Windows Analysis Report
6k00SOeMjU.dll

Signatures

System process connects to network (likely due to code injection or exploit)

Creates a process in suspended mode (likely to inject code)

Spawns processes

Signatures

Runs a DLL by calling functions

Signatures

Hides threads from debuggers

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

Contains medium sleeps (>= 30s)

Signatures

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Signatures

Creates a DirectInput object (often for capturing keystrokes)

Signatures

Hides threads from debuggers

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Signatures

Queries a list of all running processes

Signatures

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Queries the volume information (name, serial number etc) of a device

Queries a list of all running drivers

Reads software policies

Signatures

Detected TCP or UDP traffic on non-standard ports

Execution Graphs are highly condensed control flow graphs which give the user a synthetic view of the code detected during Hybrid Code Analysis. They include additional runtime information such as the execution status which is highlighted with different colors and shapes.

Entrypoint

Program entry point, most likely the entry point of the PE file.

Key Decision

A code location where a decision has been made to avoid execution of potentially malicious behavior.

Dynamic / Decrypted

Code which has been generated at runtime, often referred to as unpacked or self-modifying code.

Unpacker / Decrypter

Code section which is responsible for unpacking or decrypting a portion of dynamic code.

Executed

Code which has been executed at runtime.

Not Executed

Code which has not been executed at runtime.

Unknown

Code for which it is unknown if it has been executed or not at runtime.

Signature Matched

Code which matches a behavioral signature.

Rich Path

Path through the execution graph which shows a lot of behavior (e.g. with respect to called API functions).

Thread / callback entry

Code corresponding to a thread or callback entry point.

Thread / callback creation

Edges denoting either a thread creation (e.g. using CreateThread) or a callback registration (e.g. EnumWindows).

Entrypoint

VBA program entry point such as Document_Open.

Decryption Function

Function likely responsible for string decryption.

Executed

This line was executed during analysis.

Not Executed

This line was likely not executed during analysis.