Malicious
Classifications
Spyware Exploit Downloader
Threat Names
Mal/HTMLGen-A Mal/Generic-S AgentTesla
Dynamic Analysis Report
Created on 2023-08-02T11:06:21+00:00
ed248657afc15600a6b8e5b9cfa94203f9bfeda0ebd1a3007356e99836adeddf.rtf
RTF Document
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\RDhJ0CNFevzX\Desktop\ed248657afc15600a6b8e5b9cfa94203f9bfeda0ebd1a3007356e99836adeddf.rtf | Sample File | RTF |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
Names | Mal/Generic-S |
Office Information
»
Document Content Snippet
»
99488146please click Enable editing from the yellow bar above.The independent auditors’ opinion says the financial statements are fairly stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit’s) employees in the normal course of performing their duties. If the auditors detect an unexpected material misstatement during your audit, it could indicate that your internal controls are not functioning properly. Conver |
C:\Users\RDhJ0CNFevzX\AppData\Roaming\lawserhgj5784.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
PE Information
»
Image Base | 0x00400000 |
Entry Point | 0x004BBCCA |
Size Of Code | 0x000B9E00 |
Size Of Initialized Data | 0x00000E00 |
File Type | IMAGE_FILE_EXECUTABLE_IMAGE |
Subsystem | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Machine Type | IMAGE_FILE_MACHINE_I386 |
Compile Timestamp | 2023-08-02 03:41 (UTC+2) |
Version Information (11)
»
Comments | - |
CompanyName | Microsoft |
FileDescription | WindowsFormsApplication1 |
FileVersion | 1.0.0.0 |
InternalName | FoNW.exe |
LegalCopyright | Copyright © Microsoft 2011 |
LegalTrademarks | - |
OriginalFilename | FoNW.exe |
ProductName | WindowsFormsApplication1 |
ProductVersion | 1.0.0.0 |
Assembly Version | 1.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x00402000 | 0x000B9CD0 | 0x000B9E00 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.74 |
.rsrc | 0x004BC000 | 0x00000B08 | 0x00000C00 | 0x000BA000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.64 |
.reloc | 0x004BE000 | 0x0000000C | 0x00000200 | 0x000BAC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.1 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | - | 0x00402000 | 0x000BBC9E | 0x000B9E9E | 0x00000000 |
Memory Dumps (17)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|
lawserhgj5784.exe | 3 | 0x00560000 | 0x0061FFFF | Relevant Image | 32-bit | - |
...
|
||
buffer | 3 | 0x04870000 | 0x04879FFF | Reflectively Loaded .NET Assembly | 32-bit | - |
...
|
||
buffer | 3 | 0x04880000 | 0x04883FFF | Reflectively Loaded .NET Assembly | 32-bit | - |
...
|
||
buffer | 3 | 0x07660000 | 0x076D4FFF | Reflectively Loaded .NET Assembly | 32-bit | - |
...
|
||
buffer | 6 | 0x00400000 | 0x00441FFF | Content Changed | 32-bit | - |
...
|
||
lawserhgj5784.exe | 6 | 0x00A10000 | 0x00ACFFFF | Relevant Image | 32-bit | - |
...
|
||
lawserhgj5784.exe | 3 | 0x00560000 | 0x0061FFFF | Process Termination | 32-bit | - |
...
|
||
buffer | 6 | 0x0519E000 | 0x0519FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x0493E000 | 0x0493FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x04F5E000 | 0x04F5FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x04B5C000 | 0x04B5FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x0444E000 | 0x0444FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x00189000 | 0x0018FFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x00400000 | 0x00441FFF | First Network Behavior | 32-bit | - |
...
|
||
lawserhgj5784.exe | 6 | 0x00A10000 | 0x00ACFFFF | First Network Behavior | 32-bit | - |
...
|
||
buffer | 6 | 0x00400000 | 0x00441FFF | Final Dump | 32-bit | - |
...
|
||
lawserhgj5784.exe | 6 | 0x00A10000 | 0x00ACFFFF | Final Dump | 32-bit | - |
...
|
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat | Modified File | Stream |
Clean
|
...
|
»