Analysis

Category Package Started Completed Duration Options Log
FILE Extraction 2020-01-14 13:35:05 2020-01-14 13:35:59 54 seconds Show Options Show Log
route = internet
procdump = 0
2020-01-14 13:35:06,000 [root] INFO: Date set to: 01-14-20, time set to: 13:35:06, timeout set to: 200
2020-01-14 13:35:06,015 [root] DEBUG: Starting analyzer from: C:\tgohlqjitm
2020-01-14 13:35:06,015 [root] DEBUG: Storing results at: C:\dUCXuKbI
2020-01-14 13:35:06,015 [root] DEBUG: Pipe server name: \\.\PIPE\AMeeKbNN
2020-01-14 13:35:06,015 [root] INFO: Analysis package "Extraction" has been specified.
2020-01-14 13:35:06,342 [root] DEBUG: Started auxiliary module Browser
2020-01-14 13:35:06,342 [root] DEBUG: Started auxiliary module Curtain
2020-01-14 13:35:06,342 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2020-01-14 13:35:06,654 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-01-14 13:35:06,654 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module DigiSig
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module Disguise
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module Human
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module Screenshots
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module Sysmon
2020-01-14 13:35:06,670 [root] DEBUG: Started auxiliary module Usage
2020-01-14 13:35:06,670 [root] INFO: Analyzer: DLL set to Extraction.dll from package modules.packages.Extraction
2020-01-14 13:35:06,670 [root] INFO: Analyzer: DLL_64 set to Extraction_x64.dll from package modules.packages.Extraction
2020-01-14 13:35:06,686 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\IMG09412.PIF" with arguments "" with pid 1192
2020-01-14 13:35:09,697 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:09,697 [lib.api.process] INFO: 32-bit DLL to inject is C:\tgohlqjitm\dll\MYAYwX.dll, loader C:\tgohlqjitm\bin\lwHVnml.exe
2020-01-14 13:35:09,697 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\AMeeKbNN.
2020-01-14 13:35:09,697 [root] DEBUG: Loader: Injecting process 1192 (thread 1244) with C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:09,697 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:09,697 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:09,697 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:09,697 [root] DEBUG: Successfully injected DLL C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:09,697 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1192
2020-01-14 13:35:11,709 [lib.api.process] INFO: Successfully resumed process with pid 1192
2020-01-14 13:35:11,709 [root] INFO: Added new process to list with pid: 1192
2020-01-14 13:35:11,865 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:11,865 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:11,959 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:11,959 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:11,959 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:11,959 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:11,959 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:11,959 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77a00000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x77a5124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:11,959 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x230000
2020-01-14 13:35:11,959 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:11,959 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 1192 at 0x74eb0000, image base 0x400000, stack from 0x186000-0x190000
2020-01-14 13:35:11,959 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Users\user\AppData\Local\Temp\IMG09412.PIF".
2020-01-14 13:35:11,973 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00400000) returned 0x00000000.
2020-01-14 13:35:11,973 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:11,973 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00400000) -> AllocationBase 0x00400000 RegionSize 0x4096.
2020-01-14 13:35:11,973 [root] DEBUG: AddTrackedRegion: EntryPoint 0x1224, Entropy 7.167060e+00
2020-01-14 13:35:11,973 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions.
2020-01-14 13:35:11,973 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:11,973 [root] INFO: Monitor successfully loaded in process with pid 1192.
2020-01-14 13:35:12,177 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:12,177 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:12,177 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy 7.167060e+00.
2020-01-14 13:35:12,177 [root] DEBUG: ProtectionHandler: Adding region at 0x00240000 to tracked regions.
2020-01-14 13:35:12,177 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00240000) returned 0x00000000.
2020-01-14 13:35:12,177 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:12,177 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00240000) -> AllocationBase 0x00240000 RegionSize 0x24576.
2020-01-14 13:35:12,177 [root] DEBUG: AddTrackedRegion: New region at 0x00240000 size 0x6000 added to tracked regions.
2020-01-14 13:35:12,177 [root] DEBUG: ProtectionHandler: Address: 0x00240000 (alloc base 0x00240000), NumberOfBytesToProtect: 0x6000, NewAccessProtection: 0x20
2020-01-14 13:35:12,177 [root] DEBUG: ProtectionHandler: New code detected at (0x00240000), scanning for PE images.
2020-01-14 13:35:12,177 [root] DEBUG: DumpPEsInRange: Scanning range 0x240000 - 0x246000.
2020-01-14 13:35:12,177 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x240000-0x246000.
2020-01-14 13:35:12,177 [root] DEBUG: DumpPEsInRange: Scanning range 0x240000 - 0x246000.
2020-01-14 13:35:12,177 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x240000-0x246000.
2020-01-14 13:35:12,177 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00240000, TrackedRegion->RegionSize: 0x6000, thread 1244
2020-01-14 13:35:12,177 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xd8, Size=0x2, Address=0x00240000 and Type=0x1.
2020-01-14 13:35:12,207 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 1244 type 1 at address 0x00240000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:12,207 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00240000
2020-01-14 13:35:12,207 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xd8, Size=0x4, Address=0x0024003C and Type=0x1.
2020-01-14 13:35:12,207 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 1244 type 1 at address 0x0024003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:12,207 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0024003C
2020-01-14 13:35:12,223 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x00240000.
2020-01-14 13:35:12,223 [root] DEBUG: DLL loaded at 0x74E50000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-01-14 13:35:12,457 [root] DEBUG: ProtectionHandler: Address 0x00240000 already in tracked region at 0x00240000, size 0x6000
2020-01-14 13:35:12,457 [root] DEBUG: ProtectionHandler: Address: 0x00240000 (alloc base 0x00240000), NumberOfBytesToProtect: 0xa000, NewAccessProtection: 0x20
2020-01-14 13:35:12,457 [root] DEBUG: ProtectionHandler: Increased region size at 0x00240000 to 0xa000.
2020-01-14 13:35:12,457 [root] DEBUG: ProtectionHandler: New code detected at (0x00240000), scanning for PE images.
2020-01-14 13:35:12,457 [root] DEBUG: DumpPEsInRange: Scanning range 0x240000 - 0x24a000.
2020-01-14 13:35:12,457 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x240000-0x24a000.
2020-01-14 13:35:12,457 [root] DEBUG: DumpPEsInRange: Scanning range 0x240000 - 0x24a000.
2020-01-14 13:35:12,457 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x240000-0x24a000.
2020-01-14 13:35:12,457 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00240000, TrackedRegion->RegionSize: 0xa000, thread 1244
2020-01-14 13:35:12,473 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xd8, Size=0x2, Address=0x00240000 and Type=0x1.
2020-01-14 13:35:12,473 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 1244 type 1 at address 0x00240000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:12,473 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00240000
2020-01-14 13:35:12,473 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xd8, Size=0x4, Address=0x0024003C and Type=0x1.
2020-01-14 13:35:12,473 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 1244 type 1 at address 0x0024003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:12,473 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0024003C
2020-01-14 13:35:12,473 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x00240000.
2020-01-14 13:35:13,160 [root] DEBUG: Allocation: 0x004B0000 - 0x004BD000, size: 0xd000, protection: 0x40.
2020-01-14 13:35:13,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:13,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:13,160 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy 7.183132e+00.
2020-01-14 13:35:13,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00240000.
2020-01-14 13:35:13,160 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x004B0000, size: 0xd000.
