681885 CEST	49759	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:10.993261099 CEST	1997	49759	37.0.14.197	192.168.2.7
May 14, 2022 15:13:11.670934916 CEST	49759	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:11.696858883 CEST	1997	49759	37.0.14.197	192.168.2.7
May 14, 2022 15:13:16.758996964 CEST	49764	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:16.784977913 CEST	1997	49764	37.0.14.197	192.168.2.7
May 14, 2022 15:13:17.374563932 CEST	49764	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:17.400126934 CEST	1997	49764	37.0.14.197	192.168.2.7
May 14, 2022 15:13:18.062067032 CEST	49764	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:18.087609053 CEST	1997	49764	37.0.14.197	192.168.2.7
May 14, 2022 15:13:23.221126080 CEST	49767	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:23.246988058 CEST	1997	49767	37.0.14.197	192.168.2.7
May 14, 2022 15:13:23.765683889 CEST	49767	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:23.791879892 CEST	1997	49767	37.0.14.197	192.168.2.7
May 14, 2022 15:13:24.468888044 CEST	49767	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:24.494963884 CEST	1997	49767	37.0.14.197	192.168.2.7
May 14, 2022 15:13:29.503086090 CEST	49772	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:29.529722929 CEST	1997	49772	37.0.14.197	192.168.2.7
May 14, 2022 15:13:30.156899929 CEST	49772	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:30.182760000 CEST	1997	49772	37.0.14.197	192.168.2.7
May 14, 2022 15:13:30.766243935 CEST	49772	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:30.792093992 CEST	1997	49772	37.0.14.197	192.168.2.7
May 14, 2022 15:13:35.801711082 CEST	49775	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:35.827675104 CEST	1997	49775	37.0.14.197	192.168.2.7
May 14, 2022 15:13:36.376149893 CEST	49775	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:36.401798010 CEST	1997	49775	37.0.14.197	192.168.2.7
May 14, 2022 15:13:37.063730955 CEST	49775	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:37.089828968 CEST	1997	49775	37.0.14.197	192.168.2.7
May 14, 2022 15:13:42.097322941 CEST	49776	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:42.123228073 CEST	1997	49776	37.0.14.197	192.168.2.7
May 14, 2022 15:13:42.673525095 CEST	49776	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:42.700122118 CEST	1997	49776	37.0.14.197	192.168.2.7
May 14, 2022 15:13:43.376730919 CEST	49776	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:43.403115034 CEST	1997	49776	37.0.14.197	192.168.2.7
May 14, 2022 15:13:48.413826942 CEST	49779	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:48.439472914 CEST	1997	49779	37.0.14.197	192.168.2.7
May 14, 2022 15:13:48.970900059 CEST	49779	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:48.996689081 CEST	1997	49779	37.0.14.197	192.168.2.7
May 14, 2022 15:13:49.658581972 CEST	49779	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:49.684767962 CEST	1997	49779	37.0.14.197	192.168.2.7
May 14, 2022 15:13:54.709506989 CEST	49786	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:54.735519886 CEST	1997	49786	37.0.14.197	192.168.2.7
May 14, 2022 15:13:55.268349886 CEST	49786	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:55.294430971 CEST	1997	49786	37.0.14.197	192.168.2.7
May 14, 2022 15:13:55.971503019 CEST	49786	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:13:55.997323990 CEST	1997	49786	37.0.14.197	192.168.2.7
May 14, 2022 15:14:01.001420021 CEST	49788	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:01.027152061 CEST	1997	49788	37.0.14.197	192.168.2.7
May 14, 2022 15:14:01.674514055 CEST	49788	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:01.700834036 CEST	1997	49788	37.0.14.197	192.168.2.7
May 14, 2022 15:14:02.274871111 CEST	49788	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:02.300708055 CEST	1997	49788	37.0.14.197	192.168.2.7
May 14, 2022 15:14:07.310281038 CEST	49791	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:07.336261988 CEST	1997	49791	37.0.14.197	192.168.2.7
May 14, 2022 15:14:07.875304937 CEST	49791	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:07.901042938 CEST	1997	49791	37.0.14.197	192.168.2.7
May 14, 2022 15:14:08.463462114 CEST	49791	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:08.489412069 CEST	1997	49791	37.0.14.197	192.168.2.7
May 14, 2022 15:14:14.789881945 CEST	49795	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:14.816304922 CEST	1997	49795	37.0.14.197	192.168.2.7
May 14, 2022 15:14:15.470901966 CEST	49795	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:15.496644020 CEST	1997	49795	37.0.14.197	192.168.2.7
May 14, 2022 15:14:16.158397913 CEST	49795	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:16.183933973 CEST	1997	49795	37.0.14.197	192.168.2.7
May 14, 2022 15:14:21.192248106 CEST	49798	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:21.218460083 CEST	1997	49798	37.0.14.197	192.168.2.7
May 14, 2022 15:14:21.863154888 CEST	49798	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:21.888931036 CEST	1997	49798	37.0.14.197	192.168.2.7
May 14, 2022 15:14:22.472081900 CEST	49798	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:22.497839928 CEST	1997	49798	37.0.14.197	192.168.2.7
May 14, 2022 15:14:27.504615068 CEST	49801	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:27.530740976 CEST	1997	49801	37.0.14.197	192.168.2.7
May 14, 2022 15:14:28.081301928 CEST	49801	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:28.107630968 CEST	1997	49801	37.0.14.197	192.168.2.7
May 14, 2022 15:14:28.768841028 CEST	49801	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:28.794717073 CEST	1997	49801	37.0.14.197	192.168.2.7
May 14, 2022 15:14:34.069231987 CEST	49802	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:34.095155001 CEST	1997	49802	37.0.14.197	192.168.2.7
May 14, 2022 15:14:34.675590992 CEST	49802	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:34.701366901 CEST	1997	49802	37.0.14.197	192.168.2.7
May 14, 2022 15:14:35.363176107 CEST	49802	1997	192.168.2.7	37.0.14.197
May 14, 2022 15:14:35.388854980 CEST	1997	49802	37.0.14.197	192.168.2.7

Target ID:	1
Start time:	15:12:22
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe"
Imagebase:	0x2e0000
File size:	411136 bytes
MD5 hash:	87A264AA9AEC9CE66F4B092363DD5ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000002.447136668.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000002.447222285.0000000004129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: DHL_29028263 documento de recibo de la compra,pdf.exePID: 6600, Parent PID: 7092

General

Target ID:	3
Start time:	15:12:51
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe
Imagebase:	0x2e0000
File size:	411136 bytes
MD5 hash:	87A264AA9AEC9CE66F4B092363DD5ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000000.417195755.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.416591236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000000.416662895.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.417147497.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000003.431594632.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.426962811.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.431623764.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000002.622879575.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.431671478.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000003.426948480.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.431567861.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000000.418334237.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.418265932.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000002.622706566.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000003.00000000.417884328.000000000054F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.415418870.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.426786774.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.415889492.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: AveMaria_WarZone, Description: unknown, Source: 00000003.00000000.417779464.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.431652682.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000003.00000003.424810982.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: cmd.exePID: 2208, Parent PID: 7092

General

Target ID:	6
Start time:	15:12:54
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 4468, Parent PID: 2208

General

Target ID:	7
Start time:	15:12:55
Start date:	14/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7bab80000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 4992, Parent PID: 2208

General

Target ID:	8
Start time:	15:12:56
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\window defender\window defender.exe'" /f
Imagebase:	0x7ff7e8070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 6632, Parent PID: 6600

General

Target ID:	9
Start time:	15:13:00
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 6716, Parent PID: 7092

General

Target ID:	10
Start time:	15:13:00
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe" /C copy "C:\Users\user\Desktop\DHL_29028263 documento de recibo de la compra,pdf.exe" "C:\Users\user\AppData\Roaming\window defender\window defender.exe
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 6892, Parent PID: 6632

General

Target ID:	12
Start time:	15:13:01
Start date:	14/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7bab80000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 7084, Parent PID: 6716

General

Target ID:	13
Start time:	15:13:02
Start date:	14/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7bab80000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: window defender.exePID: 3668, Parent PID: 1108

General

Target ID:	16
Start time:	15:14:00
Start date:	14/05/2022
Path:	C:\Users\user\AppData\Roaming\window defender\window defender.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\window defender\window defender.exe
Imagebase:	0xe90000
File size:	411136 bytes
MD5 hash:	87A264AA9AEC9CE66F4B092363DD5ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	AWS CloudTrail logs, Authentication logs, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.
Tactics:	Defense Evasion
Data Sources:	Authentication logs, File monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL_29028263 documento de recibo de la compra,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AveMaria

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_29028263 documento de recibo de la compra,pdf.exe.log

C:\Users\user\AppData\Roaming\window defender\window defender.exe

C:\Users\user\AppData\Roaming\window defender\window defender.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
DHL_29028263 documento de recibo de la compra,pdf.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposesand to support other malicious activities, including distraction, hacktivism, and extortion.
Tactics:	Impact
Data Sources:	Netflow/Enclave netflow, Network device logs, Network intrusion detection system, Network protocol analysis, SSL/TLS inspection, Web application firewall logs, Web logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre