Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
documentos DHL.exe

Overview

General Information

Sample Name:documentos DHL.exe
Analysis ID:755464
MD5:ca1cd0656568af4f58aa28e61a3e3edb
SHA1:1fde05eb6e587047d8a47950bcb2efdb53409b42
SHA256:6931d5a8ac6e00c855139d9da394b7895d83a9a18a8974c0b2381c5a28e68678
Infos:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Found stalling execution ending in API Sleep call
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Tries to harvest and steal ftp login credentials
Executable has a suspicious name (potential lure to open the executable)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64native
  • documentos DHL.exe (PID: 7424 cmdline: C:\Users\user\Desktop\documentos DHL.exe MD5: CA1CD0656568AF4F58AA28E61A3E3EDB)
    • ieinstal.exe (PID: 8576 cmdline: C:\Users\user\Desktop\documentos DHL.exe MD5: 7871873BABCEA94FBA13900B561C7C55)
    • ieinstal.exe (PID: 8584 cmdline: C:\Users\user\Desktop\documentos DHL.exe MD5: 7871873BABCEA94FBA13900B561C7C55)
    • ieinstal.exe (PID: 8596 cmdline: C:\Users\user\Desktop\documentos DHL.exe MD5: 7871873BABCEA94FBA13900B561C7C55)