2020-01-14 13:35:13,160 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x004B0000) returned 0x00000000.
2020-01-14 13:35:13,160 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:13,160 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x004B0000) -> AllocationBase 0x004B0000 RegionSize 0x53248.
2020-01-14 13:35:13,160 [root] DEBUG: AddTrackedRegion: New region at 0x004B0000 size 0xd000 added to tracked regions.
2020-01-14 13:35:13,160 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x004B0000, TrackedRegion->RegionSize: 0xd000, thread 1244
2020-01-14 13:35:13,160 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00240000 to 0x004B0000.
2020-01-14 13:35:13,160 [root] DEBUG: DumpPEsInRange: Scanning range 0x240000 - 0x24a000.
2020-01-14 13:35:13,160 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x240000-0x24a000.
2020-01-14 13:35:13,160 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00240000 - 0x0024A000.
2020-01-14 13:35:13,160 [root] DEBUG: DumpMemory: CAPE output file C:\dUCXuKbI\CAPE\1192_134272297613351314212020 successfully created, size 0x10000
2020-01-14 13:35:13,207 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x240000
2020-01-14 13:35:13,207 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00240000 size 0x10000.
2020-01-14 13:35:13,207 [root] DEBUG: DumpMemory: CAPE output file C:\dUCXuKbI\CAPE\1192_186813245313351314212020 successfully created, size 0xa000
2020-01-14 13:35:13,221 [root] INFO: Added new CAPE file to list with path: C:\dUCXuKbI\CAPE\1192_186813245313351314212020
2020-01-14 13:35:13,221 [root] DEBUG: DumpRegion: Dumped stack region from 0x00240000, size 0xa000.
2020-01-14 13:35:13,221 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00240000.
2020-01-14 13:35:13,221 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x240000 - 0x24a000.
2020-01-14 13:35:13,221 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xd8, Size=0x2, Address=0x004B0000 and Type=0x1.
2020-01-14 13:35:13,221 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 1244 type 1 at address 0x004B0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:13,221 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x004B0000
2020-01-14 13:35:13,221 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xd8, Size=0x4, Address=0x004B003C and Type=0x1.
2020-01-14 13:35:13,221 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 1244 type 1 at address 0x004B003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:13,221 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x004B003C
2020-01-14 13:35:13,221 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x004B0000 (size 0xd000).
2020-01-14 13:35:18,417 [root] DEBUG: DLL unloaded from 0x77BE0000.
2020-01-14 13:35:18,417 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00421C6B (thread 1244)
2020-01-14 13:35:18,417 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x004B003C.
2020-01-14 13:35:18,417 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xb3603445 (at 0x004B003C).
2020-01-14 13:35:18,417 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x004B0000 and Type=0x0.
2020-01-14 13:35:18,417 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x004B0000.
2020-01-14 13:35:18,417 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00421C6B (thread 1244)
2020-01-14 13:35:18,417 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x004B0000.
2020-01-14 13:35:18,417 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x004B0000 already exists for thread 1244 (process 1192), skipping.
2020-01-14 13:35:18,417 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x4b0000: 0x41.
2020-01-14 13:35:18,417 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:35:18,417 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004B0000 (thread 1244)
2020-01-14 13:35:18,417 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x004B0000 (allocation base 0x004B0000).
2020-01-14 13:35:18,417 [root] DEBUG: ShellcodeExecCallback: Debug: About to scan region for a PE image (base 0x004B0000, size 0xd000).
2020-01-14 13:35:18,433 [root] DEBUG: DumpPEsInRange: Scanning range 0x4b0000 - 0x4bd000.
2020-01-14 13:35:18,433 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x4b0000-0x4bd000.
2020-01-14 13:35:18,433 [root] DEBUG: DumpMemory: CAPE output file C:\dUCXuKbI\CAPE\1192_183789836418152314212020 successfully created, size 0xd000
2020-01-14 13:35:18,433 [root] INFO: Added new CAPE file to list with path: C:\dUCXuKbI\CAPE\1192_183789836418152314212020
2020-01-14 13:35:18,433 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x004B0000 (size 0xd000).
2020-01-14 13:35:18,433 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x4b0000 - 0x4bd000.
2020-01-14 13:35:18,433 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x004B0000.
2020-01-14 13:35:18,433 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x004B003C.
2020-01-14 13:35:18,433 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x004B0000.
2020-01-14 13:35:18,433 [root] DEBUG: set_caller_info: Adding region at 0x004B0000 to caller regions list (kernel32::SetErrorMode).
2020-01-14 13:35:18,433 [root] DEBUG: set_caller_info: Caller at 0x004B5BCE in tracked regions.
2020-01-14 13:35:18,433 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:18,433 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:18,433 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy 7.183132e+00.
2020-01-14 13:35:18,433 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00240000.
2020-01-14 13:35:18,433 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x004B0000.
2020-01-14 13:35:20,460 [root] DEBUG: DLL loaded at 0x759C0000: C:\Windows\syswow64\shell32 (0xc4a000 bytes).
2020-01-14 13:35:20,648 [root] INFO: Announced 32-bit process name: IMG09412.PIF pid: 1132
2020-01-14 13:35:20,648 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:20,648 [lib.api.process] INFO: 32-bit DLL to inject is C:\tgohlqjitm\dll\MYAYwX.dll, loader C:\tgohlqjitm\bin\lwHVnml.exe
2020-01-14 13:35:20,648 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\AMeeKbNN.
2020-01-14 13:35:20,648 [root] DEBUG: Loader: Injecting process 1132 (thread 1620) with C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,648 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:20,648 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,648 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:20,664 [root] DEBUG: Successfully injected DLL C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,664 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1132
2020-01-14 13:35:20,664 [root] DEBUG: DLL loaded at 0x75130000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-01-14 13:35:20,664 [root] DEBUG: DLL unloaded from 0x00400000.
2020-01-14 13:35:20,678 [root] INFO: Announced 32-bit process name: IMG09412.PIF pid: 1132
2020-01-14 13:35:20,678 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:20,678 [lib.api.process] INFO: 32-bit DLL to inject is C:\tgohlqjitm\dll\MYAYwX.dll, loader C:\tgohlqjitm\bin\lwHVnml.exe
2020-01-14 13:35:20,678 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\AMeeKbNN.
2020-01-14 13:35:20,678 [root] DEBUG: Loader: Injecting process 1132 (thread 1620) with C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,678 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:20,678 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,678 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:20,678 [root] DEBUG: Successfully injected DLL C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,678 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1132
2020-01-14 13:35:20,678 [root] INFO: Announced 32-bit process name: IMG09412.PIF pid: 1132
2020-01-14 13:35:20,678 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:20,678 [lib.api.process] INFO: 32-bit DLL to inject is C:\tgohlqjitm\dll\MYAYwX.dll, loader C:\tgohlqjitm\bin\lwHVnml.exe
2020-01-14 13:35:20,678 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\AMeeKbNN.
2020-01-14 13:35:20,678 [root] DEBUG: Loader: Injecting process 1132 (thread 1620) with C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,678 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:20,678 [root] DEBUG: InjectDllViaIAT: Modified EP detected, rebasing IAT patch to new image base 0x00400000 (context EP 0x0041942F)
2020-01-14 13:35:20,678 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,694 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:20,694 [root] DEBUG: Successfully injected DLL C:\tgohlqjitm\dll\MYAYwX.dll.
2020-01-14 13:35:20,694 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1132
2020-01-14 13:35:20,694 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 1192).
2020-01-14 13:35:20,694 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:20,694 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:20,694 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:20,694 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:20,694 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy -nan(ind).
2020-01-14 13:35:20,694 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:20,694 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00240000.
2020-01-14 13:35:20,694 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x004B0000.
2020-01-14 13:35:20,694 [root] INFO: Notified of termination of process with pid 1192.
2020-01-14 13:35:20,710 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:20,710 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77a00000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x77a5124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:20,710 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x1d0000
2020-01-14 13:35:20,710 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:20,726 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 1132 at 0x74eb0000, image base 0x400000, stack from 0x186000-0x190000
2020-01-14 13:35:20,742 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Users\user\AppData\Local\Temp\IMG09412.PIF".
2020-01-14 13:35:20,742 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00400000) returned 0x00000000.
2020-01-14 13:35:20,742 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:20,756 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00400000) -> AllocationBase 0x00400000 RegionSize 0x4096.
2020-01-14 13:35:20,756 [root] DEBUG: AddTrackedRegion: EntryPoint 0x1224, Entropy 7.167060e+00
2020-01-14 13:35:20,756 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions.
2020-01-14 13:35:20,756 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:20,773 [root] INFO: Added new process to list with pid: 1132
2020-01-14 13:35:20,773 [root] INFO: Monitor successfully loaded in process with pid 1132.
2020-01-14 13:35:20,788 [root] DEBUG: Allocation: 0x001E0000 - 0x001ED000, size: 0xd000, protection: 0x40.
2020-01-14 13:35:20,788 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:20,788 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:20,788 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy 7.167060e+00.
2020-01-14 13:35:20,788 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x001E0000, size: 0xd000.
2020-01-14 13:35:20,788 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x001E0000) returned 0x00000000.
2020-01-14 13:35:20,803 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:20,803 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x001E0000) -> AllocationBase 0x001E0000 RegionSize 0x53248.
2020-01-14 13:35:20,803 [root] DEBUG: AddTrackedRegion: New region at 0x001E0000 size 0xd000 added to tracked regions.
2020-01-14 13:35:20,803 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x001E0000, TrackedRegion->RegionSize: 0xd000, thread 1620
2020-01-14 13:35:20,803 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x001E0000 and Type=0x1.
2020-01-14 13:35:20,803 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 1620 type 1 at address 0x001E0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:20,819 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x001E0000
2020-01-14 13:35:20,851 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x001E003C and Type=0x1.
2020-01-14 13:35:20,851 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 1620 type 1 at address 0x001E003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:20,851 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x001E003C
2020-01-14 13:35:20,865 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x001E0000 (size 0xd000).
2020-01-14 13:35:23,892 [root] DEBUG: DLL unloaded from 0x77BE0000.
2020-01-14 13:35:23,892 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00421C6B (thread 1620)
2020-01-14 13:35:23,907 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x001E003C.
2020-01-14 13:35:23,907 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xb3603445 (at 0x001E003C).
2020-01-14 13:35:23,907 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x001E0000 and Type=0x0.
2020-01-14 13:35:23,907 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x001E0000.
2020-01-14 13:35:23,907 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00421C6B (thread 1620)
2020-01-14 13:35:23,924 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x001E0000.
2020-01-14 13:35:23,924 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x001E0000 already exists for thread 1620 (process 1132), skipping.
2020-01-14 13:35:23,924 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x1e0000: 0x41.
2020-01-14 13:35:23,954 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:35:23,986 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x001E0000 (thread 1620)
2020-01-14 13:35:23,986 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x001E0000 (allocation base 0x001E0000).
2020-01-14 13:35:23,986 [root] DEBUG: ShellcodeExecCallback: Debug: About to scan region for a PE image (base 0x001E0000, size 0xd000).
2020-01-14 13:35:24,017 [root] DEBUG: DumpPEsInRange: Scanning range 0x1e0000 - 0x1ed000.
2020-01-14 13:35:24,032 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1e0000-0x1ed000.
2020-01-14 13:35:24,032 [root] DEBUG: DumpMemory: CAPE output file C:\dUCXuKbI\CAPE\1132_151172107724152314212020 successfully created, size 0xd000
2020-01-14 13:35:24,032 [root] INFO: Added new CAPE file to list with path: C:\dUCXuKbI\CAPE\1132_151172107724152314212020
2020-01-14 13:35:24,032 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x001E0000 (size 0xd000).
2020-01-14 13:35:24,049 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1e0000 - 0x1ed000.
2020-01-14 13:35:24,049 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x001E0000.
2020-01-14 13:35:24,049 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x001E003C.
2020-01-14 13:35:24,079 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x001E0000.
2020-01-14 13:35:24,079 [root] DEBUG: set_caller_info: Adding region at 0x001E0000 to caller regions list (kernel32::SetErrorMode).
2020-01-14 13:35:24,111 [root] DEBUG: set_caller_info: Caller at 0x001E5BCE in tracked regions.
2020-01-14 13:35:24,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:24,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:24,111 [root] DEBUG: ProcessImageBase: EP 0x00001224 image base 0x00400000 size 0x0 entropy 7.167060e+00.
2020-01-14 13:35:24,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x001E0000.
2020-01-14 13:35:26,124 [root] DEBUG: DLL loaded at 0x759C0000: C:\Windows\syswow64\shell32 (0xc4a000 bytes).
2020-01-14 13:35:26,217 [root] DEBUG: ProtectionHandler: Address 0x00401000 already in tracked region at 0x00400000, size 0x1000
2020-01-14 13:35:26,217 [root] DEBUG: ProtectionHandler: Address: 0x00401000 (alloc base 0x00400000), NumberOfBytesToProtect: 0x59c, NewAccessProtection: 0x20
2020-01-14 13:35:26,217 [root] DEBUG: ProtectionHandler: Increased region size at 0x00401000 to 0x159c.
2020-01-14 13:35:26,217 [root] DEBUG: ProtectionHandler: Updated region protection at 0x00401000 to 0x20.
2020-01-14 13:35:26,217 [root] DEBUG: ProcessImageBase: EP 0x0000140A image base 0x00400000 size 0x0 entropy -nan(ind).
2020-01-14 13:35:26,217 [root] DEBUG: ProcessImageBase: Modified entry point (0x0000140A) detected at image base 0x00400000 - dumping.
2020-01-14 13:35:26,233 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:35:26,247 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-01-14 13:35:26,247 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000140A.
2020-01-14 13:35:26,263 [root] INFO: Added new CAPE file to list with path: C:\dUCXuKbI\CAPE\1132_213624313626351314212020
2020-01-14 13:35:26,263 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x1000.
2020-01-14 13:35:26,279 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1560.
2020-01-14 13:35:26,295 [root] DEBUG: DLL loaded at 0x74E60000: C:\Windows\system32\mscoree (0x4a000 bytes).
2020-01-14 13:35:26,295 [root] DEBUG: set_caller_info: Adding region at 0x000A0000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-01-14 13:35:26,295 [root] DEBUG: Allocation: 0x00400000 - 0x0044E000, size: 0x4e000, protection: 0x40.
2020-01-14 13:35:26,295 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:26,325 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:26,325 [root] DEBUG: ProcessImageBase: EP 0x00000000 image base 0x00400000 size 0x0 entropy 0.000000e+00.
2020-01-14 13:35:26,325 [root] DEBUG: ProcessImageBase: Modified entry point (0x00000000) detected at image base 0x00400000 - dumping.
2020-01-14 13:35:26,358 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x00400000
2020-01-14 13:35:33,470 [modules.auxiliary.human] INFO: Found button "Close the program", clicking it
2020-01-14 13:35:35,094 [root] INFO: Process with pid 1132 has terminated
2020-01-14 13:35:41,177 [root] INFO: Process list is empty, terminating analysis.
2020-01-14 13:35:42,253 [root] INFO: Created shutdown mutex.
2020-01-14 13:35:43,345 [root] INFO: Shutting down package.
2020-01-14 13:35:43,424 [root] INFO: Stopping auxiliary modules.
2020-01-14 13:35:43,440 [root] INFO: Finishing auxiliary modules.
2020-01-14 13:35:43,440 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-01-14 13:35:43,440 [root] WARNING: File at path "C:\dUCXuKbI\debugger" does not exist, skip.
2020-01-14 13:35:43,440 [root] INFO: Analysis completed.

MalScore

9.0

Malicious

Machine

Name Label Manager Started On Shutdown On
target-04 target-04 ESX 2020-01-14 13:35:06 2020-01-14 13:35:59

File Details

File Name IMG09412.PIF
File Size 667648 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 480abc3a2caea5c3b9137dea41576444
SHA1 5a39798b1f1ecf9fac0ff60dbcbf008055a6c1af
SHA256 12b5aa8e9abe2a09f19ebc02ea43117a10bfdf6bb9b735e2071605c18ec6e269
SHA512 4a07ede213478cfb79befaedc906ce079816033f7dd405e175534bd709f2cd5b819806cb44285216231423bc761c53349547a3b25c8a38f0e52d00887095ec97
CRC32 80997667
Ssdeep 12288:Mkq9L5g16f+sFkGwoa7W64qSLI4A9cx7//KHRp:Mkv16f+sFkOrqSH1lqHz
TrID
  • 88.6% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8)
  • 4.8% (.EXE) Win32 Executable (generic) (4508/7/1)
  • 2.1% (.EXE) OS/2 Executable (generic) (2029/13)
  • 2.1% (.EXE) Generic Win/DOS Executable (2002/3)
  • 2.1% (.EXE) DOS Executable Generic (2000/1)
ClamAV None matched
Yara None matched
CAPE Yara None matched
Resubmit sample

Signatures

Behavioural detection: Executable code extraction
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 1192 trigged the Yara rule 'embedded_win_api'
Hit: PID 1192 trigged the Yara rule 'shellcode_patterns'
NtSetInformationThread: attempt to hide thread from debugger
Dynamic (imported) function loading detected
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: GDI32.dll/GetLayout
DynamicLoader: GDI32.dll/GdiRealizationInfo
DynamicLoader: GDI32.dll/FontIsLinked
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: GDI32.dll/GetFontAssocStatus
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: GDI32.dll/GetTextExtentExPointWPri
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: USER32.dll/EnumWindows
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: shell32.DLL/ShellExecuteW
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/VirtualProtectEx
DynamicLoader: kernel32.dll/CreateProcessInternalW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetLongPathNameW
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: ntdll.dll/NtProtectVirtualMemory
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgUiRemoteBreakin
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtGetContextThread
DynamicLoader: ntdll.dll/NtSetContextThread
DynamicLoader: USER32.dll/GetCursorPos
DynamicLoader: ntdll.dll/NtResumeThread
DynamicLoader: kernel32.dll/GetExitCodeProcess
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: USER32.dll/EnumWindows
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: shell32.DLL/ShellExecuteW
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/VirtualProtectEx
DynamicLoader: kernel32.dll/CreateProcessInternalW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetLongPathNameW
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: ntdll.dll/NtProtectVirtualMemory
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgUiRemoteBreakin
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtGetContextThread
DynamicLoader: ntdll.dll/NtSetContextThread
DynamicLoader: kernel32.dll/GetStartupInfoW
DynamicLoader: kernel32.dll/SizeofResource
DynamicLoader: kernel32.dll/LockResource
DynamicLoader: kernel32.dll/LoadResource
DynamicLoader: kernel32.dll/FindResourceA
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/MapViewOfFileEx
DynamicLoader: kernel32.dll/CreateFileMappingA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/LoadLibraryA
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetStartupInfoA
DynamicLoader: msvcrt.dll/_exit
DynamicLoader: msvcrt.dll/_XcptFilter
DynamicLoader: msvcrt.dll/strcmp
DynamicLoader: msvcrt.dll/_acmdln
DynamicLoader: msvcrt.dll/__getmainargs
DynamicLoader: msvcrt.dll/_initterm
DynamicLoader: msvcrt.dll/__setusermatherr
DynamicLoader: msvcrt.dll/_adjust_fdiv
DynamicLoader: msvcrt.dll/__p__commode
DynamicLoader: msvcrt.dll/__p__fmode
DynamicLoader: msvcrt.dll/__set_app_type
DynamicLoader: msvcrt.dll/_except_handler3
DynamicLoader: msvcrt.dll/_controlfp
DynamicLoader: msvcrt.dll/memcpy
DynamicLoader: msvcrt.dll/exit
DynamicLoader: kernel32.dll/CreateThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: kernel32.dll/TerminateThread
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: kernel32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/LocalAlloc
DynamicLoader: kernel32.dll/UnmapViewOfFile
DynamicLoader: kernel32.dll/GetLastError
DynamicLoader: kernel32.dll/GetCommandLineW
DynamicLoader: kernel32.dll/LocalFree
DynamicLoader: kernel32.dll/DeleteCriticalSection
DynamicLoader: kernel32.dll/ExitProcess
DynamicLoader: kernel32.dll/FormatMessageA
DynamicLoader: kernel32.dll/RaiseException
DynamicLoader: kernel32.dll/VirtualFree
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/WriteConsoleW
DynamicLoader: kernel32.dll/SetFilePointerEx
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/SetStdHandle
DynamicLoader: kernel32.dll/GetConsoleMode
DynamicLoader: kernel32.dll/GetConsoleCP
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/FlushFileBuffers
DynamicLoader: kernel32.dll/GetStringTypeW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/OutputDebugStringW
DynamicLoader: kernel32.dll/EnterCriticalSection
DynamicLoader: kernel32.dll/LeaveCriticalSection
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/UnhandledExceptionFilter
DynamicLoader: kernel32.dll/SetUnhandledExceptionFilter
DynamicLoader: kernel32.dll/GetStartupInfoW
DynamicLoader: kernel32.dll/GetModuleHandleW
DynamicLoader: kernel32.dll/QueryPerformanceCounter
DynamicLoader: kernel32.dll/GetCurrentProcessId
DynamicLoader: kernel32.dll/GetCurrentThreadId
DynamicLoader: kernel32.dll/GetSystemTimeAsFileTime
DynamicLoader: kernel32.dll/InitializeSListHead
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: kernel32.dll/GetModuleFileNameW
DynamicLoader: kernel32.dll/InterlockedFlushSList
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/RtlUnwind
DynamicLoader: kernel32.dll/TlsAlloc
DynamicLoader: kernel32.dll/TlsGetValue
DynamicLoader: kernel32.dll/TlsSetValue
DynamicLoader: kernel32.dll/TlsFree
DynamicLoader: kernel32.dll/FreeLibrary
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/LoadLibraryExW
DynamicLoader: kernel32.dll/MultiByteToWideChar
DynamicLoader: kernel32.dll/GetModuleHandleExW
DynamicLoader: kernel32.dll/WideCharToMultiByte
DynamicLoader: kernel32.dll/HeapFree
DynamicLoader: kernel32.dll/HeapAlloc
DynamicLoader: kernel32.dll/GetACP
DynamicLoader: kernel32.dll/LCMapStringW
DynamicLoader: kernel32.dll/GetStdHandle
DynamicLoader: kernel32.dll/GetFileType
DynamicLoader: kernel32.dll/HeapSize
DynamicLoader: kernel32.dll/HeapReAlloc
DynamicLoader: kernel32.dll/IsValidCodePage
DynamicLoader: kernel32.dll/GetOEMCP
DynamicLoader: kernel32.dll/GetCPInfo
DynamicLoader: kernel32.dll/GetEnvironmentStringsW
DynamicLoader: kernel32.dll/FreeEnvironmentStringsW
DynamicLoader: kernel32.dll/GetProcessHeap
DynamicLoader: kernel32.dll/GetCommandLineA
DynamicLoader: shell32.DLL/CommandLineToArgvW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoree.dll/CorBindToRuntimeEx
DynamicLoader: ADVAPI32.dll/SystemFunction036
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
CAPE extracted potentially suspicious content
IMG09412.PIF: Extracted Shellcode
IMG09412.PIF: Extracted Shellcode
IMG09412.PIF: Extracted PE Image: 32-bit executable
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.24, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x000a0000, virtual_size: 0x0009ff68
Behavioural detection: Injection (Process Hollowing)
Injection: IMG09412.PIF(1192) -> IMG09412.PIF(1132)
Executed a process and injected code into it, probably while unpacking
Injection: IMG09412.PIF(1192) -> IMG09412.PIF(1132)

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Users\user\AppData\Local\Temp\IMG09412.PIF.cfg
C:\Windows\sysnative\C_932.NLS
C:\Windows\sysnative\C_949.NLS
C:\Windows\sysnative\C_950.NLS
C:\Windows\sysnative\C_936.NLS
C:\Windows\SysWOW64\en-US\MSCTF.dll.mui
C:\Windows\Fonts\staticcache.dat
C:\Users\user\AppData\Local\Temp\api-ms-win-core-synch-l1-2-0.DLL
C:\Windows\System32\api-ms-win-core-synch-l1-2-0.DLL
C:\Windows\system\api-ms-win-core-synch-l1-2-0.DLL
C:\Windows\api-ms-win-core-synch-l1-2-0.DLL
C:\Windows\System32\wbem\api-ms-win-core-synch-l1-2-0.DLL
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-core-synch-l1-2-0.DLL
C:\Users\user\AppData\Local\Temp\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\system\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\wbem\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-core-fibers-l1-1-1.DLL
C:\Users\user\AppData\Local\Temp\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\System32\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\system\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\System32\wbem\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Windows\SysWOW64\en-US\MSCTF.dll.mui
C:\Windows\Fonts\staticcache.dat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\IMG09412.PIF
HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{FA445657-9379-11D6-B41A-00065B83EE53}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Keyboard Layout\Toggle
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
\xe1\xa9\xa0\xc9\x8bEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans Serif
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
\xe1\xa9\xa0\xc9\x8bEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
kernel32.dll.IsProcessorFeaturePresent
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
cryptbase.dll.SystemFunction036
oleaut32.dll.OleLoadPictureEx
oleaut32.dll.DispCallFunc
oleaut32.dll.LoadTypeLibEx
oleaut32.dll.UnRegisterTypeLib
oleaut32.dll.CreateTypeLib2
oleaut32.dll.VarDateFromUdate
oleaut32.dll.VarUdateFromDate
oleaut32.dll.GetAltMonthNames
oleaut32.dll.VarNumFromParseNum
oleaut32.dll.VarParseNumFromStr
oleaut32.dll.VarDecFromR4
oleaut32.dll.VarDecFromR8
oleaut32.dll.VarDecFromDate
oleaut32.dll.VarDecFromI4
oleaut32.dll.VarDecFromCy
oleaut32.dll.VarR4FromDec
oleaut32.dll.GetRecordInfoFromTypeInfo
oleaut32.dll.GetRecordInfoFromGuids
oleaut32.dll.SafeArrayGetRecordInfo
oleaut32.dll.SafeArraySetRecordInfo
oleaut32.dll.SafeArrayGetIID
oleaut32.dll.SafeArraySetIID
oleaut32.dll.SafeArrayCopyData
oleaut32.dll.SafeArrayAllocDescriptorEx
oleaut32.dll.SafeArrayCreateEx
oleaut32.dll.VarFormat
oleaut32.dll.VarFormatDateTime
oleaut32.dll.VarFormatNumber
oleaut32.dll.VarFormatPercent
oleaut32.dll.VarFormatCurrency
oleaut32.dll.VarWeekdayName
oleaut32.dll.VarMonthName
oleaut32.dll.VarAdd
oleaut32.dll.VarAnd
oleaut32.dll.VarCat
oleaut32.dll.VarDiv
oleaut32.dll.VarEqv
oleaut32.dll.VarIdiv
oleaut32.dll.VarImp
oleaut32.dll.VarMod
oleaut32.dll.VarMul
oleaut32.dll.VarOr
oleaut32.dll.VarPow
oleaut32.dll.VarSub
oleaut32.dll.VarXor
oleaut32.dll.VarAbs
oleaut32.dll.VarFix
oleaut32.dll.VarInt
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarRound
oleaut32.dll.VarCmp
oleaut32.dll.VarDecAdd
oleaut32.dll.VarDecCmp
oleaut32.dll.VarBstrCat
oleaut32.dll.VarCyMulI4
oleaut32.dll.VarBstrCmp
ole32.dll.CoCreateInstanceEx
ole32.dll.CLSIDFromProgIDEx
sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary
user32.dll.GetSystemMetrics
user32.dll.MonitorFromWindow
user32.dll.MonitorFromRect
user32.dll.MonitorFromPoint
user32.dll.EnumDisplayMonitors
user32.dll.GetMonitorInfoA
ole32.dll.CoInitializeEx
ole32.dll.CoUninitialize
ole32.dll.CoRegisterInitializeSpy
ole32.dll.CoRevokeInitializeSpy
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryValueExW
advapi32.dll.RegCloseKey
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
gdi32.dll.GetTextFaceAliasW
gdi32.dll.GetTextExtentExPointWPri
kernel32.dll.GetTickCount
kernel32.dll.Sleep
kernel32.dll.TerminateProcess
user32.dll.EnumWindows
kernel32.dll.SetErrorMode
kernel32.dll.SetLastError
kernel32.dll.CloseHandle
shell32.dll.ShellExecuteW
kernel32.dll.WriteFile
kernel32.dll.CreateFileW
kernel32.dll.VirtualProtectEx
kernel32.dll.CreateProcessInternalW
kernel32.dll.GetTempPathW
kernel32.dll.GetLongPathNameW
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.ExitThread
kernel32.dll.GetCurrentThread
ntdll.dll.NtProtectVirtualMemory
ntdll.dll.DbgBreakPoint
ntdll.dll.DbgUiRemoteBreakin
ntdll.dll.NtSetInformationThread
ntdll.dll.NtAllocateVirtualMemory
ntdll.dll.NtGetContextThread
ntdll.dll.NtSetContextThread
user32.dll.GetCursorPos
ntdll.dll.NtResumeThread
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetStartupInfoW
kernel32.dll.SizeofResource
kernel32.dll.LockResource
kernel32.dll.LoadResource
kernel32.dll.FindResourceA
kernel32.dll.VirtualAlloc
kernel32.dll.MapViewOfFileEx
kernel32.dll.CreateFileMappingA
kernel32.dll.GetProcAddress
kernel32.dll.LoadLibraryA
kernel32.dll.GetModuleHandleA
kernel32.dll.GetStartupInfoA
msvcrt.dll._exit
msvcrt.dll._XcptFilter
msvcrt.dll.strcmp
msvcrt.dll._acmdln
msvcrt.dll.__getmainargs
msvcrt.dll._initterm
msvcrt.dll.__setusermatherr
msvcrt.dll._adjust_fdiv
msvcrt.dll.__p__commode
msvcrt.dll.__p__fmode
msvcrt.dll.__set_app_type
msvcrt.dll._except_handler3
msvcrt.dll._controlfp
msvcrt.dll.memcpy
msvcrt.dll.exit
kernel32.dll.CreateThread
kernel32.dll.TerminateThread
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.LocalAlloc
kernel32.dll.UnmapViewOfFile
kernel32.dll.GetLastError
kernel32.dll.GetCommandLineW
kernel32.dll.LocalFree
kernel32.dll.DeleteCriticalSection
kernel32.dll.ExitProcess
kernel32.dll.FormatMessageA
kernel32.dll.RaiseException
kernel32.dll.VirtualFree
kernel32.dll.WriteConsoleW
kernel32.dll.SetFilePointerEx
kernel32.dll.SetStdHandle
kernel32.dll.GetConsoleMode
kernel32.dll.GetConsoleCP
kernel32.dll.FlushFileBuffers
kernel32.dll.GetStringTypeW
kernel32.dll.IsDebuggerPresent
kernel32.dll.OutputDebugStringW
kernel32.dll.EnterCriticalSection
kernel32.dll.LeaveCriticalSection
kernel32.dll.UnhandledExceptionFilter
kernel32.dll.SetUnhandledExceptionFilter
kernel32.dll.GetModuleHandleW
kernel32.dll.QueryPerformanceCounter
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.InitializeSListHead
kernel32.dll.GetCurrentProcess
kernel32.dll.GetModuleFileNameW
kernel32.dll.InterlockedFlushSList
kernel32.dll.RtlUnwind
kernel32.dll.TlsAlloc
kernel32.dll.TlsGetValue
kernel32.dll.TlsSetValue
kernel32.dll.TlsFree
kernel32.dll.FreeLibrary
kernel32.dll.LoadLibraryExW
kernel32.dll.MultiByteToWideChar
kernel32.dll.GetModuleHandleExW
kernel32.dll.WideCharToMultiByte
kernel32.dll.HeapFree
kernel32.dll.HeapAlloc
kernel32.dll.GetACP
kernel32.dll.LCMapStringW
kernel32.dll.GetStdHandle
kernel32.dll.GetFileType
kernel32.dll.HeapSize
kernel32.dll.HeapReAlloc
kernel32.dll.IsValidCodePage
kernel32.dll.GetOEMCP
kernel32.dll.GetCPInfo
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.GetProcessHeap
kernel32.dll.GetCommandLineA
shell32.dll.CommandLineToArgvW
oleaut32.dll.#23
oleaut32.dll.#16
oleaut32.dll.#8
oleaut32.dll.#2
oleaut32.dll.#26
oleaut32.dll.#24
oleaut32.dll.#15
oleaut32.dll.#411
oleaut32.dll.#9
mscoree.dll.CorBindToRuntimeEx
advapi32.dll.SystemFunction036
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.FlsAlloc
kernel32.dll.FlsSetValue
advapi32.dll.EventRegister
kernel32.dll.FlsGetValue
kernel32.dll.LCMapStringEx
"C:\Users\user\AppData\Local\Temp\IMG09412.PIF"
Local\MSCTF.Asm.MutexDefault1

PE Information

Image Base 0x00400000
Entry Point 0x00401224
Reported Checksum 0x000aa1ae
Actual Checksum 0x000aa1ae
Minimum OS Version 4.0
Compile Time 2014-11-21 10:06:25
Import Hash 8bcded09b38d1f07c80ae4751385732f

Sections

Name Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00001000 0x0009ff68 0x000a0000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.24
.data 0x000a1000 0x000009f0 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rsrc 0x000a2000 0x000008c0 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1.93

Imports

Library MSVBVM60.DLL:
0x401000 _CIcos
0x401004 _adj_fptan
0x401008 __vbaFreeVar
0x40100c _adj_fdiv_m64
0x401010 _adj_fprem1
0x401018 _adj_fdiv_m32
0x40101c None
0x401020 _adj_fdiv_m16i
0x401024 _adj_fdivr_m16i
0x401028 _CIsin
0x40102c __vbaChkstk
0x401030 EVENT_SINK_AddRef
0x401034 _adj_fpatan
0x401038 EVENT_SINK_Release
0x40103c _CIsqrt
0x401044 __vbaExceptHandler
0x401048 _adj_fprem
0x40104c _adj_fdivr_m64
0x401050 __vbaI2Str
0x401054 __vbaFPException
0x401058 _CIlog
0x40105c _adj_fdiv_m32i
0x401060 _adj_fdivr_m32i
0x401064 __vbaI4Str
0x401068 _adj_fdivr_m32
0x40106c _adj_fdiv_r
0x401070 None
0x401074 __vbaFpI4
0x401078 _CIatan
0x40107c _allmul
0x401080 _CItan
0x401084 __vbaFPInt
0x401088 _CIexp

.text
`.data
.rsrc
MSVBVM60.DLL
@x"]A
otoxingillERMALL6
KondirjaHypnotoxin
KondirjaWhirrs5
KondirjaWhirrs5
Kondirjaepitonion7
KondirjaRegerminate
wwxwp
opp?qqq
{[PILl
$4=Eg
-9BEY
y]?@]w
&4?EEy
"/=DEP
.9BEEv
*5BEEX
*>OWi
tE4:KWo
!,<DEG}
-5BEHv
%4?EGk
!0=DGx
*9CHy
%*(1xvh
v.RRRRRO,:
v2RRRRRRJ0
v/RRRRRRP>W
v0RRRRRRRP3n
v0RRRRRRRRL;
v2RRRRRRRRR;{
t.RRRRRRRRREJ
u)PRRRRRRRRO4
t%POF?GQRRRR9s
+JRRRJC
FRRP/
FRRCY
%OR>^
,QP<w
%OR?Y
#MP=_
`^OEB94HV
*NRG:
9OQBJ
K&$/5=DE6[
BPPB]
*&6=>CEEJA=
'HRQ9]
=!45=BBDGH3`
!/JRO6d
*/59ABBEE)
!#"/HRO9o
").45;?>BA=
&%"/LRM4o
"(-059;>>/bP
(((:MRM2q
&*-067:9$
"1MJ=
#"+--9MRM9f
!%*-/15*P
#'*BOCC
%2//:NRM6d
)**0HQ=Z
%543?MQM6a
!$%)P?
!**,7KP=d
(#454:JPQCJ
%-04=MO9`
,66:CNO6a
4647GQRL9N
4:=?DNO=[
0614CORQH=\
4?>BGOPC:a
3BDDHORNB;a
-BG,J
4DIKLNQRROJ=94**2B9*$*?LPQQOLHCCEKNOD$\
&'-6]
**+?^v
,=<==AEIKKLNNNK=;59E
;==;.&$$&&(,15;EFIIE;14E
;1,&$'4I1.4
KWWWW!
EYWTE
!,5=A
<;<==6
1==F;
11(""%%)14;4))4
1,(0(
z{zccc
vvvMMM
(((434ZZZ
@@@<<<666<<<IIJfff
%%%000:::xxx
kklNNO:::334???___
"""-,,777AA@
___JJJ@@AEEEggg
***444<==OOO
666[[[
&&&111:::AAAkkk
+++SSS
+++555>>>BBBVVV
vvvQQQ;;;===OOOooo
222WWW
(((222;;;AAABBB{{{
$$$///999@@@BBBKKK
!!!--,666>>>BBBBBB{{{
)))443<<<AAABBBVVV
)))<<<NNNZZZppp
%%&000:::@@@BBBJJJ
qqq;;;///777HHHYYYsss
++*554===ABACCCnnn
'''222;;;@@@DDDj)j
$$#///999@@@EEEwww
,++655>>>HHH{){
DDDsss
NNNXXX
EEEopoiii
kkk~~~
vvviii
wxwddd
lmluuu
}}}xxx
\\]--.PPOOOOOOOOOOOOONNNE,-555
UUV..0PPOOOOOOOOOOOOOOOOGGG--.
UUV..0PPOOOOOOOOOOEOOOOOOOO<<=FFG
UUV..0PPOOOOOOOOOOOOOOOOOOONNN//1qqq
UUU../PPOOOOEOOOOOOOOOOOOOOOOOIIJ778
UUV../OOOOOOOOOOOOOOOOOOOOOOOOOOO667~~~
OOOOOOOOOOOOOOOOOOOOPPOBBCBBC
iij&&)OOOOOOOOOPPPOOOOOOOOOOOOOOOMML--.
OOMMMAAB::;DDENNNOOOOOOOOOOOO556ggh
++,HHHOOOOOOOOOFFG445
BBCOOOOOONNN--.
BBCOOOOOO>>?IIJ
GGHOOOKKL002
%%&MMMOOO<<=]]^
??@OOOKKL,,-
KKLOOO;;<IIJ
446OOONNN//0{{|
GGHOOOEEF334
,+,NNNOOO667nno
AABPPPKLK001
%%'MMMPPO;;;PPP
889OOOMMM.-/
CCDOOPEEF445
%%&KKLOOO878]]]
889OOOMMM335
~~~yyy
CCDOOPHHH002
ccccdcMMM@A@<=<777121CCCXXX
))*KKLPPPCCD223
III@@@TTT
667NNNOOO>>?BBB
CCC"""###---555:::???@@@222NNN
==>JJJ112
>>?OOOOOO<<=HHI
'''333888<<<???BBBEEEFFF===888
//0NNN//0
''(EEFOOONNN446SSS
333!!!000444888<<<???BBBEEDFFF111aaa
""#JJJ??@NNN
!!!!!!,-.GGGOOOMMM113ccd
***///333777;::>>>AAACCBCCC'''
>>?MMN001
###$$$$$%..0FFHOOOLLM445vvv
###***...222666998;;;>>>@@@<<<555
//0NNN>>?JJK
'''''''''113IIJOOOKKL112xxx
$$$(((,,,///333666999;;;===///aaa
$$%CCDMMM224
*+****+**667JJKOOOJJJ//0xxx
"""%&&)))---000333565777777%%%
!!!"##//0KKKEEF889
###...------668JJKOOOKKK556iij
###&&&*)),,,///121333)))===
##$%%%(((;;<NNN==>==?
&&&010///.//779KKLOOOLLM224aab
%%%((()))///EEEOOO99:LLM
24UUV
"""%%%''')))###555
!!!)**,,,...555HHINNO88:aab
$##323333221778GGIOOONNN==>??A
'''/./010222::;KKLNNN445___
333443211446EEGOOOOOOBBC112uuv
---233454666>>?LLLMMM335]]^
111444111444DDENNNPOOJJJ335JJK
000766988:::@@ALLMMMN889RRS
///333111112>>@MMMOOOOOODDF667RRS
((* "ggg
322:::<<<=>=CDDMMNNNN==>445[[\
..0--/EEE
222===?@?AAAFFGMMMOOOLLL==>666ZZ[
99;556::;
*)+>>>EEF++,AAB
222BBBFFFGGHIIJKKLNNNOOOOOPNNNGGH;;<555000((*((*//1==>557))*##$**,::<IIJNNNOOOOOONNNJJKEEF@@A@@@AABHHHMMMMMN??@##$MMM
$$%%%&$$&../QQQ
!!"))(;;;OOOggg
+++iii
ggg"##<<<
666LLL
...AAA
fff
&&&jkj
VVVPPPPPP>>>
TTUPPOPPPLLM
WWWPPPPPPPPPCCD
YYZ556))*KKKJJK
JJKdde
>>?VVW
001DDD
EEFffg
jkjbcbjkj
JJJ+++777SSS
112GGH
>>>222;;;CCCmmm
223XXX
[[[&&&889GGG
CCC""",-,555777
&&&CCD~~~
PPP...<<=HHI
$$$+++:::
$$$445EEF
ccc...::;JJKggh
~~~/..>>?GGGuuu
""#223TTU
<<<667>>>???999445777445444889BBC[[[
iii'''222
333;;;
%%%{{{
+++<<<
"""&&&###***efe
BBBPPQ
FFFNNNGGH
666FFG$$$UUV
555000
999556ccc
111888:::
&&&SST
999===dee
((( ,,,iii
JJJ:::``a
TTT!!!)))OPO
---uuu
}}}889
LLMuuu==>nno+++>>?
KondirjaFOREDAFA
KondirjaCYCLOCEPHALY0
Kondirjacoolheadedness6
KondirjaCOCONUCAN
KondirjaBheer
KondirjaGHATTA
Kondirjafrontcourt4
KondirjaIrremunerable9
KondirjaSUGAMO
.[^Un
.[4e7
5{hNa
,[\Ul$
>QvUn
.[\un$
b]S3?
\Iv0?
KD@$y
.WXUnu
\Y^UVI
.[_In$
^Ud"m
,[^SdW
.[^Sn
[^_d"
.[^\W
[^_}"
8l?]ODP,
Z^UFm
#fLa'
xY^_})
.[LRF{
*s<Wn.
Z^Unb
.X^=d$
/[eEn$
-\_\g$
[O<i$
.[^Un$
VB5!6&*
FRyou
gillERMALL5
gillERMALL6
gillERMALL6
KondirjaHypnotoxin
KondirjaSUGAMO
C:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
Kondirjafrontcourt4
Kondirjacoolheadedness6
Kondirjaepitonion7
KondirjaBheer
KondirjaFOREDAFA
KondirjaHypnotoxin3
VBA6.DLL
__vbaFreeVar
__vbaFPInt
__vbaFpI4
__vbaI2Str
__vbaI4Str
__vbaHresultCheckObj
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaFreeVar
_adj_fdiv_m64
_adj_fprem1
__vbaHresultCheckObj
_adj_fdiv_m32
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaI4Str
_adj_fdivr_m32
_adj_fdiv_r
__vbaFpI4
_CIatan
_allmul
_CItan
__vbaFPInt
_CIexp
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
Comments
cibero
ProductName
gillERMALL5
FileVersion
ProductVersion
InternalName
FRyou
OriginalFilename
FRyou.exe
This file is not on VirusTotal.

Process Tree


IMG09412.PIF, PID: 1192, Parent PID: 1512
Full Path: C:\Users\user\AppData\Local\Temp\IMG09412.PIF
Command Line: "C:\Users\user\AppData\Local\Temp\IMG09412.PIF"
IMG09412.PIF, PID: 1132, Parent PID: 1192
Full Path: C:\Users\user\AppData\Local\Temp\IMG09412.PIF
Command Line: "C:\Users\user\AppData\Local\Temp\IMG09412.PIF"

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Type Extracted Shellcode
Size 40960 bytes
Virtual Address 0x00240000
Process IMG09412.PIF
PID 1192
Path C:\Users\user\AppData\Local\Temp\IMG09412.PIF
MD5 1788f9f8545675ad07b7d92e60f50f6d
SHA1 3663bf898bf65fe4be6c69e19d90303ee4d9db10
SHA256 012923cb0d427b1f5e9ba1c8a931a5ccd4ba45942aec4786f89be25ad0ed4604
CRC32 E11CB357
Ssdeep 192:ezlZwJw4R8Zc2yRLugOJ2cUUj4B701ZG0cY0jTd2KO9Lu7CWmSjl9Fkzp3l/b7Uo:ezYRF2yRR15Uj4B7017cdO67nUddUo
Yara None matched
CAPE Yara None matched
Download Download ZIP
Type Extracted Shellcode
Size 53248 bytes
Virtual Address 0x004B0000
Process IMG09412.PIF
PID 1192
Path C:\Users\user\AppData\Local\Temp\IMG09412.PIF
MD5 1036b94bc4fec46c5f069697c3d4bd84
SHA1 f08f186da36fbd4abfa4b696bd86821c650dd6f8
SHA256 c05d77954da7a5b0beec5e43c245afa404572045783dcfbfaf36be15b0be1f6d
CRC32 378C4CF0
Ssdeep 768:f3OEXn7HiDXj0d+CZZyyvi/n+pUI0JDcPpVvLEEIXIUIrSjo:f3OmZivmIcPpVvKo
Yara
  • embedded_win_api - A non-Windows executable contains win32 API functions names
  • shellcode_patterns - Matched shellcode byte patterns
CAPE Yara None matched
Download Download ZIP
Type Extracted PE Image: 32-bit executable
Size 4096 bytes
Virtual Address 0x00400000
Process IMG09412.PIF
PID 1132
Path C:\Users\user\AppData\Local\Temp\IMG09412.PIF
MD5 c294833f808e74a0b42b4584e30aba72
SHA1 f4339bf6772bd71c19cc7e343819f9207d62c9ca
SHA256 41e38048650d0fb2dc6503eb7f05996cb919493f353ab4df9347083b6572eb87
CRC32 F8961D2E
Ssdeep 48:CDB5+h77NMuU0PcaRr6WrTToJseUD+MlI8xcLPElTwfj2G3XPtboyl1M:EA7qCrTczUJxczENu2UPtboynM
Yara None matched
CAPE Yara None matched
Download Download ZIP
Sorry! No process dumps.

Comments



No comments posted

Processing ( 1.554 seconds )

  • 0.44 Static
  • 0.432 CAPE
  • 0.297 TargetInfo
  • 0.141 TrID
  • 0.098 BehaviorAnalysis
  • 0.092 Deduplicate
  • 0.041 Strings
  • 0.007 NetworkAnalysis
  • 0.005 AnalysisInfo
  • 0.001 Debug

Signatures ( 0.08 seconds )

  • 0.011 antiav_detectreg
  • 0.008 ransomware_files
  • 0.005 infostealer_ftp
  • 0.004 stealth_timeout
  • 0.004 antiav_detectfile
  • 0.003 antidbg_windows
  • 0.003 persistence_autorun
  • 0.003 decoy_document
  • 0.003 infostealer_im
  • 0.003 ransomware_extensions
  • 0.002 antivm_vbox_libs
  • 0.002 NewtWire Behavior
  • 0.002 api_spamming
  • 0.002 dynamic_function_loading
  • 0.002 antianalysis_detectreg
  • 0.002 browser_security
  • 0.002 infostealer_bitcoin
  • 0.002 infostealer_mail
  • 0.001 tinba_behavior
  • 0.001 malicious_dynamic_function_loading
  • 0.001 rat_nanocore
  • 0.001 exploit_getbasekerneladdress
  • 0.001 antiemu_wine_func
  • 0.001 betabot_behavior
  • 0.001 exploit_gethaldispatchtable
  • 0.001 exec_crash
  • 0.001 infostealer_browser_password
  • 0.001 cerber_behavior
  • 0.001 kovter_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antivm_vbox_files
  • 0.001 antivm_vbox_keys
  • 0.001 geodo_banking_trojan
  • 0.001 disables_browser_warn
  • 0.001 masquerade_process_name

Reporting ( 0.001 seconds )

  • 0.001 CompressResults
Task ID 121543
Mongo ID 5e1ddb4bb84a07bce5476b89
Cuckoo release 1.3-CAPE
Delete