Edit tour

Windows Analysis Report
inquiry.pdf.exe

Overview

General Information

Sample Name:	inquiry.pdf.exe
Analysis ID:	715157
MD5:	6236e43da1b2c6279760e6b2b7e2d40f
SHA1:	a24221417ff9c0d169bf17b7f242824fe61d3b72
SHA256:	b4056e17199edd889d2b77c02865136c47ab29566717c2f86ae8911c02e2994a
Tags:	exe
Infos:

Detection

AveMaria, DarkTortilla, UACMe

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DarkTortilla Crypter

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected UACMe UAC Bypass tool

Yara detected AveMaria stealer

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Increases the number of concurrent connection per server for Internet Explorer

Contains functionality to hide user accounts

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Injects a PE file into a foreign processes

Uses ping.exe to sleep

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Uses reg.exe to modify the Windows registry

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

inquiry.pdf.exe (PID: 5896 cmdline: C:\Users\user\Desktop\inquiry.pdf.exe MD5: 6236E43DA1B2C6279760E6B2B7E2D40F)

cmd.exe (PID: 2148 cmdline: cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe, MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 612 cmdline: ping 127.0.0.1 -n 7 MD5: 70C24A306F768936563ABDADB9CA9108)

reg.exe (PID: 4684 cmdline: REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe," MD5: CEE2A7E57DF2A159A065A34913A055C2)

cmd.exe (PID: 3272 cmdline: cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\user\Desktop\inquiry.pdf.exe" "C:\Users\user\AppData\Roaming\glonkjhg.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\user\AppData\Roaming\glonkjhg.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 636 cmdline: ping 127.0.0.1 -n 12 MD5: 70C24A306F768936563ABDADB9CA9108)

PING.EXE (PID: 5244 cmdline: ping 127.0.0.1 -n 12 MD5: 70C24A306F768936563ABDADB9CA9108)

glonkjhg.exe (PID: 4760 cmdline: C:\Users\user\AppData\Roaming\glonkjhg.exe MD5: 6236E43DA1B2C6279760E6B2B7E2D40F)

AddInProcess32.exe (PID: 2400 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

AddInProcess32.exe (PID: 1916 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

jhFFFffkl.exe (PID: 4896 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

jhFFFffkl.exe (PID: 6060 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

jhFFFffkl.exe (PID: 4184 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

jhFFFffkl.exe (PID: 3932 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

cleanup

Malware Configuration

Threatname: AveMaria

{"C2 url": "hannoyputa.giize.com", "port": 3027}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000000.404261855.0000000000A54000.00000040.00000400.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xdf0:$c1: Elevation:Administrator!new:
00000013.00000000.404261855.0000000000A54000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1f48:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1f48:$c1: Elevation:Administrator!new:
00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x75e0:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x5dc4:$a2: SMTP Password 0x4e78:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x1f48:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x7530:$a5: for /F "usebackq tokens=*" %%A in (" 0x5850:$a6: \Torch\User Data\Default\Login Data 0x2068:$a7: /n:%temp%\ellocnak.xml 0x63b0:$a8: "os_crypt":{"encrypted_key":" 0x2098:$a9: Hey I'm Admin 0x5c8c:$a10: \logins.json 0x6328:$a11: Accounts\Account.rec0 0x72b8:$a13: Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
00000014.00000003.485580240.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.485580240.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000014.00000003.485580240.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x3480:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x8488:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1c64:$a2: SMTP Password 0x6c6c:$a2: SMTP Password 0xd18:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x5d20:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x33d0:$a5: for /F "usebackq tokens=" %%A in (" 0x83d8:$a5: for /F "usebackq tokens=" %%A in (" 0x16f0:$a6: \Torch\User Data\Default\Login Data 0x66f8:$a6: \Torch\User Data\Default\Login Data 0x2250:$a8: "os_crypt":{"encrypted_key":" 0x7258:$a8: "os_crypt":{"encrypted_key":" 0x1b2c:$a10: \logins.json 0x6b34:$a10: \logins.json 0x21c8:$a11: Accounts\Account.rec0 0x71d0:$a11: Accounts\Account.rec0 0x3158:$a13: Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper 0x8160:$a13: Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
00000012.00000002.520061729.0000000002B9D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.327749606.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x51fda:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x8641a:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xba84a:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x51fda:$c1: Elevation:Administrator!new: 0x8641a:$c1: Elevation:Administrator!new: 0xba84a:$c1: Elevation:Administrator!new:
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000012.00000002.534025112.0000000003C58000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x4f26a:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x836aa:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0xb7ada:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x4da4e:$a2: SMTP Password 0x81e8e:$a2: SMTP Password 0xb62be:$a2: SMTP Password 0x4cb02:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x80f42:$a3: select signon_realm, origin_url, username_value, password_value from logins 0xb5372:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x51fda:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x8641a:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0xba84a:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x4f1ba:$a5: for /F "usebackq tokens=" %%A in (" 0x835fa:$a5: for /F "usebackq tokens=" %%A in (" 0xb7a2a:$a5: for /F "usebackq tokens=*" %%A in (" 0x4d4da:$a6: \Torch\User Data\Default\Login Data 0x8191a:$a6: \Torch\User Data\Default\Login Data 0xb5d4a:$a6: \Torch\User Data\Default\Login Data 0x520fa:$a7: /n:%temp%\ellocnak.xml 0x8653a:$a7: /n:%temp%\ellocnak.xml 0xba96a:$a7: /n:%temp%\ellocnak.xml
00000014.00000003.486255631.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1f48:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1f48:$c1: Elevation:Administrator!new:
00000014.00000003.486255631.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000014.00000003.486195668.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.486195668.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000014.00000003.486195668.0000000000E98000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x3690:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1e74:$a2: SMTP Password 0xf28:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x35e0:$a5: for /F "usebackq tokens=*" %%A in (" 0x1900:$a6: \Torch\User Data\Default\Login Data 0x2460:$a8: "os_crypt":{"encrypted_key":" 0x1d3c:$a10: \logins.json 0x23d8:$a11: Accounts\Account.rec0 0x3368:$a13: Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
00000000.00000002.316384133.0000000002A8D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000014.00000003.485919583.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1ff8:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1ff8:$c1: Elevation:Administrator!new:
00000014.00000003.485919583.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000014.00000003.486150119.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1f48:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1f48:$c1: Elevation:Administrator!new:
00000014.00000003.486150119.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000013.00000000.403984932.0000000000919000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000000.403984932.0000000000919000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000013.00000000.403984932.0000000000919000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x3680:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x1e64:$a2: SMTP Password 0xf18:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x35d0:$a5: for /F "usebackq tokens=*" %%A in (" 0x18f0:$a6: \Torch\User Data\Default\Login Data 0x2450:$a8: "os_crypt":{"encrypted_key":" 0x1d2c:$a10: \logins.json 0x23c8:$a11: Accounts\Account.rec0 0x3358:$a13: Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	Codoso_Gh0st_1	Detects Codoso APT Gh0st Malware	Florian Roth	0x1e0e2:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x52508:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1e0e2:$c1: Elevation:Administrator!new: 0x52508:$c1: Elevation:Administrator!new:
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACMe	Yara detected UACMe UAC Bypass tool	Joe Security
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
00000000.00000002.329246325.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AveMaria_31d2bce9	unknown	unknown	0x1b372:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x4f798:$a1: cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q 0x19b56:$a2: SMTP Password 0x4df7c:$a2: SMTP Password 0x18c0a:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x4d030:$a3: select signon_realm, origin_url, username_value, password_value from logins 0x1e0e2:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x52508:$a4: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09} 0x1b2c2:$a5: for /F "usebackq tokens=" %%A in (" 0x4f6e8:$a5: for /F "usebackq tokens=" %%A in (" 0x195e2:$a6: \Torch\User Data\Default\Login Data 0x4da08:$a6: \Torch\User Data\Default\Login Data 0x1e202:$a7: /n:%temp%\ellocnak.xml 0x52628:$a7: /n:%temp%\ellocnak.xml 0x1a142:$a8: "os_crypt":{"encrypted_key":" 0x4e568:$a8: "os_crypt":{"encrypted_key":" 0x1e232:$a9: Hey I'm Admin 0x52658:$a9: Hey I'm Admin 0x19a1e:$a10: \logins.json

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
inquiry.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AveMaria

Yara Signatures

Memory Dumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report inquiry.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AveMaria

Yara Signatures

Memory Dumps

Windows Analysis Report
inquiry.pdf.exe