Branka Primorac Maturalac May 2026

Signatures

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample might require command line arguments

Signatures

Contains functionality to modify services (start/stop/modify)

Signatures

Contains functionality to dynamically determine API calls

Signatures

Contains functionality to modify services (start/stop/modify)

Signatures

Contains functionality to adjust token privileges (e.g. debug / backup)

Signatures

Creates a process in suspended mode (likely to inject code)

May try to detect the Windows Explorer process (often used for injection)

Spawns processes

Signatures

Creates files inside the user directory

Signatures

May sleep (evasive loops) to hinder dynamic analysis

Signatures

Found potential string decryption / allocating functions

Signatures

Found potential string decryption / allocating functions

Sample is packed with UPX

Signatures

Sample is packed with UPX

Signatures

Potential key logger detected (key state polling based)

Signatures

Contains functionality to query local / system time

Contains functionality to query time zone information

Signatures

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Signatures

May try to detect the Windows Explorer process (often used for injection)

Contains functionality to enum processes or threads

Signatures

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Signatures

Contains functionality to query the account / user name

Signatures

Contains functionality to query the account / user name

Signatures

Reads the hosts file

Signatures

Contains functionality to enumerate / list files inside a directory

Reads ini files

Signatures

Contains functionality to query windows version

Contains functionality to check free disk space

Contains functionality to query local / system time

Reads software policies

Signatures

Contains functionality to record screenshots

Signatures

Detected potential crypto function

Signatures

Detected potential crypto function

Uses Microsoft's Enhanced Cryptographic Provider

Execution Graphs are highly condensed control flow graphs which give the user a synthetic view of the code detected during Hybrid Code Analysis. They include additional runtime information such as the execution status which is highlighted with different colors and shapes.

Entrypoint

Program entry point, most likely the entry point of the PE file.

Key Decision

A code location where a decision has been made to avoid execution of potentially malicious behavior.

Dynamic / Decrypted

Code which has been generated at runtime, often referred to as unpacked or self-modifying code.

Unpacker / Decrypter

Code section which is responsible for unpacking or decrypting a portion of dynamic code.

Executed

Code which has been executed at runtime.

Not Executed

Code which has not been executed at runtime.

Unknown

Code for which it is unknown if it has been executed or not at runtime.

Signature Matched

Code which matches a behavioral signature.

Rich Path

Path through the execution graph which shows a lot of behavior (e.g. with respect to called API functions).

Thread / callback entry

Code corresponding to a thread or callback entry point.

Thread / callback creation

Edges denoting either a thread creation (e.g. using CreateThread) or a callback registration (e.g. EnumWindows).

Entrypoint

VBA program entry point such as Document_Open.

Decryption Function

Function likely responsible for string decryption.

Executed

This line was executed during analysis.

Not Executed

This line was likely not executed during analysis.