Click to jump to signature section
Source: XF-Sublime-KG.exe | ReversingLabs: Detection: 42% |
Source: XF-Sublime-KG.exe | Virustotal: Detection: 35% | Perma Link |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | ReversingLabs: Detection: 23% |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Virustotal: Detection: 18% | Perma Link |
Source: XF-Sublime-KG.exe | Joe Sandbox ML: detected |
Source: 0.2.XF-Sublime-KG.exe.286606e.1.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: XF-Sublime-KG.exe | Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: XF-Sublime-KG.exe | Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_0040290B FindFirstFileW, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_0040699E FindFirstFileW,FindClose, |
Source: XF-Sublime-KG.exe, 00000000.00000002.521940680.0000000002865000.00000004.00000020.00020000.00000000.sdmp, XF-Sublime-KG.exe, 00000001.00000002.522451285.00000000734C6000.00000008.00000001.01000000.00000005.sdmp, nst2ED8.tmp.0.dr, libwinpthread-1.dll.0.dr | String found in binary or memory: http://mingw-w64.sourceforge.net/X |
Source: XF-Sublime-KG.exe | String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
Source: BASSMOD.dll.0.dr | Static PE information: section name: |
Source: BASSMOD.dll.0.dr | Static PE information: section name: |
Source: XF-Sublime-KG.exe | Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: XF-Sublime-KG.exe, 00000000.00000002.521940680.0000000002865000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameWinPthreadGCp( vs XF-Sublime-KG.exe |
Source: XF-Sublime-KG.exe, 00000001.00000002.522451285.00000000734C6000.00000008.00000001.01000000.00000005.sdmp | Binary or memory string: OriginalFilenameWinPthreadGCp( vs XF-Sublime-KG.exe |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00406D5F |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B739A0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B77D50 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B76A90 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_100028F0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_10010534 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_1000ADA0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_100031D8 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_10001B00 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_10009B49 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_10001790 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4B4C0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4FC90 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4847C |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE49C53 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4F420 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE56DD7 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4D5A1 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4FEE0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4F6C0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE50EC0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4D6D8 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4DE38 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE468E0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4F8F0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE508B0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE48061 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE49820 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4C830 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE47030 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE501C0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4C9D4 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4D974 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE52AB0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE4CA91 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE50A9C |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE54A10 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE46BD0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE503A0 |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE47330 |
Source: libwinpthread-1.dll.0.dr | Static PE information: Number of sections : 11 > 10 |
Source: BASSMOD.dll.0.dr | Static PE information: Section: ZLIB complexity 1.0005039687539372 |
Source: XF-Sublime-KG.exe | ReversingLabs: Detection: 42% |
Source: XF-Sublime-KG.exe | Virustotal: Detection: 35% |
Source: XF-Sublime-KG.exe | Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Source: unknown | Process created: C:\Users\user\Desktop\XF-Sublime-KG.exe C:\Users\user\Desktop\XF-Sublime-KG.exe |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Process created: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Process created: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B72EF4 DragQueryFileA,DragQueryFileA,DragQueryFileA,DragQueryFileA,free,DragFinish,DragAcceptFiles,LoadIconA,SendMessageA,SendMessageA,SetWindowTextA,CreateFontA,GetDlgItem,GetDlgItem,SendMessageA,SendMessageA,GetDlgItem,SendMessageA,GetDlgItem,SendMessageA,SetDlgItemTextA,SetDlgItemTextA,SetDlgItemTextA,FindResourceA,SizeofResource,LoadResource,LockResource,BASSMOD_MusicLoad,BASSMOD_MusicGetLength,BASSMOD_MusicPlay,PostMessageA,MessageBoxA,DragAcceptFiles,PostMessageA,LoadCursorA,SetCursor,SetDlgItemTextA,GetDlgItemTextA,SetDlgItemTextA,BASSMOD_MusicPlay,MessageBoxIndirectA,MessageBoxIndirectA,LoadCursorA,SetCursor,SetDlgItemTextA,malloc,EndDialog,BASSMOD_MusicPause,MessageBoxIndirectA,MessageBoxIndirectA, |
Source: classification engine | Classification label: mal64.winEXE@3/6@0/0 |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_004021AA CoCreateInstance, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Window detected: Number of UI elements: 14 |
Source: XF-Sublime-KG.exe | Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B7E1BB push ebx; ret |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B7C9FB pushfd ; retf |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B7C96D pushfd ; retf |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B7CF96 push es; iretd |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_1000E989 push FF3F95A1h; ret |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_1000CBA0 push eax; ret |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE414E0 push dword ptr [eax+04h]; ret |
Source: BASSMOD.dll.0.dr | Static PE information: section name: |
Source: BASSMOD.dll.0.dr | Static PE information: section name: |
Source: libgcc_s_dw2-1.dll.0.dr | Static PE information: section name: /4 |
Source: libtomcrypt.dll.0.dr | Static PE information: section name: UPX2 |
Source: libwinpthread-1.dll.0.dr | Static PE information: section name: /4 |
Source: XF-Sublime-KG.exe.0.dr | Static PE information: section name: .eh_fram |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B714E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, |
Source: initial sample | Static PE information: section name: entropy: 7.982708398519935 |
Source: initial sample | Static PE information: section name: UPX0 |
Source: initial sample | Static PE information: section name: UPX1 |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | File created: C:\Users\user\AppData\Local\Temp\libtomcrypt.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | File created: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Jump to dropped file |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | File created: C:\Users\user\AppData\Local\Temp\libwinpthread-1.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | File created: C:\Users\user\AppData\Local\Temp\libgcc_s_dw2-1.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | File created: C:\Users\user\AppData\Local\Temp\BASSMOD.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Last function: Thread delayed |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | API coverage: 4.3 % |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_6CE5DD17 sidt fword ptr [edx] |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_0040290B FindFirstFileW, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_0040699E FindFirstFileW,FindClose, |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | API call chain: ExitProcess graph end node |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B714E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B7116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B711A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B71160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_00B713C1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm, |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Code function: 1_2_10001000 cpuid |
Source: C:\Users\user\AppData\Local\Temp\XF-Sublime-KG.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Source: C:\Users\user\Desktop\XF-Sublime-KG.exe | Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |