Analysis Report

Overview

General Information

Joe Sandbox Version:	15.0.0
Analysis ID:	134325
Start time:	12:35:34
Joe Sandbox Product:	Cloud
Start date:	14/06/2016
Overall analysis duration:	0h 3m 40s
Report type:	full
Sample file name:	jksype200575.hwp
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Hancom Office 2014, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Detection:	SUS
Classification:	sus26.winHWP@3/20@0/0
HCA Information:	Successful, ratio: 96% Number of executed functions: 26 Number of non-executed functions: 0
EGA Information:	Failed
HDC Information:	Failed
Cookbook Comments:	Found application associated with file extension: .hwp
Warnings:	Show All Exclude process from analysis (whitelisted): WmiApSrv.exe Execution Graph export aborted for target Hwp.exe, PID 3100 because it is empty Report size exceeded maximum capacity and may have missing behavior information.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	26	0 - 100	Report FP / FN

Classification

Analysis Advice

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample sleeps for a long time, analyze it with the fake sleep cookbook

Sample tries to load a library which is not present or installed on the analysis machine, update the analysis machine or analyze the sample with the missing library cookbook

Signature Overview

Click to jump to signature section

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Window created: window name: CLIPBRDWNDCLASS

Networking:

Urls found in memory or binary data

Show sources

Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/config.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/config.jscss
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/config.jsp;r9s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/config.jss
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/config.jsssr33s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/base.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/base.css#_9s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/base.css?23s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/base.cssbaf
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/base.cssz_9s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home.cssgr
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home.cssro
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home.csss
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home_netffice.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/home_netffice.cssi
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/hwp/base.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/hwp/index.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/css/index.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home.html
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home.htmle
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home.htmlsl
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home_netffice.html
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home_netffice.html4
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home_netffice.html9
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home_netffice.htmld
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/home_netffice.htmlfile:///c:/program%20file
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_netffice.png
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_netffice.png...it.gif...
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_netffice.pngm
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_netffice.pngw
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_netffice.pngx
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_start.png
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_start.png%
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_start.png...
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_start.png...-
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/icon_start.pngng/hwp/index.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/wait.gif
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/img/wait.gift33s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/index.html
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/index.html/hea
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/index.htmll03s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/index.htmlp
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/index.htmly03s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/common.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/common.js.htmlcss/hwp/index.css
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/common.js533s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/common.jsm23s
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/common.jsome_netffice.html...mm/html/img
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home.jsg
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home.jso
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home.jsy
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home_netffice.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home_netffice.js$
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home_netffice.js0
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home_netffice.jsc
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/home_netffice.jsf
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jsc
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jsdan
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jsg
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jsing.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jsing.jsj
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/index.jssg.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.js2
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.js8
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.jsc
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.jsh~
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/json2.jsu
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/localsetting.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.js
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.js1
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.jsf
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.jsfile:///c:/program%20files/hnc
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.jsl
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/strings.jss
Source: Hwp.exe	String found in binary or memory: file:///c:/program%20files/hnc/hoffice9/bin/hnccomm/html/js/webtoolkit.base64.js
Source: Hwp.exe	String found in binary or memory: file://c:
Source: Hwp.exe	String found in binary or memory: http://
Source: Hwp.exe	String found in binary or memory: http://%s.com
Source: Hwp.exe	String found in binary or memory: http://amazon.fr/
Source: Hwp.exe	String found in binary or memory: http://apache.org/xml/uknownns
Source: Hwp.exe	String found in binary or memory: http://apache.org/xml/uknownnst
Source: Hwp.exe	String found in binary or memory: http://api.bing.com/qsml.aspx?query=
Source: Hwp.exe	String found in binary or memory: http://ariadna.elmundo.es/
Source: Hwp.exe	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://arianna.libero.it/
Source: Hwp.exe	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://asp.usatoday.com/
Source: Hwp.exe	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://auone.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://auto.search.msn.com/response.asp?mt=
Source: Hwp.exe	String found in binary or memory: http://br.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://browse.guardian.co.uk/
Source: Hwp.exe	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://busca.buscape.com.br/
Source: Hwp.exe	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://busca.igbusca.com.br/
Source: Hwp.exe	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://busca.orange.es/
Source: Hwp.exe	String found in binary or memory: http://busca.uol.com.br/
Source: Hwp.exe	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://buscador.lycos.es/
Source: Hwp.exe	String found in binary or memory: http://buscador.terra.com.br/
Source: Hwp.exe	String found in binary or memory: http://buscador.terra.com/
Source: Hwp.exe	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://buscador.terra.es/
Source: Hwp.exe	String found in binary or memory: http://buscar.ozu.es/
Source: Hwp.exe	String found in binary or memory: http://buscar.ya.com/
Source: Hwp.exe	String found in binary or memory: http://busqueda.aol.com.mx/
Source: Hwp.exe	String found in binary or memory: http://cerca.lycos.it/
Source: Hwp.exe	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: Hwp.exe	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: Hwp.exe	String found in binary or memory: http://cn.bing.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://cn.bing.com/search?q=
Source: Hwp.exe	String found in binary or memory: http://cnet.search.com/
Source: Hwp.exe	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://corp.naukri.com/
Source: Hwp.exe	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://cs.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://cs.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://cs.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://de.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://de.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://de.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://de.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://en.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://en.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://en.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://es.ask.com/
Source: Hwp.exe	String found in binary or memory: http://es.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://es.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://es.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://es.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: Hwp.exe	String found in binary or memory: http://espanol.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://espn.go.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://find.joins.com/
Source: Hwp.exe	String found in binary or memory: http://fr.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://fr.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://fr.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://fr.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=105563
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=120347-http://go.microsoft.com/fwlink/?linkid=1203463read
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=122812hthe
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=124983
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=125824-http://go.microsoft.com/fwlink/?linkid=125723-http://g
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=139524
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=2112211this
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=238591-http://go.microsoft.com/fwlink/?linkid=245073
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=246764
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=246765pa
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=272902
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=280122
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=287051
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=303674
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=317454
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=403856&language=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=50462
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=50893)lear&n
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54537&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54729&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54758
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54796&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54896&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55027&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55028&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55107&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55218&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55242&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55245&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=56297&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=57427&protocol=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=58472&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=58473&clcid=
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=66725
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=74005finternet
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=76277pa
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=92362.
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=99193
Source: Hwp.exe	String found in binary or memory: http://go.microsoft.com/fwlink/p/?linkid=255141
Source: Hwp.exe	String found in binary or memory: http://google.pchome.com.tw/
Source: Hwp.exe	String found in binary or memory: http://home.altervista.org/
Source: Hwp.exe	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: Hwp.exe	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: Hwp.exe	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: Hwp.exe	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: Hwp.exe	String found in binary or memory: http://images.monster.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: Hwp.exe	String found in binary or memory: http://in.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://it.search.dada.net/
Source: Hwp.exe	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://it.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://it.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://it.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://it.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://ja.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://ja.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://ja.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://javascript.crockford.com/jsmin.html
Source: Hwp.exe	String found in binary or memory: http://jobsearch.monster.com/
Source: Hwp.exe	String found in binary or memory: http://kr.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://list.taobao.com/
Source: Hwp.exe	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: Hwp.exe	String found in binary or memory: http://mail.live.com/
Source: Hwp.exe	String found in binary or memory: http://mail.live.com/?rru=compose%3fsubject%3d
Source: Hwp.exe	String found in binary or memory: http://msk.afisha.ru/
Source: Hwp.exe	String found in binary or memory: http://nl.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://nl.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://nl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/exif/1.0/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/ix/1.0/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/pdf/1.3/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/photoshop/1.0/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/tiff/1.0/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/xap/1.0/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/xap/1.0/mm/
Source: Hwp.exe	String found in binary or memory: http://ns.adobe.com/xap/1.0/stype/resourceevent#
Source: Hwp.exe	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: Hwp.exe	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: Hwp.exe	String found in binary or memory: http://p.zhongsou.com/
Source: Hwp.exe	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://pl.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://pl.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://pl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://price.ru/
Source: Hwp.exe	String found in binary or memory: http://price.ru/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://pt.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://pt.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://pt.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://purl.org/dc/elements/1.1/
Source: Hwp.exe	String found in binary or memory: http://purl.org/rss/1.0/modules/content/
Source: Hwp.exe	String found in binary or memory: http://purl.org/rss/1.0/modules/slash/
Source: Hwp.exe	String found in binary or memory: http://recherche.linternaute.com/
Source: Hwp.exe	String found in binary or memory: http://recherche.tf1.fr/
Source: Hwp.exe	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://rover.ebay.com
Source: Hwp.exe	String found in binary or memory: http://ru.search.yahoo.com
Source: Hwp.exe	String found in binary or memory: http://ru.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://ru.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://ru.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://sads.myspace.com/
Source: Hwp.exe	String found in binary or memory: http://schemas.microsoft.com/office/2004/12/omml
Source: Hwp.exe	String found in binary or memory: http://search-dyn.tiscali.it/
Source: Hwp.exe	String found in binary or memory: http://search.about.com/
Source: Hwp.exe	String found in binary or memory: http://search.alice.it/
Source: Hwp.exe	String found in binary or memory: http://search.alice.it/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.aol.co.uk/
Source: Hwp.exe	String found in binary or memory: http://search.aol.com/
Source: Hwp.exe	String found in binary or memory: http://search.aol.in/
Source: Hwp.exe	String found in binary or memory: http://search.atlas.cz/
Source: Hwp.exe	String found in binary or memory: http://search.auction.co.kr/
Source: Hwp.exe	String found in binary or memory: http://search.auone.jp/
Source: Hwp.exe	String found in binary or memory: http://search.books.com.tw/
Source: Hwp.exe	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.centrum.cz/
Source: Hwp.exe	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.chol.com/
Source: Hwp.exe	String found in binary or memory: http://search.chol.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.cn.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://search.daum.net/
Source: Hwp.exe	String found in binary or memory: http://search.daum.net/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.dreamwiz.com/
Source: Hwp.exe	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.ebay.co.uk/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.com/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.ebay.de/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.es/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.fr/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.in/
Source: Hwp.exe	String found in binary or memory: http://search.ebay.it/
Source: Hwp.exe	String found in binary or memory: http://search.empas.com/
Source: Hwp.exe	String found in binary or memory: http://search.empas.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.espn.go.com/
Source: Hwp.exe	String found in binary or memory: http://search.gamer.com.tw/
Source: Hwp.exe	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.gismeteo.ru/
Source: Hwp.exe	String found in binary or memory: http://search.goo.ne.jp/
Source: Hwp.exe	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.hanafos.com/
Source: Hwp.exe	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.interpark.com/
Source: Hwp.exe	String found in binary or memory: http://search.ipop.co.kr/
Source: Hwp.exe	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.live.com/results.aspx?form=iefm1&q=
Source: Hwp.exe	String found in binary or memory: http://search.live.com/results.aspx?form=so2tdf&q=
Source: Hwp.exe	String found in binary or memory: http://search.live.com/results.aspx?form=soltdf&q=
Source: Hwp.exe	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://search.livedoor.com/
Source: Hwp.exe	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.lycos.co.uk/
Source: Hwp.exe	String found in binary or memory: http://search.lycos.com/
Source: Hwp.exe	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.microsoft.com/
Source: Hwp.exe	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: Hwp.exe	String found in binary or memory: http://search.nate.com/
Source: Hwp.exe	String found in binary or memory: http://search.naver.com/
Source: Hwp.exe	String found in binary or memory: http://search.naver.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.nifty.com/
Source: Hwp.exe	String found in binary or memory: http://search.orange.co.uk/
Source: Hwp.exe	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.rediff.com/
Source: Hwp.exe	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.seznam.cz/
Source: Hwp.exe	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.sify.com/
Source: Hwp.exe	String found in binary or memory: http://search.yahoo.co.jp
Source: Hwp.exe	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://search.yahooapis.jp/assistsearchservice/v2/webassistsearch?output=iejson&p=
Source: Hwp.exe	String found in binary or memory: http://search.yam.com/
Source: Hwp.exe	String found in binary or memory: http://search1.taobao.com/
Source: Hwp.exe	String found in binary or memory: http://search2.estadao.com.br/
Source: Hwp.exe	String found in binary or memory: http://searchresults.news.com.au/
Source: Hwp.exe	String found in binary or memory: http://service2.bfast.com/
Source: Hwp.exe	String found in binary or memory: http://si.wikipedia.org/
Source: Hwp.exe	String found in binary or memory: http://si.wikipedia.org/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://si.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: Hwp.exe	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: Hwp.exe	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: Hwp.exe	String found in binary or memory: http://suche.aol.de/
Source: Hwp.exe	String found in binary or memory: http://suche.freenet.de/
Source: Hwp.exe	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://suche.lycos.de/
Source: Hwp.exe	String found in binary or memory: http://suche.t-online.de/
Source: Hwp.exe	String found in binary or memory: http://suche.web.de/
Source: Hwp.exe	String found in binary or memory: http://suche.web.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://treyresearch.net
Source: Hwp.exe	String found in binary or memory: http://tw.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://udn.com/
Source: Hwp.exe	String found in binary or memory: http://udn.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://uk.ask.com/
Source: Hwp.exe	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://uk.search.yahoo.com/
Source: Hwp.exe	String found in binary or memory: http://vachercher.lycos.fr/
Source: Hwp.exe	String found in binary or memory: http://video.globo.com/
Source: Hwp.exe	String found in binary or memory: http://video.globo.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://web.ask.com/
Source: Hwp.exe	String found in binary or memory: http://wellformedweb.org/commentapi/
Source: Hwp.exe	String found in binary or memory: http://windowsupdate.microsoft.com
Source: Hwp.exe	String found in binary or memory: http://www.%s.com
Source: Hwp.exe	String found in binary or memory: http://www.abril.com.br/
Source: Hwp.exe	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.afisha.ru/app_themes/default/images/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.alarabiya.net/
Source: Hwp.exe	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.amazon.co.jp/
Source: Hwp.exe	String found in binary or memory: http://www.amazon.co.uk/
Source: Hwp.exe	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: Hwp.exe	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.amazon.com/gp/search?ie=utf8&tag=ie8search-20&index=blended&linkcode=qs&c
Source: Hwp.exe	String found in binary or memory: http://www.amazon.de/
Source: Hwp.exe	String found in binary or memory: http://www.aol.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.arrakis.com/
Source: Hwp.exe	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.asharqalawsat.com/
Source: Hwp.exe	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.ask.com/
Source: Hwp.exe	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: Hwp.exe	String found in binary or memory: http://www.baidu.com/
Source: Hwp.exe	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/maps/
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/maps/default.aspx
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/maps/geotager.aspx
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/safety/warning
Source: Hwp.exe	String found in binary or memory: http://www.bing.com/search?q=
Source: Hwp.exe	String found in binary or memory: http://www.cdiscount.com/
Source: Hwp.exe	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.ceneo.pl/
Source: Hwp.exe	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: Hwp.exe	String found in binary or memory: http://www.cjmall.com/
Source: Hwp.exe	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.cnet.co.uk/
Source: Hwp.exe	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.dailymail.co.uk/
Source: Hwp.exe	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.etmall.com.tw/
Source: Hwp.exe	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.excite.co.jp/
Source: Hwp.exe	String found in binary or memory: http://www.expedia.com/
Source: Hwp.exe	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.facebook.com/
Source: Hwp.exe	String found in binary or memory: http://www.facebook.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.gmarket.co.kr/
Source: Hwp.exe	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.google.co.in/
Source: Hwp.exe	String found in binary or memory: http://www.google.co.jp/
Source: Hwp.exe	String found in binary or memory: http://www.google.co.uk/
Source: Hwp.exe	String found in binary or memory: http://www.google.com
Source: Hwp.exe	String found in binary or memory: http://www.google.com.br/
Source: Hwp.exe	String found in binary or memory: http://www.google.com.sa/
Source: Hwp.exe	String found in binary or memory: http://www.google.com.tw/
Source: Hwp.exe	String found in binary or memory: http://www.google.com/
Source: Hwp.exe	String found in binary or memory: http://www.google.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.google.cz/
Source: Hwp.exe	String found in binary or memory: http://www.google.de/
Source: Hwp.exe	String found in binary or memory: http://www.google.es/
Source: Hwp.exe	String found in binary or memory: http://www.google.fr/
Source: Hwp.exe	String found in binary or memory: http://www.google.it/
Source: Hwp.exe	String found in binary or memory: http://www.google.pl/
Source: Hwp.exe	String found in binary or memory: http://www.google.ru/
Source: Hwp.exe	String found in binary or memory: http://www.google.si/
Source: Hwp.exe	String found in binary or memory: http://www.iask.com/
Source: Hwp.exe	String found in binary or memory: http://www.iask.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.json.org/js.html
Source: Hwp.exe	String found in binary or memory: http://www.kkbox.com.tw/
Source: Hwp.exe	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: Hwp.exe	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.mercadolivre.com.br/
Source: Hwp.exe	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.merlin.com.pl/
Source: Hwp.exe	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.microsoft.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.microsoft.com/schemas/rss/core/2005/internal
Source: Hwp.exe	String found in binary or memory: http://www.microsofttranslator.com/?ref=ie8activity
Source: Hwp.exe	String found in binary or memory: http://www.microsofttranslator.com/bv.aspx?ref=ie8activity&a=
Source: Hwp.exe	String found in binary or memory: http://www.microsofttranslator.com/bvprev.aspx?ref=ie8activity
Source: Hwp.exe	String found in binary or memory: http://www.microsofttranslator.com/default.aspx?ref=ie8activity
Source: Hwp.exe	String found in binary or memory: http://www.microsofttranslator.com/defaultprev.aspx?ref=ie8activity
Source: Hwp.exe	String found in binary or memory: http://www.mtv.com/
Source: Hwp.exe	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.najdi.si/
Source: Hwp.exe	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.nate.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.neckermann.de/
Source: Hwp.exe	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.orange.fr/
Source: Hwp.exe	String found in binary or memory: http://www.otto.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.ozon.ru/
Source: Hwp.exe	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.paginasamarillas.es/
Source: Hwp.exe	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.priceminister.com/
Source: Hwp.exe	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.rambler.ru/
Source: Hwp.exe	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.recherche.aol.fr/
Source: Hwp.exe	String found in binary or memory: http://www.rtl.de/
Source: Hwp.exe	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.servicios.clarin.com/
Source: Hwp.exe	String found in binary or memory: http://www.shopzilla.com/
Source: Hwp.exe	String found in binary or memory: http://www.sify.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.sogou.com/
Source: Hwp.exe	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.soso.com/
Source: Hwp.exe	String found in binary or memory: http://www.soso.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.taobao.com/
Source: Hwp.exe	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.target.com/
Source: Hwp.exe	String found in binary or memory: http://www.target.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.tchibo.de/
Source: Hwp.exe	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.tesco.com/
Source: Hwp.exe	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.univision.com/
Source: Hwp.exe	String found in binary or memory: http://www.univision.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/1999/02/22-rdf-syntax-ns#
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/1999/xhtml
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/1999/xsl/transform
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/2000/xmlns/
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/tr/html4/loose.dtd
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/tr/html4/strict.dtd
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/tr/wd-xsl
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/xml/1998/namespace
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/xml/1998/namespaceeon
Source: Hwp.exe	String found in binary or memory: http://www.w3.org/xml/1998/namespaceh
Source: Hwp.exe	String found in binary or memory: http://www.walmart.com/
Source: Hwp.exe	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.weather.com/
Source: Hwp.exe	String found in binary or memory: http://www.weather.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.webtoolkit.info/javascript-base64.html
Source: Hwp.exe	String found in binary or memory: http://www.ya.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.yam.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www.yandex.ru/
Source: Hwp.exe	String found in binary or memory: http://www.yandex.ru/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://www3.fnac.com/
Source: Hwp.exe	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?service=awsecommerceservice&version=2008-06-26&operation
Source: Hwp.exe	String found in binary or memory: http://yellowpages.superpages.com/
Source: Hwp.exe	String found in binary or memory: http://yellowpages.superpages.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: http://z.about.com/m/a08.ico
Source: Hwp.exe	String found in binary or memory: https://
Source: Hwp.exe	String found in binary or memory: https://accounts.google.com/o/oauth2/auth?scope=https%3a%2f%2fwww.googleapis.com%2fauth%2fdrive.file
Source: Hwp.exe	String found in binary or memory: https://accounts.google.com/o/oauth2/authta
Source: Hwp.exe	String found in binary or memory: https://auth.netffice24.com43q
Source: Hwp.exe	String found in binary or memory: https://auth.netffice24.com62
Source: Hwp.exe	String found in binary or memory: https://auth.netffice24.come4n
Source: Hwp.exe	String found in binary or memory: https://example.com
Source: Hwp.exe	String found in binary or memory: https://hnccomm.hancom.com/msg/msginfo_dnload.php
Source: Hwp.exe	String found in binary or memory: https://hnccomm.hancom.com/workshare/connectivity.js
Source: Hwp.exe	String found in binary or memory: https://hofficecommunicator.hancom.com/workshare/mailer4.php
Source: Hwp.exe	String found in binary or memory: https://hofficecommunicator.hancom.com/workshare/smtp-list.js
Source: Hwp.exe	String found in binary or memory: https://hofficecommunicator.hancom.com/workshare/verify-smtp.php
Source: Hwp.exe	String found in binary or memory: https://ieonlinews.microsoft.com/
Source: Hwp.exe	String found in binary or memory: https://www.example.com.
Source: Hwp.exe	String found in binary or memory: https://www.facebook.com
Source: Hwp.exe	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=1004189452925259&redirect_uri=http://www.facebook.co

Found strings which match to known social media urls

Show sources

Source: Hwp.exe	String found in binary or memory: <FavoriteIcon>http://search.yahoo.co.jp/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <FavoriteIcon>http://search.yahoo.com/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: Hwp.exe	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: Hwp.exe	String found in binary or memory: <URL>http://br.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://de.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://es.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://espanol.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://fr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://in.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://it.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://kr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://ru.search.yahoo.com</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://sads.myspace.com/</URL> equals www.myspace.com (Myspace)
Source: Hwp.exe	String found in binary or memory: <URL>http://search.cn.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://search.yahoo.co.jp</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://tw.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://uk.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: Hwp.exe	String found in binary or memory: <SuggestionsURL>http://ie.search.yahoo.com/os?command={SearchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Hwp.exe	String found in binary or memory: .facebook.com equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: Error validating access token: Session does not match current stored session. This may be because the user changed the password since the time the session was created or Facebook has changed the session for security reasons. equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: Error validating access token: Session does not match current stored session. This may be because the user changed the password since the time the session was created or Facebook has changed the session for security reasons.S5 equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: Free Hotmail.url equals www.hotmail.com (Hotmail)
Source: Hwp.exe	String found in binary or memory: facebook.com/connect/login_success.htmlU5 equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=1004189452925259&redirect_uri=http://www.facebook.com/connect/login_success.html&type=user_agent&display=popup&scope=email,user_photos,friends_photos,user_videos,friends_videos,publish_stream,offline_access,xmpp_login,read_stream,user_birthday equals www.facebook.com (Facebook)
Source: Hwp.exe	String found in binary or memory: https://www.facebook.com^ equals www.facebook.com (Facebook)

Social media urls found in memory data

Show sources

Source: Hwp.exe	String found in binary or memory: http://www.facebook.com/
Source: Hwp.exe	String found in binary or memory: http://www.facebook.com/favicon.ico
Source: Hwp.exe	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=1004189452925259&redirect_uri=http://www.facebook.co

Spreading:

Enumerates the file system

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft\Windows\History\desktop.ini
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft\Windows

System Summary:

Reads internet explorer settings

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key opened: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Classification label

Show sources

Source: classification engine

Classification label: sus26.winHWP@3/20@0/0

Creates files inside the user directory

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

File created: C:\Users\admin\AppData\Local\HncComm\

Creates temporary files

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

File created: C:\Users\admin\AppData\Local\Temp\~DF431EE72667FC434C.TMP

Reads ini files

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

File read: C:\Users\admin\AppData\Roaming\HNC\User\Common\90\Fonts\ShareFont.ini

Reads software policies

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe
Source: unknown	Process created: C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Process created: C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Writes ini files

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

File written: C:\Users\admin\AppData\Roaming\HNC\User\Common\90\Fonts\ShareFont.ini

Searches for the Microsoft Outlook file path

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Tries to load missing DLLs

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Section loaded: shcore.dll
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Section loaded: hncxalcore8.dll
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Section loaded: hncxalmesg8.dll
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Section loaded: hncptncore8.dll
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Section loaded: hncxseccore8.dll

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Memory protected: page read and write and page guard

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

System information queried: KernelDebuggerInformation

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Enumerates the file system

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft\Windows\History\desktop.ini
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	File opened: C:\Users\admin\AppData\Local\Microsoft\Windows

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe TID: 2576	Thread sleep count: 33 > 30
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe TID: 3312	Thread sleep time: -60000ms >= -60000ms

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe	Process information set: NOOPENFILEERRORBOX

Stores large binary data to the registry

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key value created or modified: HKEY_USERS\Software\HNC\Hwp\9.0\HwpFrame_KOR\DefaultSet_Office9\VERTICAL DockInfo0

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\jksype200575.hwp VolumeInformation
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\HNC\HOffice9\Bin\Hwp.exe	Queries volume information: C:\Windows\Fonts\gulim.ttc VolumeInformation

Yara Overview

No Yara matches

Screenshot

Startup

system is w7_4

Hwp.exe (PID: 3100 MD5: 551A007AC44F36E62BAFFA932241F0CB)

HimTrayIcon.exe (PID: 2808 MD5: 60604F41453D91F840DE8AB8FCE7EA7C)

cleanup

Created / dropped Files

File Path	Type and Hashes
C:\Users\admin\AppData\Local\HncComm\db\setting.db3	Type: SQLite 3.x database MD5: 95EA7D7FA7C79740AACF13F4C93D2401 SHA: E4228EF22F02524BBD74B1A06203EC553E2966E7 SHA-256: 2A119F6EBF2E4806BEC48AD305258AFB89B9050B9600E3ABB9D8B77CC6670295 SHA-512: C63E7BBEBC3EB8D46F41F0737B5704E266242821B55E4A0FBAC74510249B25699EDC0A58BDF1B7AC3DB82D188239C3ED26F81667A4D5E291DCAA2DD0FC847EFF
C:\Users\admin\AppData\Local\Temp\Hnc\Normal90.hwt_sec0	Type: data MD5: 778C2B39BC3BD2BC69C0C9C34573806D SHA: 4366A71B733F2D10597A0595F422EB4EDE950770 SHA-256: 59DF66DA34953C1247075742F71D210915043E289D7134E3EB9E30A7C9DABFA6 SHA-512: 040C356659DB0B4AED9BD174AAF7792D0B456A289313733E04E70F5C94596EEF2BAE59339A7EB1285583792B49E146AF8711A04131983770AE84AC9A43AECDA0
C:\Users\admin\AppData\Local\Temp\Hnc\jksype200575.hwp_sec0	Type: data MD5: 85DDD6936F1F89E8E228169DF5FD9F0E SHA: 7885F791E39D5D3C4E6B8BAB1A06A7D9C26E91D1 SHA-256: 4752460536EB7C0216240C91AD716ADB30BF3992E7EBC73CE2CD9060741112B8 SHA-512: 2194F981D03FB3F70841BE68D21565B1379F0581A6439A70101D14F04EA628B82EC440A1F92AD879017B8861202B9A8AEF4E5235FDEECCD723EA9183E2B19015
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec0	Type: data MD5: 8D296A01CFD92381CE53EA153F17459D SHA: AE053E1AB2AAC719166F5808879BA2528426CDC9 SHA-256: EA329179D84B81FA3EB53A0734115203B5398CC87950A92F4E18670EF405848E SHA-512: EDC48EF50DD27DDEF951846901DF6458C736211E685F700BAB8A3F30D7B26D3BCBD1D9C371AAA7349166FADAF232D3BF5F1F1B05AB0846B513A9651F7DF0B3C7
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec1	Type: data MD5: 4C565653B13F062FC5486399A54D1288 SHA: 6BC88A3EEF7B2BAFDA3AFB5AFC45237E0231D336 SHA-256: 2B3A7821CAB8D0D1DCC35A35C0CF26F3E84B6D41AD4F8EA4A1DF943A90221A30 SHA-512: BAA1A1EF7DCC489E36F3F26F641960EAA06B3DB4C612ECF212D0D134D0C7C802AF53208CFD8B31591C07F198208CCF5EFC1D6F4F8D0DB5B7B99A6037896C9CFE
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec2	Type: data MD5: DA3A5CE8BF36FB9DF0787BB07981F11A SHA: E22A70C311FE9BEC6F61A0AA83E239C2A4E32A8E SHA-256: 3BCFE5376012754D0A098C5742E4C8C32AA7174B7115DB2ECB6240D0B1936AE0 SHA-512: E9C0434992E3895B788CD0F1140D9943DE19B3F27F5B41ED57487DC88C003B56DC990840536C546500700FDF979231B9BB4559964290681F8A09527344024482
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec3	Type: data MD5: FB5016CF349CDFA16EE555DC4F7F3679 SHA: 08F8E61A90D04A22CC61D92E04EE0FAF1351841E SHA-256: C632E9D9AF3291501B11A2EE2006399B7FEE2AAEB88537CDCF9F936B03F60CFF SHA-512: F38700643A66D883862C44D787AB0839D3B893541A32AE77FD8B73C95C000788EC9F218E86AD116B76F2B116073BC4FE3F46EE9BA423A72CA106200BF23A1D0C
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec4	Type: data MD5: AF2054F0B214E848484B16D76DF0F46A SHA: 07962330B85AFB22CA37E46A587254FEF9AF8376 SHA-256: 365D475A88CE91244949A10CBEBC12E635F8F50AFD4C5A11043727A6DCB4A07E SHA-512: 4EE9E2EFD2D46C45EBE190574ED54284DE1208825746297D17D8439B8B9AC1D107295DD30792B6E05AF51EBCDE3038353A2A980AF2F7B1C9004A2DC1B289BC67
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec5	Type: data MD5: AE9EBDA90DADEBE51A624E279A8BEDA9 SHA: 690F01153F28B432A1D9F7E2383C250EE519D465 SHA-256: BAB542614C85C43EE346549DACA499E6E055D6A4DBAAB4186F508CAD39B37618 SHA-512: 4501E75C7664B3040578BE236F7146AEADFFE86688C328928BA59F29377832F31F64F373986E61846133DAF96B57B05D4428A59418EDEE952005ACD8BF227C2B
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec6	Type: data MD5: 097C4C4B2336D5AA2171983EC05D6A69 SHA: F078489BF91F9E1868D2FF32F248B7A70D5D116B SHA-256: 4D4E8BB01F580063114FF30A789A475F0C90AB5D1C01B21D65F94B273478C9A7 SHA-512: 3B859E81D3325A3A8808EA5E4C0A729B8E4088A179105AB489641454DCD8A347E771D1CAB784C894E2FEEC74A78579816941ECEA5E263FD447D4601D43C20A8C
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec7	Type: data MD5: F6099A97128D3F048051B481C5F511B5 SHA: 1C8B8B82F096B8272C5FC35815BEBEB14BF20357 SHA-256: B7BC8022A972E4711F7C9FC128AAB47E917FDD4D0FA089CC463BE1EB420FA051 SHA-512: F6762BA0984A726FDC400C5D9D0C9EBF9624193ECEB66717C14137FC1682D837B67846FD4A673DE92C012F250528373E1E6D4D94F94D17CF7B12A1C655263793
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec8	Type: data MD5: 32FFD8DA46C54EF56942D2098573A1F8 SHA: BD4627AC646A01ADC0970158EE62D9AD221E188E SHA-256: DD17A617244A7511F399BC0BB96C5225D21DD26917CAE9338FF195032A2FC01B SHA-512: 0866762411C66C7A9CEC83F182D20D3E6C3B67EE52A04FABC06260DB9770E0CFE893D8D401BEC14264E8D6DF667729E97923D1F54E1610BFDB31DB5E8862F102
C:\Users\admin\AppData\Local\Temp\Hnc\memo_preset.hwp_sec9	Type: data MD5: EB146DD3E2E4D6BBF635FF6A376F5D0C SHA: 4D75AEE9D5D60BAE02B4DD6F2D6EDDD6BD308568 SHA-256: 9D57A43DC747ADA40976676D4C76783868AC5439D400616B350EC27EDC8D81C3 SHA-512: 02DBAEA49193295C4C78285AE2E32165BDE40BEAEA9D73BB44C5D1E70496B181B6E66D27D90ABAC5BA337736AD672002A1572D12331E3FB8576AE07C891DBF23
C:\Users\admin\AppData\Local\Temp\Hnc\textart_preset.hwp_sec0	Type: data MD5: 9C5ABFD46E3349D2FF4865E2029D9F76 SHA: 123F23A9D2AA6576C36020FF9DA549F4B3E20D16 SHA-256: 5B15FF45220A1145BCE2D8EA64632654ACB3B6D680FB4F0E766B5B8666C08326 SHA-512: ECD210A6CE6E113CDFE17A3FE5BA8A894ADCC6472E200C542FEA128ED2091496A19EF5D81B953C10812926CC8CD4C766F1E45C38ECC66FA7FF43CC23F830EB1E
C:\Users\admin\AppData\Roaming\HNC\Office\Recent\jksype200575.hwp.lnk	Type: MS Windows shortcut MD5: 32AC49B7CD44B99353846CBD9E4A9F34 SHA: 4399A00BC992819711C583403FE46D42A65D1D1F SHA-256: DD1818CF95324EEF1BE62089CDF71BFAB62C07767AC8F590C0EA6183C966B7A9 SHA-512: 81672097A4B9DE390679EEF0FECEE00D6D220928364678A9B03FBBFEC102269E5564BBE32B646528CE61A51AC12D24FCC49915BD760AF7FF9D94A1EE572481FA
C:\Users\admin\AppData\Roaming\HNC\User\Common\90\Fonts\ShareFont.ini	Type: ASCII text, with no line terminators MD5: 708935D3E8B8CB93AB999AF28F89AACB SHA: 1111D603890754CAE1B1A2626B5564B15512866B SHA-256: E3F650A34E18BD8F4DC2C91B576E9454CD76C26B85353046D8ECBD041E979EC5 SHA-512: 733ABBF3B90D42102AE9A9F8D7E71A4816494993D0C7E72CC7A805C04DC11347365D5C8D5BA87444EE1776C27CAE85CE67616250FDB8B68680FEBFD170E36FFA
C:\Users\admin\AppData\Roaming\HNC\User\Shared90\Dics\hjuser6.dic	Type: data MD5: 0719372EF17609B1F530E0D04EB99736 SHA: 06B3895B205D40F4DF47A8C666967CD498E8786A SHA-256: 46671576C093930465F05F0E44B22EF48A7CB159694C75BEBCD64EECC00B0552 SHA-512: 6A45F3C054E21B2EC8BC90C2F8C40FA577C1B3F65BB4AC403F161ECADA51A93B0F366E8EE99DFB53E11C3375C69D4D4A27E552E7986369DFB9F49CE3C4AD0156
C:\Users\admin\AppData\Roaming\HNC\User\Shared90\Dics\hjuser6Ext.dic	Type: data MD5: 0719372EF17609B1F530E0D04EB99736 SHA: 06B3895B205D40F4DF47A8C666967CD498E8786A SHA-256: 46671576C093930465F05F0E44B22EF48A7CB159694C75BEBCD64EECC00B0552 SHA-512: 6A45F3C054E21B2EC8BC90C2F8C40FA577C1B3F65BB4AC403F161ECADA51A93B0F366E8EE99DFB53E11C3375C69D4D4A27E552E7986369DFB9F49CE3C4AD0156
C:\Users\admin\AppData\Roaming\HNC\User\Shared90\Dics\mark.dic	Type: data MD5: 1138B14575AD26561F9FFBB56E79E15F SHA: 3FCFF92D69415D8CDB29C18F6540F8132659C39F SHA-256: 2A7A627D9B2C2116A1B05B068E202AA5B45FB4700011229568D23DA60DFBCF63 SHA-512: 617BD59463880AE87383BDFB2ED7EEE1A79CE4E44AE1392C3269BA5E441451169A64908A09215A0487AB1B00005B503D82F7709F90D3D53729EBB96342D66697
\srvsvc	Type: Hitachi SH big-endian COFF object, not stripped MD5: 1FF3DE735A87D719B35ED6D00689168C SHA: 6711956511BAB8C677A411EA33830E1A2139AC84 SHA-256: 36A192FDB029E0357EB75DF25BF3C2EF035DBCBB9B811527B7276C5CA6D2177E SHA-512: 1160A3480E574315832F8A9B60D0A6293A14D3A259EA3B6E220EEC46D72504C66AF2712A7CEF030F0E0F548845FD1AFC1FEC43985FE56614A6AF27FB75C3BA57

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

Static File Info

General
File type:	Composite Document File V2 Document, No summary info
TrID:	Hangul (Korean) Word Processor document (alternate) (16508/1) 67.34% Generic OLE2 / Multistream Compound File (8008/1) 32.66%
File name:	jksype200575.hwp
File size:	114176
MD5:	3cc6eae1f4ed253eea61c08e5790c2ec
SHA1:	ba92c245a9d4d9233ea3eb9b911723804202f609
SHA256:	c8c688a4821fee706a88519e7136ecce0692631caa4f4b77878454d2d274a7b5
SHA512:	224f6674b94cc9c3f2c13c839169a9e84f8d54b6f6ed234173dca7ecbf14007d4870793c50889e0b4cf6e00041fd4aa3ffaa3ac31dff35b79681c4789f9fd373

File Icon

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Streams

Stream Path: \x5HwpSummaryInformation, File Type: data, Stream Size: 489

General
Stream Path:	\x5HwpSummaryInformation
File Type:	data
Stream Size:	489
Entropy:	3.77359555382
Base64 Encoded:	False
Data ASCII:	. . . . . . . . ` . . . a . . . . . . ` . . . . . . . . ` . . . a . . . . . . ` . . . . 0 . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . 0 . . . . . . . L . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D . X . . . . . . . . . Y . . . . . . . . . . X . . . . . . \\ . . . . l . . . . . . . . . . . . . . . . . . . . . . . H . P . _ . O . w . n .
Data Raw:	fe ff 00 00 05 01 02 00 60 b6 a2 9f 61 10 d4 11 b4 c6 00 60 97 c0 9d 8c 01 00 00 00 60 b6 a2 9f 61 10 d4 11 b4 c6 00 60 97 c0 9d 8c 30 00 00 00 b9 01 00 00 0e 00 00 00 02 00 00 00 78 00 00 00 03 00 00 00 b0 00 00 00 04 00 00 00 bc 00 00 00 14 00 00 00 d8 00 00 00 05 00 00 00 18 01 00 00 06 00 00 00 24 01 00 00 08 00 00 00 30 01 00 00 09 00 00 00 4c 01 00 00 0c 00 00 00 78 01 00 00

Stream Path: BodyText/Section0, File Type: data, Stream Size: 45580

General
Stream Path:	BodyText/Section0
File Type:	data
Stream Size:	45580
Entropy:	7.98578929348
Base64 Encoded:	True
Data ASCII:	. W . l [ . u > . . . . . . ) . 2 e Q . . V n % O U ( . . . . . T K J . . . \\ . . . U - . . I m L q . . K ] L . . . . . A ^ . . . . G ; h X . . . ) . . . S 6 e . * . . . ! . . . . 2 . . . & . . . . . . . . . . . . . . H S \| . I . = \\ . . . . . . . . . 9 { . e i % " . . . J T . . . . . Q . . . T . . . . . s q . G . . . . . { + s . ( . . . . . . A g B % . . . d ] r . . R . O . . . . c . . . T . . ; . . z . L . . . . . . . x 4 . P y < . . . . c . > . [ . . . ] + . . . . . . c . . . Z z . . . . . ) b 6 / ) . .
Data Raw:	bc 57 7f 6c 5b d7 75 3e 94 9e 14 da a6 13 29 b1 32 65 51 97 97 56 6e 25 4f 55 28 db b2 a9 d6 d8 54 4b 4a 94 c6 d9 5c d7 1d e8 55 2d 98 c4 49 6d 4c 71 b4 8d 4b 5d 4c 1b 88 d6 19 ec 41 5e dd c2 19 f8 47 3b 68 58 bd da 18 29 c8 a2 0c 53 36 65 90 2a 7f 02 b2 21 d7 a6 bc ad 32 a0 0d 06 26 0c 0e e0 01 0a e0 00 ca b6 f3 dd fb 9e f8 48 53 7c a4 49 e5 3d 5c f2 fd b8 ef de ef fc fa ce 39 7b

Stream Path: DocInfo, File Type: data, Stream Size: 1643

General
Stream Path:	DocInfo
File Type:	data
Stream Size:	1643
Entropy:	7.86788797939
Base64 Encoded:	True
Data ASCII:	. W ] l . E . > . w . . . m . . m A * ? W M . . B . . . . 1 . . Z . . . 1 A . . . . . . . . . ` . . L . O . . . \| h . . $ . . R . Z . Y . . E . . 1 T . . C . y 0 . . L . % . 9 3 . . . . . . ; . . . q 6 { . . . w . . . . . . . . . . A . . U . P . . . T . . . W 2 . 2 . . . . S . . ) . . Q 6 . . F ^ b . . . . . . . . . . . . . W . . . . . . . . . W . 4 M . . . . . . . v . . ~ \| { . . B . . . . L { . . < . . v B . . @ 1 d . c . . . ~ . 6 . . x . 4 . . } . . - > . & . . w . . . . . . . . N f . . . . . . . . .
Data Raw:	ed 57 5d 6c 15 45 14 3e b3 77 ee ed ed 6d 91 b2 6d 41 2a 3f 57 4d 14 13 42 b0 14 e8 03 31 1b 8c 5a a3 20 06 13 31 41 a4 84 86 10 e9 8f a4 a4 f0 60 b2 18 4c 8c 4f 98 10 9e 7c 68 e2 8b 24 05 9b 52 12 5a 8a 59 1a 0a 45 0d b9 31 54 13 c3 43 1f 79 30 c6 07 4c 1a 25 e2 39 33 b3 bd bb dd d9 bd 3b e5 c6 a8 71 36 7b cf ce cc 77 ce 9c f9 ce 99 9f db 00 83 8c 41 f0 01 55 1a 50 2e 03 e0 54 cd

Stream Path: DocOptions/_LinkDoc, File Type: data, Stream Size: 524

General
Stream Path:	DocOptions/_LinkDoc
File Type:	data
Stream Size:	524
Entropy:	5.51323276693
Base64 Encoded:	False
Data ASCII:	. . . . . . \\ . . 8 . . . . . . . . . . . . . . . . . < . \\ . . . . . . t . . . . . . . . . % . 8 . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . t . . . . . . . . . . D . . . . t . . . . . . . . . t . . 8 . . . . . . . . . . . . t . . . . \\ . . Y . P . . . % . . . . . . \\ . . . . . . t . . . . . . \\ . . . . Y . P . . . . . . . . . . . t . . . . . . . . % . D . . . . . . . X . . . . . . @ . . . . . . . . . . . . . . . X .
Data Raw:	00 00 ec c2 01 ac 5c d5 20 00 38 bb 1c c8 94 b2 20 00 ac c0 8c d6 20 00 04 c8 18 bc 01 c8 3c c7 5c b8 20 00 cc b9 f0 c5 74 d5 20 00 88 c7 94 b2 20 00 ed d3 25 b8 38 bb 1c c8 74 c7 e4 b2 2e 00 20 00 f8 ad 20 00 11 c9 d0 c5 1c c1 c4 b3 20 00 94 c6 98 c9 20 00 e4 b4 b4 c5 20 00 e0 c2 38 bb 74 c7 98 b0 20 00 e4 b9 a4 c2 f4 ce 44 c7 20 00 b5 d1 74 d5 20 00 00 ac a5 c7 20 00 ce b9 74 c7

Stream Path: FileHeader, File Type: Hangul (Korean) Word Processor File 3.0, Stream Size: 256

General
Stream Path:	FileHeader
File Type:	Hangul (Korean) Word Processor File 3.0
Stream Size:	256
Entropy:	0.753978584208
Base64 Encoded:	False
Data ASCII:	H W P D o c u m e n t F i l e . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	48 57 50 20 44 6f 63 75 6d 65 6e 74 20 46 69 6c 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 01 00 05 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: PrvImage, File Type: GIF image data, version 89a, 177 x 250, Stream Size: 2299

General
Stream Path:	PrvImage
File Type:	GIF image data, version 89a, 177 x 250
Stream Size:	2299
Entropy:	7.39182439445
Base64 Encoded:	False
Data ASCII:	G I F 8 9 a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x x x k k k ] ] ] P P P C C C 5 5 5 ( ( ( . . . . . . . . . . . . . . . . . . . . . . d ` . L H . 0 0 . . . . . . . . . . . . . . . . . . . . . ` . . H . . . . . . . . . . . . . . . . ` . . H . . 0 . . . . \| . . p . . d . . X . . L . . @ . ` 0 . H . . . . . . . . . . . . . . . ` . . H . . 0 . . . . . . . . . . . . . . . . . . . . . ` d . H L . . . . . . . . . . . . . . . `
Data Raw:	47 49 46 38 39 61 b1 00 fa 00 f7 00 00 00 00 00 80 00 00 00 80 00 80 80 00 00 00 80 80 00 80 00 80 80 c0 c0 c0 fe fe fe f1 f1 f1 e4 e4 e4 d6 d6 d6 c9 c9 c9 bb bb bb ae ae ae a1 a1 a1 93 93 93 86 86 86 78 78 78 6b 6b 6b 5d 5d 5d 50 50 50 43 43 43 35 35 35 28 28 28 1a 1a 1a 0d 0d 0d 01 01 01 f8 cc c8 f8 b0 b0 f8 98 98 f8 80 80 f8 64 60 f8 4c 48 f8 30 30 f8 18 18 f8 00 00 e0 00 00 c8

Stream Path: PrvText, File Type: data, Stream Size: 2044

General
Stream Path:	PrvText
File Type:	data
Stream Size:	2044
Entropy:	5.62486222368
Base64 Encoded:	False
Data ASCII:	Y . P . . . % . X . . 8 . . . . . . . . . . . ) . H . * . . . . . A . . S . t . u . d . y . . o . n . . I . m . p . r . o . v . e . m . e . n . t . . o . f . . S . c . h . o . o . l . . V . i . o . l . e . n . c . e . . . . . . . . . . . . . . . . . $ @ . . . . . * . * . . . . . . . . . < . > . < . . . . . } . > . < . > . . . . . < . > . < . > . . . . . < . . . . . . . . . l . . . . . . . . . Y . P . . . % . X . . 8 . . . . . D . . . . . . . . h . < . \\ . h . , .
Data Raw:	59 d5 50 ad ed d3 25 b8 58 c7 20 00 38 bb 1c c8 10 c8 fc ac 20 00 1c ac 20 c1 29 bc 48 c5 2a 00 0d 00 0a 00 41 00 20 00 53 00 74 00 75 00 64 00 79 00 20 00 6f 00 6e 00 20 00 49 00 6d 00 70 00 72 00 6f 00 76 00 65 00 6d 00 65 00 6e 00 74 00 20 00 6f 00 66 00 20 00 53 00 63 00 68 00 6f 00 6f 00 6c 00 20 00 56 00 69 00 6f 00 6c 00 65 00 6e 00 63 00 65 00 0d 00 0a 00 0d 00 0a 00 20 00

Stream Path: Scripts/DefaultJScript, File Type: data, Stream Size: 137

General
Stream Path:	Scripts/DefaultJScript
File Type:	data
Stream Size:	137
Entropy:	6.63252523982
Base64 Encoded:	False
Data ASCII:	u . . . . P . D O . . . p K m . . X . X X I k G . . . B . Q . . . . 2 \\ . Q . d & . . . . M . . . . . . . . . . * Z : . . . . 3 G . . . . 1 > . . . . . . . $ . . . ( Y . . . g z . . . . ] 2 V . ! . . . 3 N . . l . . . . . ' B . k . R 2 D . 4 . 9 . . . . j . . . . . . . . .
Data Raw:	75 8e bb 0e 82 50 10 44 4f 8b 09 ff 70 4b 6d a0 87 58 90 58 58 49 6b 47 08 8f 84 42 ae 51 84 c2 f8 ed 32 5c b0 51 d9 64 26 9b dd cc d9 4d 81 9e 9c 1b 86 03 96 82 07 17 2a 5a 3a ee 9a ed a5 33 47 06 ae 7f f6 31 3e 9b d5 fc 9c fe a5 06 24 ba d3 d1 28 59 91 ad f2 67 7a 08 d4 fa aa 5d 32 56 9d 21 95 7f 93 33 4e e2 0d 6c d9 b9 e4 d3 b9 27 42 a8 6b 96 52 32 44 d2 34 7f 39 9f f4 a9 b7 6a

Stream Path: Scripts/JScriptVersion, File Type: data, Stream Size: 14

General
Stream Path:	Scripts/JScriptVersion
File Type:	data
Stream Size:	14
Entropy:	2.97809488817
Base64 Encoded:	False
Data ASCII:	c d ` . . . . . . . . . . .
Data Raw:	63 64 60 00 03 00 f7 df 88 a9 08 00 00 00

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: Hwp.exe PID: 3100 Parent PID: 3096

General

Start time:	12:37:23
Start date:	14/06/2016
Path:	C:\Program Files\HNC\HOffice9\Bin\Hwp.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x160000
File size:	5581320 bytes
MD5 hash:	551A007AC44F36E62BAFFA932241F0CB
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: HimTrayIcon.exe PID: 2808 Parent PID: 3100

General

Start time:	12:37:25
Start date:	14/06/2016
Path:	C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\HNC\HOffice9\Bin\HimTrayIcon.exe
Imagebase:	0x77ca0000
File size:	711176 bytes
MD5 hash:	60604F41453D91F840DE8AB8FCE7EA7C
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Hwp.exe PID: 3100 Parent PID: 3096

Executed Functions

Function 09FD007D, Relevance: .2, Instructions: 164

Memory Dump Source

Source File: 00000000.00000002.12114272956.09FD0000.00000010.sdmp, Offset: 09FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd0000_Hwp.jbxd

Function 09FD0215, Relevance: .0, Instructions: 22

Memory Dump Source

Source File: 00000000.00000002.12114272956.09FD0000.00000010.sdmp, Offset: 09FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd0000_Hwp.jbxd

Function 09FD026B, Relevance: .0, Instructions: 8

Memory Dump Source

Source File: 00000000.00000002.12114272956.09FD0000.00000010.sdmp, Offset: 09FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd0000_Hwp.jbxd

Function 0A480FD7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12114419879.0A480000.00000010.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a480000_Hwp.jbxd

Function 0A480FC7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12114419879.0A480000.00000010.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a480000_Hwp.jbxd

Function 0A480FDF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12114419879.0A480000.00000010.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a480000_Hwp.jbxd

Function 0A480FCF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12114419879.0A480000.00000010.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a480000_Hwp.jbxd

Function 07590F67, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F7F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590ED7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590EDF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590EAF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F57, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590FA7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590FCF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590E7F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F8F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590FC7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590EFF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F87, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590EF7, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F3F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F2F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590FAF, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F6F, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Function 07590F37, Relevance: .0, Instructions: 4

Memory Dump Source

Source File: 00000000.00000002.12112989659.07590000.00000010.sdmp, Offset: 07590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7590000_Hwp.jbxd

Non-executed Functions

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Analysis Advice

Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Networking:

Spreading:

System Summary:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Yara Overview

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static OLE Info

General

OLE File

Indicators

Streams

Stream Path: \x5HwpSummaryInformation, File Type: data, Stream Size: 489

General

Stream Path: BodyText/Section0, File Type: data, Stream Size: 45580

General

Stream Path: DocInfo, File Type: data, Stream Size: 1643

General

Stream Path: DocOptions/_LinkDoc, File Type: data, Stream Size: 524

General

Stream Path: FileHeader, File Type: Hangul (Korean) Word Processor File 3.0, Stream Size: 256

General

Stream Path: PrvImage, File Type: GIF image data, version 89a, 177 x 250, Stream Size: 2299

General

Stream Path: PrvText, File Type: data, Stream Size: 2044

General

Stream Path: Scripts/DefaultJScript, File Type: data, Stream Size: 137

General

Stream Path: Scripts/JScriptVersion, File Type: data, Stream Size: 14

General

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: Hwp.exe PID: 3100 Parent PID: 3096

General

Chronological Activities

Analysis Process: HimTrayIcon.exe PID: 2808 Parent PID: 3100

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Hwp.exe PID: 3100 Parent PID: 3096

Executed Functions

Function 09FD007D, Relevance: .2, Instructions: 164

Function 09FD0215, Relevance: .0, Instructions: 22

Function 09FD026B, Relevance: .0, Instructions: 8

Function 0A480FD7, Relevance: .0, Instructions: 4

Function 0A480FC7, Relevance: .0, Instructions: 4

Function 0A480FDF, Relevance: .0, Instructions: 4

Function 0A480FCF, Relevance: .0, Instructions: 4