Windows Analysis Report
Ordene 501527,pdf.exe

Overview

General Information

Sample Name: Ordene 501527,pdf.exe
Analysis ID: 680367
MD5: 5162b6782f86f1f24e8610544d159ae9
SHA1: 0d1ead84c74ee462976928783c1f733aa859bc94
SHA256: 6730e52c8075c7e044c2bbaf9f7ad8c0f7f8d03fb23adbd2331adc8b591caec7
Tags: exe
Infos:

Detection

GuLoader
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Stores files to the Windows start menu directory
PE / OLE file has an invalid certificate
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality for read data from the clipboard

Classification

Uses 32bit PE files
Source: Ordene 501527,pdf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Ordene 501527,pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.0.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.0.dr
Source: Binary string: Microsoft.Office.Tools.Common.v9.0.pdb source: Microsoft.Office.Tools.Common.v9.0.dll.0.dr
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_0040596D
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_004065A2 FindFirstFileW,FindClose, 0_2_004065A2
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00402862 FindFirstFileW, 0_2_00402862
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Ordene 501527,pdf.exe String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://s.symcd.com06
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: FanControlWrapper.dll.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/cps0%
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/rpa0
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/rpa0.
Source: FanControlWrapper.dll.0.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: FanControlWrapper.dll.0.dr String found in binary or memory: https://www.globalsign.com/repository/0
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00405402 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405402
Uses 32bit PE files
Source: Ordene 501527,pdf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Sample file is different than original file name gathered from version info
Source: Ordene 501527,pdf.exe, 00000000.00000002.669383228.0000000000789000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMicrosoft.Office.Tools.Common.v9.0.dlll% vs Ordene 501527,pdf.exe
PE file contains strange resources
Source: Ordene 501527,pdf.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403350
Detected potential crypto function
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00404C3F 0_2_00404C3F
PE / OLE file has an invalid certificate
Source: Ordene 501527,pdf.exe Static PE information: invalid certificate
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File read: C:\Users\user\Desktop\Ordene 501527,pdf.exe Jump to behavior
Source: Ordene 501527,pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403350
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Local\Temp\nsfE849.tmp Jump to behavior
Source: classification engine Classification label: mal52.troj.evad.winEXE@1/5@0/0
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_004020FE CoCreateInstance, 0_2_004020FE
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_004046C3 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004046C3
Source: Ordene 501527,pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.0.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.0.dr
Source: Binary string: Microsoft.Office.Tools.Common.v9.0.pdb source: Microsoft.Office.Tools.Common.v9.0.dll.0.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.669759237.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_10002DE0 push eax; ret 0_2_10002E0E
PE file contains sections with non-standard names
Source: FanControlWrapper.dll.0.dr Static PE information: section name: .nep
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_10001B18
Drops PE files
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Local\Temp\nshB62A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven\vrkstedsbygninger Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven\vrkstedsbygninger\Ricciaceae185.Inc Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\edit-cut-symbolic.svg Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe RDTSC instruction interceptor: First address: 0000000002E0057D second address: 0000000002E0057D instructions: 0x00000000 rdtsc 0x00000002 test ah, dh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F971C9F8BF8h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_0040596D
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_004065A2 FindFirstFileW,FindClose, 0_2_004065A2
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00402862 FindFirstFileW, 0_2_00402862
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_10001B18
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 0_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403350
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680367 Sample: Ordene 501527,pdf.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 52 14 Yara detected GuLoader 2->14 16 Tries to detect virtualization through RDTSC time measurements 2->16 5 Ordene 501527,pdf.exe 32 2->5         started        process3 file4 8 C:\...\Microsoft.Office.Tools.Common.v9.0.dll, PE32 5->8 dropped 10 C:\Users\user\...\FanControlWrapper.dll, PE32+ 5->10 dropped 12 C:\Users\user\AppData\Local\...\System.dll, PE32 5->12 dropped
⊘No contacted IP infos