Try VMRay Platform
Malicious
Classifications

Injector Downloader

Threat Names

SmokeLoader Mal/Generic-S Mal/HTMLGen-A

Dynamic Analysis Report

Created on 2022-01-09T18:09:00

08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe

Windows Exe (x86-32)
...

Remarks (2/2)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "2 hours, 3 minutes, 43 seconds" to "27 seconds" to reveal dormant functionality.

(0x0200003A): A task was rescheduled ahead of time to reveal dormant functionality.

Remarks

(0x0200004A): 7 dumps were skipped because they exceeded the maximum dump size of 7 MB. The largest one was 39 MB.

(0x0200005D): 456 additional dumps with the reason "Content Changed" and a total of 2251 MB were skipped because the respective maximum limit was reached.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe Sample File Binary
malicious
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\Roaming\bcatcih (Dropped File)
MIME Type application/vnd.microsoft.portable-executable
File Size 292.00 KB
MD5 246b41453b996bfa14f60d4785e598ac Copy to Clipboard
SHA1 977b7d8cc4237ca4c8a2268aedfff4d83c7d0a86 Copy to Clipboard
SHA256 08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec Copy to Clipboard
SSDeep 6144:Sgs+Lk1QNJlgD6g++0MGnyIh41uzbgwuJ2:SO8QNJlK6g++eh41unnb Copy to Clipboard
ImpHash 09aef69c73de8322563f63d55badb1aa Copy to Clipboard
File Reputation Information
»
Verdict
malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x400000
Entry Point 0x401eaf
Size Of Code 0x10a00
Size Of Initialized Data 0x2774600
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2021-02-13 14:27:02+00:00
Version Information (3)
»
InternationalName bomgvioci.iwa
Copyright Copyrighz (C) 2021, fudkort
ProjectVersion 3.14.70.27
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x108f9 0x10a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.7
.rdata 0x412000 0x1fc78 0x1fe00 0x10e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.52
.data 0x432000 0x273bbb8 0x8600 0x30c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.72
.rsrc 0x2b6e000 0xfe00 0xfe00 0x39200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 6.5
Imports (2)
»
KERNEL32.dll (102)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DosDateTimeToFileTime - 0x412000 0x31358 0x30158 0xd0
FindResourceExW - 0x412004 0x3135c 0x3015c 0x138
InterlockedIncrement - 0x412008 0x31360 0x30160 0x2c0
GetConsoleAliasA - 0x41200c 0x31364 0x30164 0x179
GetCurrentActCtx - 0x412010 0x31368 0x30168 0x1a4
WriteConsoleInputA - 0x412014 0x3136c 0x3016c 0x483
GetConsoleAliasesLengthA - 0x412018 0x31370 0x30170 0x180
GetConsoleTitleA - 0x41201c 0x31374 0x30174 0x19e
ReadConsoleW - 0x412020 0x31378 0x30178 0x366
SetFileTime - 0x412024 0x3137c 0x3017c 0x3e3
InitializeCriticalSection - 0x412028 0x31380 0x30180 0x2b4
GlobalAlloc - 0x41202c 0x31384 0x30184 0x285
TerminateThread - 0x412030 0x31388 0x30188 0x42e
GetLocaleInfoW - 0x412034 0x3138c 0x3018c 0x1ea
SwitchToFiber - 0x412038 0x31390 0x30190 0x428
ReadConsoleInputA - 0x41203c 0x31394 0x30194 0x35d
ReadFileScatter - 0x412040 0x31398 0x30198 0x36a
DnsHostnameToComputerNameW - 0x412044 0x3139c 0x3019c 0xcf
GetWriteWatch - 0x412048 0x313a0 0x301a0 0x282
GetFileAttributesW - 0x41204c 0x313a4 0x301a4 0x1ce
WriteConsoleW - 0x412050 0x313a8 0x301a8 0x48c
SetComputerNameExW - 0x412054 0x313ac 0x301ac 0x3a3
CreateActCtxA - 0x412058 0x313b0 0x301b0 0x67
GetLongPathNameW - 0x41205c 0x313b4 0x301b4 0x1f2
SetLastError - 0x412060 0x313b8 0x301b8 0x3ec
GetProcAddress - 0x412064 0x313bc 0x301bc 0x220
VirtualAlloc - 0x412068 0x313c0 0x301c0 0x454
GetAtomNameA - 0x41206c 0x313c4 0x301c4 0x155
HeapLock - 0x412070 0x313c8 0x301c8 0x2a2
OpenJobObjectW - 0x412074 0x313cc 0x301cc 0x32e
GetModuleFileNameA - 0x412078 0x313d0 0x301d0 0x1f4
SetConsoleTitleW - 0x41207c 0x313d4 0x301d4 0x3c2
GetModuleHandleA - 0x412080 0x313d8 0x301d8 0x1f6
GetStringTypeW - 0x412084 0x313dc 0x301dc 0x240
ReleaseMutex - 0x412088 0x313e0 0x301e0 0x377
GetVersionExA - 0x41208c 0x313e4 0x301e4 0x275
EnumCalendarInfoExA - 0x412090 0x313e8 0x301e8 0xdb
SwitchToThread - 0x412094 0x313ec 0x301ec 0x429
HeapAlloc - 0x412098 0x313f0 0x301f0 0x29d
GetStartupInfoW - 0x41209c 0x313f4 0x301f4 0x23a
TerminateProcess - 0x4120a0 0x313f8 0x301f8 0x42d
GetCurrentProcess - 0x4120a4 0x313fc 0x301fc 0x1a9
UnhandledExceptionFilter - 0x4120a8 0x31400 0x30200 0x43e
SetUnhandledExceptionFilter - 0x4120ac 0x31404 0x30204 0x415
IsDebuggerPresent - 0x4120b0 0x31408 0x30208 0x2d1
DeleteCriticalSection - 0x4120b4 0x3140c 0x3020c 0xbe
LeaveCriticalSection - 0x4120b8 0x31410 0x30210 0x2ef
EnterCriticalSection - 0x4120bc 0x31414 0x30214 0xd9
HeapFree - 0x4120c0 0x31418 0x30218 0x2a1
VirtualFree - 0x4120c4 0x3141c 0x3021c 0x457
HeapReAlloc - 0x4120c8 0x31420 0x30220 0x2a4
HeapCreate - 0x4120cc 0x31424 0x30224 0x29f
GetModuleHandleW - 0x4120d0 0x31428 0x30228 0x1f9
Sleep - 0x4120d4 0x3142c 0x3022c 0x421
ExitProcess - 0x4120d8 0x31430 0x30230 0x104
WriteFile - 0x4120dc 0x31434 0x30234 0x48d
GetStdHandle - 0x4120e0 0x31438 0x30238 0x23b
RtlUnwind - 0x4120e4 0x3143c 0x3023c 0x392
GetLastError - 0x4120e8 0x31440 0x30240 0x1e6
TlsGetValue - 0x4120ec 0x31444 0x30244 0x434
TlsAlloc - 0x4120f0 0x31448 0x30248 0x432
TlsSetValue - 0x4120f4 0x3144c 0x3024c 0x435
TlsFree - 0x4120f8 0x31450 0x30250 0x433
GetCurrentThreadId - 0x4120fc 0x31454 0x30254 0x1ad
InterlockedDecrement - 0x412100 0x31458 0x30258 0x2bc
SetHandleCount - 0x412104 0x3145c 0x3025c 0x3e8
GetFileType - 0x412108 0x31460 0x30260 0x1d7
GetStartupInfoA - 0x41210c 0x31464 0x30264 0x239
GetModuleFileNameW - 0x412110 0x31468 0x30268 0x1f5
FreeEnvironmentStringsW - 0x412114 0x3146c 0x3026c 0x14b
GetEnvironmentStringsW - 0x412118 0x31470 0x30270 0x1c1
GetCommandLineW - 0x41211c 0x31474 0x30274 0x170
QueryPerformanceCounter - 0x412120 0x31478 0x30278 0x354
GetTickCount - 0x412124 0x3147c 0x3027c 0x266
GetCurrentProcessId - 0x412128 0x31480 0x30280 0x1aa
GetSystemTimeAsFileTime - 0x41212c 0x31484 0x30284 0x24f
SetFilePointer - 0x412130 0x31488 0x30288 0x3df
WideCharToMultiByte - 0x412134 0x3148c 0x3028c 0x47a
GetConsoleCP - 0x412138 0x31490 0x30290 0x183
GetConsoleMode - 0x41213c 0x31494 0x30294 0x195
GetCPInfo - 0x412140 0x31498 0x30298 0x15b
GetACP - 0x412144 0x3149c 0x3029c 0x152
GetOEMCP - 0x412148 0x314a0 0x302a0 0x213
IsValidCodePage - 0x41214c 0x314a4 0x302a4 0x2db
InitializeCriticalSectionAndSpinCount - 0x412150 0x314a8 0x302a8 0x2b5
LoadLibraryA - 0x412154 0x314ac 0x302ac 0x2f1
CloseHandle - 0x412158 0x314b0 0x302b0 0x43
CreateFileA - 0x41215c 0x314b4 0x302b4 0x78
RaiseException - 0x412160 0x314b8 0x302b8 0x35a
SetStdHandle - 0x412164 0x314bc 0x302bc 0x3fc
WriteConsoleA - 0x412168 0x314c0 0x302c0 0x482
GetConsoleOutputCP - 0x41216c 0x314c4 0x302c4 0x199
MultiByteToWideChar - 0x412170 0x314c8 0x302c8 0x31a
LCMapStringA - 0x412174 0x314cc 0x302cc 0x2e1
LCMapStringW - 0x412178 0x314d0 0x302d0 0x2e3
GetStringTypeA - 0x41217c 0x314d4 0x302d4 0x23d
GetLocaleInfoA - 0x412180 0x314d8 0x302d8 0x1e8
HeapSize - 0x412184 0x314dc 0x302dc 0x2a6
FlushFileBuffers - 0x412188 0x314e0 0x302e0 0x141
SetEndOfFile - 0x41218c 0x314e4 0x302e4 0x3cd
GetProcessHeap - 0x412190 0x314e8 0x302e8 0x223
ReadFile - 0x412194 0x314ec 0x302ec 0x368
USER32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ShowCaret - 0x41219c 0x314f4 0x302f4 0x2b2
Memory Dumps (7)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
buffer 1 0x02C50000 0x02C58FFF First Execution False 32-bit 0x02C50000 False
...
buffer 1 0x02C60000 0x02C68FFF First Execution False 32-bit 0x02C60000 False
...
buffer 2 0x00400000 0x00408FFF First Execution False 32-bit 0x00402F47 False
...
buffer 2 0x00400000 0x00408FFF Content Changed False 32-bit 0x0040283D False
...
buffer 2 0x01E40000 0x01E55FFF Marked Executable False 32-bit - True
...
buffer 2 0x00400000 0x00408FFF Process Termination False 32-bit - False
...
buffer 2 0x004F0000 0x004F5FFF Process Termination False 32-bit - True
...
C:\Users\RDHJ0C~1\AppData\Local\Temp\6951.exe Downloaded File Binary
malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 982.00 KB
MD5 8d5156fdabb28dc8146237b8b8e34758 Copy to Clipboard
SHA1 029e58f616c8a51c060458de32a302bb2bf59b57 Copy to Clipboard
SHA256 4b879bc589e17a5e6f70b1aa7b757435eaca9d96fd0e4123c92e5b072df2276e Copy to Clipboard
SSDeep 12288:WwspTk05ZjoqRCJPUnyQbIkW79mQ3Cezr7aQq/O6j:PZStPCJPijtGmeznhaj Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
File Reputation Information
»
Verdict
malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x400000
Entry Point 0x4f6c8e
Size Of Code 0xf4e00
Size Of Initialized Data 0x800
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2059-05-22 02:30:43+00:00
Version Information (11)
»
Comments cxUMnUv
CompanyName RgnVeIfBj
FileDescription cxUMnUv
FileVersion 2.13.72.61
InternalName ycvlCbh.exe
LegalCopyright Copyright © 2021 RgnVeIfBj
LegalTrademarks -
OriginalFilename ycvlCbh.exe
ProductName cxUMnUv
ProductVersion 2.13.72.61
Assembly Version 2.13.72.61
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x402000 0xf4c94 0xf4e00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.92
.rsrc 0x4f8000 0x5de 0x600 0xf5000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.28
.reloc 0x4fa000 0xc 0x200 0xf5600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.1
Imports (1)
»
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain - 0x402000 0xf6c64 0xf4e64 0x0
Memory Dumps (1)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
6951.exe 7 0x00400000 0x004FBFFF Relevant Image False 32-bit - False
...
C:\Users\RDHJ0C~1\AppData\Local\Temp\6951.tmp Dropped File Unknown
clean
...
  • Actions
»
MIME Type -
File Size 0 Bytes
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
C:\Users\RDHJ0C~1\AppData\Local\Temp\AA17.exe Downloaded File Binary
clean
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 1.76 MB
MD5 42998272cc32a403814ec2ce7a60b8c5 Copy to Clipboard
SHA1 28447cc003a78bffc96a067dd5ac907a5abe4b6f Copy to Clipboard
SHA256 c3745ed5450b57bc96b753d6f782eca7f48b2b53d0c881b3164d0dcacd4b941e Copy to Clipboard
SSDeep 49152:RUNx4tTPILbykKH/L8tSgiw5A83hjb/Z:2NxSTPxkeD8oGRtZ Copy to Clipboard
ImpHash 6ed4f5f04d62b18d96b26d6db7c18840 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x8fe9a0
Size Of Code 0x1c2000
Size Of Initialized Data 0x1000
Size Of Uninitialized Data 0x33c000
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.amd64
Compile Timestamp 1970-01-01 00:00:00+00:00
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
UPX0 0x401000 0x33c000 0x0 0x200 IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
UPX1 0x73d000 0x1c2000 0x1c1c00 0x200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.87
UPX2 0x8ff000 0x1000 0x200 0x1c1e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.37
Imports (1)
»
KERNEL32.DLL (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LoadLibraryA - 0x8ff028 0x4ff028 0x1c1e28 0x0
ExitProcess - 0x8ff030 0x4ff030 0x1c1e30 0x0
GetProcAddress - 0x8ff038 0x4ff038 0x1c1e38 0x0
VirtualProtect - 0x8ff040 0x4ff040 0x1c1e40 0x0
Memory Dumps (25)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
aa17.exe 6 0x00400000 0x008FFFFF First Execution False 64-bit 0x008FE9A0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00440D60 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00447DC0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00403E70 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00445830 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00444F10 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00451CB0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00428A30 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x0040D1C0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00408710 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x004360D0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x004166B0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00420F60 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x0045FA10 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00427EE0 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x00421090 False
...
aa17.exe 6 0x00400000 0x008FFFFF Content Changed False 64-bit 0x0045A6D3 False
...
buffer 6 0x00160000 0x0019FFFF Final Dump False 64-bit - False
...
buffer 6 0x001A0000 0x001C1FFF Final Dump False 64-bit - False
...
buffer 6 0x001D0000 0x001DFFFF Final Dump False 64-bit - False
...
buffer 6 0x001E0000 0x001EFFFF Final Dump False 64-bit - False
...
buffer 6 0x00B00000 0x00B3FFFF Final Dump False 64-bit - False
...
buffer 6 0x039D0000 0x03A0FFFF Final Dump False 64-bit - False
...
buffer 6 0xC000000000 0xC0003FFFFF Final Dump False 64-bit - False
...
aa17.exe 6 0x00400000 0x008FFFFF Final Dump False 64-bit - False
...
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image