Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Overview

General Information

Sample Name:SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Analysis ID:755946
MD5:7b6dcd6fcd1c26b9abdba167929f4c82
SHA1:04f11f07ef4a51b16383b5dde94f1af405893b45
SHA256:e38f6fab27253171688423b0792d38be81e4c01cceb35c7bca05d2ebfc011ae9
Tags:exe
Infos:

Detection

FormBook
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

  • System is w10x64
  • cleanup
{"C2 list": ["www.imperiumtowns.xyz/b3es/"], "decoy": ["sweets.wtf", "apextama.com", "tygbs.com", "kumaoedu.com", "bestbathroomremodeling.club", "lnshykj.com", "nelsonanddima.com", "falunap.info", "codyhinrichs.com", "2797vip.com", "danutka.com", "3o2t307a.com", "kellymariewest.com", "profilelonn.online", "procan.website", "sopjimmy.com", "xn--skdarkae-55ac80i.net", "entitymanaged.com", "melitadahl.art", "joineguru.net", "good-meme.com", "creditconepts.com", "narafconstruction.com", "paspsichologa.com", "rancho365.com", "rimplefeel.com", "kingsub.online", "cnsrdns.com", "billythepainter.com", "clientevirtualpdf.net", "marycruzruiz.com", "renaultcikmaparca.xyz", "1600156.com", "paymallmart.info", "garafe.com", "fredrikk.net", "gogo-tunisia.space", "center-me.com", "xiaohuayhq.com", "xn--h49a60xt7azzcm91a.com", "unidiliobobo.info", "libertypolestore.com", "20111210.net", "atraofix.online", "furniron.com", "mingyun58.com", "shfesmua.com", "rdougdigital.life", "safsip.com", "melon.town", "sagihigaibengo.net", "ethnicsbyak.com", "designoffaitheventsllc.com", "dpmforensics.com", "ripple-us.net", "fuyouhin-happiness.com", "conceptweb.online", "l453.net", "zenars.com", "mepcoonlinebill.com", "oonn99.xyz", "dackus.energy", "articvas.com", "yayuanlin.com"]}
SourceRuleDescriptionAuthorStrings
00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x65d1:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x349f1:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x61e11:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cf10:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x4b330:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x78750:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xad4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x3916f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x6658f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x15c37:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      • 0x44057:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      • 0x71477:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9c88:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9f02:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x380a8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x38322:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x654c8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x65742:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x15a35:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x43e55:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x71275:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15521:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x43941:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x70d61:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x15b37:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x43f57:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x71377:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x15caf:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x440cf:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x714ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa91a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x38d3a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x6615a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18b99:$sqlite3step: 68 34 1C 7B E1
      • 0x18cac:$sqlite3step: 68 34 1C 7B E1
      • 0x46fb9:$sqlite3step: 68 34 1C 7B E1
      • 0x470cc:$sqlite3step: 68 34 1C 7B E1
      • 0x743d9:$sqlite3step: 68 34 1C 7B E1
      • 0x744ec:$sqlite3step: 68 34 1C 7B E1
      • 0x18bc8:$sqlite3text: 68 38 2A 90 C5
      • 0x18ced:$sqlite3text: 68 38 2A 90 C5
      • 0x46fe8:$sqlite3text: 68 38 2A 90 C5
      • 0x4710d:$sqlite3text: 68 38 2A 90 C5
      • 0x74408:$sqlite3text: 68 38 2A 90 C5
      • 0x7452d:$sqlite3text: 68 38 2A 90 C5
      • 0x18bdb:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18d03:$sqlite3blob: 68 53 D8 7F 8C
      • 0x46ffb:$sqlite3blob: 68 53 D8 7F 8C
      • 0x47123:$sqlite3blob: 68 53 D8 7F 8C
      • 0x7441b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x74543:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 7 entries
      SourceRuleDescriptionAuthorStrings
      1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
        • 0x1bd90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1bafa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x17a19:$sqlite3step: 68 34 1C 7B E1
        • 0x17b2c:$sqlite3step: 68 34 1C 7B E1
        • 0x17a48:$sqlite3text: 68 38 2A 90 C5
        • 0x17b6d:$sqlite3text: 68 38 2A 90 C5
        • 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
        No Sigma rule has matched
        No Snort rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeReversingLabs: Detection: 41%
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeVirustotal: Detection: 45%Perma Link
        Source: Yara matchFile source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeJoe Sandbox ML: detected
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.imperiumtowns.xyz/b3es/"], "decoy": ["sweets.wtf", "apextama.com", "tygbs.com", "kumaoedu.com", "bestbathroomremodeling.club", "lnshykj.com", "nelsonanddima.com", "falunap.info", "codyhinrichs.com", "2797vip.com", "danutka.com", "3o2t307a.com", "kellymariewest.com", "profilelonn.online", "procan.website", "sopjimmy.com", "xn--skdarkae-55ac80i.net", "entitymanaged.com", "melitadahl.art", "joineguru.net", "good-meme.com", "creditconepts.com", "narafconstruction.com", "paspsichologa.com", "rancho365.com", "rimplefeel.com", "kingsub.online", "cnsrdns.com", "billythepainter.com", "clientevirtualpdf.net", "marycruzruiz.com", "renaultcikmaparca.xyz", "1600156.com", "paymallmart.info", "garafe.com", "fredrikk.net", "gogo-tunisia.space", "center-me.com", "xiaohuayhq.com", "xn--h49a60xt7azzcm91a.com", "unidiliobobo.info", "libertypolestore.com", "20111210.net", "atraofix.online", "furniron.com", "mingyun58.com", "shfesmua.com", "rdougdigital.life", "safsip.com", "melon.town", "sagihigaibengo.net", "ethnicsbyak.com", "designoffaitheventsllc.com", "dpmforensics.com", "ripple-us.net", "fuyouhin-happiness.com", "conceptweb.online", "l453.net", "zenars.com", "mepcoonlinebill.com", "oonn99.xyz", "dackus.energy", "articvas.com", "yayuanlin.com"]}
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp

        Networking

        barindex
        Source: Malware configuration extractorURLs: www.imperiumtowns.xyz/b3es/
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248951472.0000000006016000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249535557.0000000006017000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249659691.000000000601C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249765760.000000000601C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comB.TTF1
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF1
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comals
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comce
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comessed
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comi
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comicom
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comitue
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comoitu
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comt
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247878242.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.cm
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247400149.000000000602B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/-e
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250848136.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmX
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/#
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/F
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Kal1
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/M
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/i
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/b
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/or1
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/siv
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/vno
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

        E-Banking Fraud

        barindex
        Source: Yara matchFile source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

        System Summary

        barindex
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 0_2_015FC3340_2_015FC334
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 0_2_015FE7900_2_015FE790
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 0_2_015FE78A0_2_015FE78A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0102F9001_2_0102F900
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010441201_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010429901_2_01042990
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010499BF1_2_010499BF
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0103C1C01_2_0103C1C0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010268001_2_01026800
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E10021_2_010E1002
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105701D1_2_0105701D
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010FE8241_2_010FE824
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104A8301_2_0104A830
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0103B0901_2_0103B090
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010520A01_2_010520A0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F20A81_2_010F20A8
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F28EC1_2_010F28EC
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E60F51_2_010E60F5
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104A3091_2_0104A309
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E231B1_2_010E231B
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F2B281_2_010F2B28
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010CCB4F1_2_010CCB4F
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104AB401_2_0104AB40
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010433601_2_01043360
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010CEB8A1_2_010CEB8A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105138B1_2_0105138B
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104EB9A1_2_0104EB9A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105EBB01_2_0105EBB0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E03DA1_2_010E03DA
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010EDBD21_2_010EDBD2
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105ABD81_2_0105ABD8
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010D23E31_2_010D23E3
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01078BE81_2_01078BE8
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010DFA2B1_2_010DFA2B
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104B2361_2_0104B236
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E5A4F1_2_010E5A4F
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F22AE1_2_010F22AE
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F32A91_2_010F32A9
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010EE2C51_2_010EE2C5
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E4AEF1_2_010E4AEF
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F2D071_2_010F2D07
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01020D201_2_01020D20
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01042D501_2_01042D50
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F1D551_2_010F1D55
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010525811_2_01052581
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E2D821_2_010E2D82
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010565A01_2_010565A0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F25DD1_2_010F25DD
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0103D5E01_2_0103D5E0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0103841F1_2_0103841F
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010424301_2_01042430
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010ED4661_2_010ED466
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104B4771_2_0104B477
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010ECC771_2_010ECC77
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E44961_2_010E4496
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01054CD41_2_01054CD4
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010FDFCE1_2_010FDFCE
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010E67E21_2_010E67E2
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F1FF11_2_010F1FF1
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010456001_2_01045600
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010ED6161_2_010ED616
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01046E301_2_01046E30
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010AAE601_2_010AAE60
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010D1EB61_2_010D1EB6
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010506C01_2_010506C0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010F2EF71_2_010F2EF7
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: String function: 0102B150 appears 177 times
