Windows Analysis Report
DHL04AWB01173903102023PDF.scr.exe

Overview

General Information

Sample Name:	DHL04AWB01173903102023PDF.scr.exe
Analysis ID:	828071
MD5:	1bf124cc783ff47a91ada4e6d4ac9e6b
SHA1:	b78f2ffb785071ab785830cdd4cbc5f010b7480b
SHA256:	494d5735144af171cc15708b37b491b74be1522494958e605ac348dd4897dcf9
Tags:	DHLexeRemcosRATscrsigned
Infos:

Detection

GuLoader

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

Found potential ransomware demand text

Uses 32bit PE files

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: DHL04AWB01173903102023PDF.scr.exe

Virustotal: Detection: 13%

Perma Link

Uses 32bit PE files

Source: DHL04AWB01173903102023PDF.scr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: D:\SCM\P4\depot\esw\projects\azure\Maglev\DesignerBranches\ezheng\newarch\Vista-AddOn\ExtArch\UI\BtTray\libs\x64\ContactsApi.pdb source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, ContactsApi.dll.0.dr
Source:	Binary string: D:\Builds\149\N2\HO_MMC_g_2016_r_2016\Sources\AudioPluginMgr\plugins\DefConvertor\Release\DefConvertor.pdb source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.000000000299F000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_0040572C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040572C
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_004061E0 FindFirstFileW,FindClose,	0_2_004061E0

Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: DHL04AWB01173903102023PDF.scr.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://www.nero.com
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr	String found in binary or memory: https://d.symcb.com/rpa0

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_00405290 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405290

Spam, unwanted Advertisements and Ransom Demands

Found potential ransomware demand text

Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: __m2mep@?__global_unlock@?A0x27fb6efc@@$$FYA_NXZ
Source: nseEDA7.tmp.0.dr	String found in binary or memory: __m2mep@?__global_unlock@?A0x27fb6efc@@$$FYA_NXZ
Source: ContactsApi.dll.0.dr	String found in binary or memory: __m2mep@?__global_unlock@?A0x27fb6efc@@$$FYA_NXZ

Uses 32bit PE files

Source: DHL04AWB01173903102023PDF.scr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

PE file does not import any functions

Source: msado25.tlb.0.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831378507.0000000000409000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsado25.tlbj% vs DHL04AWB01173903102023PDF.scr.exe
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831482858.000000000044E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStoressters.exe` vs DHL04AWB01173903102023PDF.scr.exe
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsado25.tlbj% vs DHL04AWB01173903102023PDF.scr.exe
Source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.000000000299F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDefConvertor.DLL vs DHL04AWB01173903102023PDF.scr.exe
Source: DHL04AWB01173903102023PDF.scr.exe	Binary or memory string: OriginalFilenameStoressters.exe` vs DHL04AWB01173903102023PDF.scr.exe

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_0040331C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_0040331C

Creates files inside the system directory

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File created: C:\Windows\resources\0409

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_00404ACD		0_2_00404ACD
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_004064F2		0_2_004064F2

PE / OLE file has an invalid certificate

Source: DHL04AWB01173903102023PDF.scr.exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Process Stats: CPU usage > 98%

Source: DHL04AWB01173903102023PDF.scr.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File read: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Jump to behavior

Source: DHL04AWB01173903102023PDF.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File created: C:\Users\user\Nonhieratical

Jump to behavior

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File created: C:\Users\user\AppData\Local\Temp\nseEDA6.tmp

Jump to behavior

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File written: C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\Z_Custom2.ini

Jump to behavior

Source: classification engine

Classification label: mal64.rans.troj.evad.winEXE@1/11@0/0

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_00404587 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404587

Source: DHL04AWB01173903102023PDF.scr.exe

Static file information: File size 1211760 > 1048576

Source:	Binary string: D:\SCM\P4\depot\esw\projects\azure\Maglev\DesignerBranches\ezheng\newarch\Vista-AddOn\ExtArch\UI\BtTray\libs\x64\ContactsApi.pdb source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.00000000029B2000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, ContactsApi.dll.0.dr
Source:	Binary string: D:\Builds\149\N2\HO_MMC_g_2016_r_2016\Sources\AudioPluginMgr\plugins\DefConvertor\Release\DefConvertor.pdb source: DHL04AWB01173903102023PDF.scr.exe, 00000000.00000002.831811356.000000000299F000.00000004.00000020.00020000.00000000.sdmp, nseEDA7.tmp.0.dr, APM_DefConvertor.dll.0.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.832197103.0000000006825000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_10002D50 push eax; ret

0_2_10002D7E

PE file contains sections with non-standard names

Source: ContactsApi.dll.0.dr

Static PE information: section name: .nep

Binary contains a suspicious time stamp

Source: msado25.tlb.0.dr

Static PE information: 0x8DBA1FD3 [Sun May 7 15:54:59 2045 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_00406207 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406207

Drops PE files

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	File created: C:\Users\user\Nonhieratical\Extracorpuscular\APM_DefConvertor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	File created: C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\msado25.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	File created: C:\Users\user\AppData\Local\Temp\nsoF960.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	File created: C:\Users\user\Nonhieratical\Thonny\Yderligheders\Samtalernes\Sikkerhedsventilen\ContactsApi.dll	Jump to dropped file

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

RDTSC instruction interceptor: First address: 0000000006948C31 second address: 0000000006948C31 instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, edx 0x00000004 cmp ecx, edx 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F18C8FF67D2h 0x0000000a test ecx, edx 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e cmp ebx, eax 0x00000010 rdtsc

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Dropped PE file which has not been started: C:\Users\user\Nonhieratical\Extracorpuscular\APM_DefConvertor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Dropped PE file which has not been started: C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\msado25.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Dropped PE file which has not been started: C:\Users\user\Nonhieratical\Thonny\Yderligheders\Samtalernes\Sikkerhedsventilen\ContactsApi.dll	Jump to dropped file

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_0040572C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040572C
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	Code function: 0_2_004061E0 FindFirstFileW,FindClose,	0_2_004061E0

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe	API call chain: ExitProcess graph end node

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_00406207 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406207

Source: C:\Users\user\Desktop\DHL04AWB01173903102023PDF.scr.exe

Code function: 0_2_00405EBF GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405EBF

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	828071
Product:	CloudBasic
Start time:	18:03:16
Start date:	16.03.2023
Sample:	DHL04AWB01173903102023PDF.scr.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1bf124cc783ff47a91ada4e6d4ac9e6b
SHA1:	b78f2ffb785071ab785830cdd4cbc5f010b7480b
SHA256:	494d5735144af171cc15708b37b491b74be1522494958e605ac348dd4897dcf9
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\nseEDA7.tmp	data	9B4D8ABA094C64270F7878FAE618AC65	FA3D773625A7FE13C127925856A2B015C986E598	CB136F81690F426D253696166DE342FF05A1C1F3C0C780BBE800A06396424751
C:\Users\user\AppData\Local\Temp\nsoF960.tmp\System.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	BE2621A78A13A56CF09E00DD98488360	75F0539DC6AF200A07CDB056CDDDDEC595C6CFD2	852047023BA0CAE91C7A43365878613CFB4E64E36FF98C460E113D5088D68EF5
C:\Users\user\Nonhieratical\Apicad\Outjinx\Nonnavigableness\Competed\Coccosteid.Udr	data	E2901A2B3EFA6BB00F2AD1D4AD963F52	1F2C771CEAE379DF9FA7FA1FA5E4ABC36638A42E	FEFA0B1539475BF0ED224A8D9934FD4558DD0B1297FB661DAB776ABC96C333FF
C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\TableTextServiceYi.txt	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AC05652AF93A583226FD118E23D3652F	DA5BB4AE245369888D1AF981AF6785FAE21C7BC9	54E26FC4F586B39C4CCB6655735E8AA03AD31498EFD0119AB8406258D5561627
C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\Z_Custom2.ini	Generic INItialization configuration [allData0]	CA003CF1D99CDF717768E88DD64BB84C	A0326E46EA68C4649DD6645368B43922B6126FF6	44100D5F41FE4CDDD1D77EF7124FEC4F8071E5A1678339ACE0DA3DD7E826EF2F
C:\Users\user\Nonhieratical\Clavichordist\benenders\Actionfilm\Sortsrenheden\msado25.tlb	PE32+ executable (DLL) (console) x86-64, for MS Windows	299DBB927B6390C6B925757DD5B2B7FF	FFCE563E42AF7B1086CB5AE92014801B2C66DC0C	D9D2BD64DE6176B31A4E704D7E5D08FA9BB75A6A8AC007A61C4DF38F6FA82262
C:\Users\user\Nonhieratical\Counts\Convolution\Dottily\ArtDeco_brown_22.bmp	JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, components 3	162F6BB32D6D5AC380A80DA07C13E213	7985EAC367E0B19CC0E30B24399A37663E8436F6	686310A1A5B8BB4D4EAA316FC0A3970EE878CC39F75E8C68F49ED51A5AD562DF
C:\Users\user\Nonhieratical\Counts\Convolution\Dottily\Iconology.Ess	ASCII text, with very long lines (57606), with no line terminators	1EE3EA9EB5F7142B93FE99689B2038A6	AB0D94BDBDC97EEA61B226010584C12D9AED43EA	67D1985FCBEB4E6FB84785F6304B3CB63A9326B328921E04CCFD50539825FDB7
C:\Users\user\Nonhieratical\Extracorpuscular\APM_DefConvertor.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B44ED270A186763E1DA753AA39553B68	10390F85EA5DB841A8BC70E8ED931A5D34026BE8	E24E9B9C79199B66B9F847F1E07A2769B82CB7FCCA98E5B53F28B481EEBCABD8
C:\Users\user\Nonhieratical\Thonny\Yderligheders\Samtalernes\Sikkerhedsventilen\ContactsApi.dll	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows	7E49C04017D860D5EE299FFB104203DF	DDF55616BDABC91EB801CE14A45ACDAD2142B78F	1AC6E64459440B6EFB03FC256E24BCCBBC512CF6E7DCD85DD3C45E1CA7584176
C:\Users\user\Nonhieratical\Thonny\Yderligheders\Samtalernes\Sikkerhedsventilen\Sports-Wallpapers-1.jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x786, components 3	E269DECCAC13CF01A0377872E79BC676	54D196FDE9529310F9E5A3EBA6548DAB4F179542	255874E0A6A5CA862CBAE5C783D582729B343C70C5697062D7F1E587F15F25EC

Windows Analysis Report
DHL04AWB01173903102023PDF.scr.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report DHL04AWB01173903102023PDF.scr.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
DHL04AWB01173903102023PDF.scr.exe