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: String function: 010B5720 appears 85 times
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: String function: 0107D08C appears 48 times
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069860 NtQuerySystemInformation,LdrInitializeThunk,1_2_01069860
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069660 NtAllocateVirtualMemory,LdrInitializeThunk,1_2_01069660
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010696E0 NtFreeVirtualMemory,LdrInitializeThunk,1_2_010696E0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069910 NtAdjustPrivilegesToken,1_2_01069910
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069950 NtQueueApcThread,1_2_01069950
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010699A0 NtCreateSection,1_2_010699A0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010699D0 NtCreateProcessEx,1_2_010699D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069820 NtEnumerateKey,1_2_01069820
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069840 NtDelayExecution,1_2_01069840
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0106B040 NtSuspendThread,1_2_0106B040
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010698A0 NtWriteVirtualMemory,1_2_010698A0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010698F0 NtReadVirtualMemory,1_2_010698F0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069B00 NtSetValueKey,1_2_01069B00
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0106A3B0 NtGetContextThread,1_2_0106A3B0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069A00 NtProtectVirtualMemory,1_2_01069A00
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069A10 NtQuerySection,1_2_01069A10
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069A20 NtResumeThread,1_2_01069A20
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069A50 NtCreateFile,1_2_01069A50
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069A80 NtOpenDirectoryObject,1_2_01069A80
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069520 NtWaitForSingleObject,1_2_01069520
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0106AD30 NtSetContextThread,1_2_0106AD30
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069540 NtReadFile,1_2_01069540
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069560 NtWriteFile,1_2_01069560
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010695D0 NtClose,1_2_010695D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010695F0 NtQueryInformationFile,1_2_010695F0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0106A710 NtOpenProcessToken,1_2_0106A710
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069710 NtQueryInformationToken,1_2_01069710
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069730 NtQueryVirtualMemory,1_2_01069730
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069760 NtOpenProcess,1_2_01069760
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0106A770 NtOpenThread,1_2_0106A770
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069770 NtSetInformationFile,1_2_01069770
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069780 NtMapViewOfSection,1_2_01069780
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010697A0 NtUnmapViewOfSection,1_2_010697A0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069FE0 NtCreateMutant,1_2_01069FE0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069610 NtEnumerateValueKey,1_2_01069610
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069650 NtQueryValueKey,1_2_01069650
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01069670 NtQueryInformationProcess,1_2_01069670
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_010696D0 NtCreateKey,1_2_010696D0
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.267730037.00000000078D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.264250960.000000000111F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.261495799.0000000000F7E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.259043934.0000000000DD5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeBinary or memory string: OriginalFilenamefzynaa.exe< vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeReversingLabs: Detection: 41%
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeVirustotal: Detection: 45%
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.logJump to behavior
        Source: classification engineClassification label: mal92.troj.evad.winEXE@3/1@0/0
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeMutant created: \Sessions\1\BaseNamedObjects\wGtrYQj
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0107D0D1 push ecx; ret 1_2_0107D0E4
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeStatic PE information: 0xBF0A3116 [Sun Jul 26 06:03:02 2071 UTC]
        Source: initial sampleStatic PE information: section name: .text entropy: 7.830178117653337
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Source: Yara matchFile source: 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeRDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeRDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5464Thread sleep time: -38122s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5468Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5576Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01056B90 rdtsc 1_2_01056B90
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeAPI coverage: 0.5 %
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeThread delayed: delay time: 38122Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
        Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01056B90 rdtsc 1_2_01056B90
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]1_2_01029100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]1_2_01029100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]1_2_01029100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]1_2_01030100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]1_2_01030100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]1_2_01030100
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]1_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]1_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]1_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]1_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01044120 mov ecx, dword ptr fs:[00000030h]1_2_01044120
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_01023138 mov ecx, dword ptr fs:[00000030h]1_2_01023138
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105513A mov eax, dword ptr fs:[00000030h]1_2_0105513A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0105513A mov eax, dword ptr fs:[00000030h]1_2_0105513A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h]1_2_0104B944
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h]1_2_0104B944
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0102395E mov eax, dword ptr fs:[00000030h]1_2_0102395E
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exeCode function: 1_2_0102395E mov eax, dword ptr fs:[00000030h]1_2_0102395E
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe