Create Interactive Tour

Windows Analysis Report
XDelta3.exe

Overview

General Information

Sample Name:	XDelta3.exe
Analysis ID:	1304926
MD5:	1a2bbe17070a0281f5dbc643e740acb8
SHA1:	00e4374c1a39434643b53b8d0418e20bd98eeb47
SHA256:	8cd3e6814795cd611e61eca644b6a072758c6880655a24e4a36390635137789b
Infos:

Detection

Score:	6
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Found evaded block containing many API calls

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

XDelta3.exe (PID: 6724 cmdline: C:\Users\user\Desktop\XDelta3.exe MD5: 1A2BBE17070A0281F5DBC643E740ACB8)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Joe Sandbox Signatures

• Compliance
• Spreading
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: XDelta3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: g:\jmacd\svn\xdelta3\release\xdelta3.pdb source: XDelta3.exe
Source:	Binary string: g:\jmacd\svn\xdelta3\release\xdelta3.pdb`a source: XDelta3.exe

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_004138BF __getdrive,FindFirstFileA,__fullpath,__fullpath,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,

0_2_004138BF

Source: XDelta3.exe, 00000000.00000002.366714434.000000000061A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_9322b205-b

Source: XDelta3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00417777	0_2_00417777
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00402800	0_2_00402800
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0040D0C0	0_2_0040D0C0
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_004148DE	0_2_004148DE
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_004090F0	0_2_004090F0
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00410CA0	0_2_00410CA0
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0040C160	0_2_0040C160
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00416160	0_2_00416160
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00421D19	0_2_00421D19
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0042291F	0_2_0042291F
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00423DFE	0_2_00423DFE
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00406E40	0_2_00406E40
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0040F650	0_2_0040F650
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0042225B	0_2_0042225B
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00409600	0_2_00409600
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00408700	0_2_00408700
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00415B39	0_2_00415B39
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_004217D7	0_2_004217D7
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00408BE0	0_2_00408BE0
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_004237F4	0_2_004237F4

Source: C:\Users\user\Desktop\XDelta3.exe	Code function: String function: 00412A78 appears 218 times
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: String function: 0040A610 appears 33 times
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: String function: 004160FC appears 38 times

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_0040A3A0 ReadFile,GetLastError,_memset,FormatMessageA,_fprintf,_fprintf,

0_2_0040A3A0

Source: XDelta3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\XDelta3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XDelta3.exe C:\Users\user\Desktop\XDelta3.exe
Source: C:\Users\user\Desktop\XDelta3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_01

Source: classification engine

Classification label: clean6.winEXE@2/1@0/0

Source: XDelta3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: g:\jmacd\svn\xdelta3\release\xdelta3.pdb source: XDelta3.exe
Source:	Binary string: g:\jmacd\svn\xdelta3\release\xdelta3.pdb`a source: XDelta3.exe

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_00416141 push ecx; ret

0_2_00416154

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_00419FA5 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00419FA5

Source: C:\Users\user\Desktop\XDelta3.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-17683

Source: C:\Users\user\Desktop\XDelta3.exe

Evaded block: after key decision

graph_0-18878

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\XDelta3.exe

0_2_004138BF

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_0041241C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041241C

Source: C:\Users\user\Desktop\XDelta3.exe

0_2_00419FA5

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_00413C72 GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,

0_2_00413C72

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0041241C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041241C
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_0041242B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041242B
Source: C:\Users\user\Desktop\XDelta3.exe	Code function: 0_2_00415280 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00415280

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: GetLocaleInfoA,

0_2_0041DE07

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_0041DAF9 cpuid

0_2_0041DAF9

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_0041CFBC __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0041CFBC

Source: C:\Users\user\Desktop\XDelta3.exe

0_2_00413C72

Source: C:\Users\user\Desktop\XDelta3.exe

Code function: 0_2_0040C160 _memset,_memset,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,_fprintf,_strtol,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,_fprintf,

0_2_0040C160

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	Path Interception	1 Process Injection	1 Process Injection	1 Input Capture	2 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XDelta3.exe	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1304926
Start date and time:	2023-09-07 08:10:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	XDelta3.exe
Detection:	CLEAN
Classification:	clean6.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 6 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: XDelta3.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\XDelta3.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.210882914624721
Encrypted:	false
SSDEEP:	3:cfFKuRvE5EP550MPEJvn:K7Rv3PEh
MD5:	AA348CCB0A6F27A5296517FF22252150
SHA1:	9FF33B37C7B75E83B684A90676F5DFB3AE5501E9
SHA-256:	9B00910FC21C3C6E58CDD8A4FD3498129C73BEFA73129565A82DC10AC3348A1F
SHA-512:	879DFAD8C53348D715D97BCD40B0BBA6D8DCBB97005ED1EBB9D29CFD4B0F646738EEC08054600E821401C613AB6C2A8990604A7734F22C64CD76C4D990AA5FED
Malicious:	false
Reputation:	low
Preview:	xdelta3: input read failed: (stdin): The handle is invalid......

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.452646876036035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XDelta3.exe
File size:	184'320 bytes
MD5:	1a2bbe17070a0281f5dbc643e740acb8
SHA1:	00e4374c1a39434643b53b8d0418e20bd98eeb47
SHA256:	8cd3e6814795cd611e61eca644b6a072758c6880655a24e4a36390635137789b
SHA512:	c7f15aae73f01134e5bb40c8368ae74d8ce2d99d31ee9f7652cdfe3f547ecb2fc65a0450343f3d24a3b2ac2d2748f59690a01a18e0e456224970fe7a243bfa90
SSDEEP:	3072:PlYiMhYr5bseAeM60UXC164Wqe3v+tHzJO6LMJtcxHpDwi7Nrmg8MPpkEG+trRSK:Pl1j/M60UXQBe3v+tHzJO6LMJtcxRwit
TLSH:	FC048C31B5C0D0F1C8A6107265A5CB3A9B36A116533A85E7F7B92FD5AB306F0D33A21D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."f..f...f...f.......d...A...@...A...F...A...........e...f.......A...g...A...g...A...g...Richf...........PE..L...,..F...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x413e28
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4607032C [Sun Mar 25 23:18:04 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	41043cd6713b2fce95740de7d275bb9d

Entrypoint Preview

Instruction
call 00007F19D4A1FA10h
jmp 00007F19D4A19F45h
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0042B7F8h], eax
mov dword ptr [0042B7F4h], ecx
mov dword ptr [0042B7F0h], edx
mov dword ptr [0042B7ECh], ebx
mov dword ptr [0042B7E8h], esi
mov dword ptr [0042B7E4h], edi
mov word ptr [0042B810h], ss
mov word ptr [0042B804h], cs
mov word ptr [0042B7E0h], ds
mov word ptr [0042B7DCh], es
mov word ptr [0042B7D8h], fs
mov word ptr [0042B7D4h], gs
pushfd
pop dword ptr [0042B808h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0042B7FCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0042B800h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042B80Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0042B748h], 00010001h
mov eax, dword ptr [0042B800h]
mov dword ptr [0042B6FCh], eax
mov dword ptr [0042B6F0h], C0000409h
mov dword ptr [0042B6F4h], 00000001h
mov eax, dword ptr [0042A404h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0042A408h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [0042406Ch]

Rich Headers

Programming Language:

[C++] VS2005 build 50727
[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2977c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x241b0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29200	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x174	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22fca	0x23000	False	0.5693010602678571	data	6.672409060094496	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x5fc4	0x6000	False	0.4010009765625	data	5.815877013653106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0xd4c4	0x2000	False	0.2623291015625	data	2.74589023396663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x38000	0xf8	0x1000	False	0.04638671875	data	0.44638350821621453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x38060	0x92	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.9041095890410958

Imports

DLL

Import

KERNEL32.dll

CreateFileA, SystemTimeToFileTime, SetFilePointerEx, FormatMessageA, WriteFile, ReadFile, GetFileSizeEx, GetStartupInfoA, GetLastError, GetLocalTime, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapFree, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDriveTypeA, FindFirstFileA, GetCommandLineA, GetVersionExA, GetProcessHeap, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, GetProcAddress, GetModuleHandleA, ExitProcess, GetStdHandle, GetModuleFileNameA, HeapDestroy, HeapCreate, VirtualFree, DeleteCriticalSection, VirtualAlloc, HeapReAlloc, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetHandleCount, GetFileType, Sleep, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetFileAttributesA, GetFullPathNameA, GetCurrentDirectoryA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LoadLibraryA, InitializeCriticalSection, SetFilePointer, RtlUnwind, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetTimeZoneInformation, HeapSize, DeleteFileA, RaiseException

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• XDelta3.exe
• conhost.exe

Click to jump to process

Click to jump to process

Behavior

• XDelta3.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	08:11:06
Start date:	07/09/2023
Path:	C:\Users\user\Desktop\XDelta3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\XDelta3.exe
Imagebase:	0x400000
File size:	184'320 bytes
MD5 hash:	1A2BBE17070A0281F5DBC643E740ACB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:11:07
Start date:	07/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	2000
Total number of Limit Nodes:	68

Executed Functions

Function 0040A3A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(0040C061,?,?,0040C061,00000000,?,?,0040C061,source read failed), ref: 0040A3AF
GetLastError.KERNEL32 ref: 0040A3B9
_memset.LIBCMT ref: 0040A3E4
FormatMessageA.KERNELBASE(00001200,00000000,00000000,00000400,00430D78,00000100,00000000), ref: 0040A405
_fprintf.LIBCMT ref: 0040A428
_fprintf.LIBCMT ref: 0040A459

Strings

xdelta3: main read: %s: %u, xrefs: 0040A44B
xdelta3: %s: %s: %s, xrefs: 0040A41A
xC, xrefs: 0040A40B

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$ErrorFileFormatLastMessageRead_memset
String ID: xC$xdelta3: %s: %s: %s$xdelta3: main read: %s: %u
API String ID: 609771618-2075157648
Opcode ID: 22f79e62f8fa25b1a7185863011ea93ea98cda7cead50f793c7607148936a652
Instruction ID: 07601248f1faade19142c2662c608b01915fc1c3fe82050ed259198f2a1e788a
Opcode Fuzzy Hash: 22f79e62f8fa25b1a7185863011ea93ea98cda7cead50f793c7607148936a652
Instruction Fuzzy Hash: 6311AFB63403006BE720DB69DC06F6732A8DBC8B45F24452EFA45D7280E6B8E851872E

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fprintf.LIBCMT ref: 0040CE80
_fprintf.LIBCMT ref: 0040CEBA
_fprintf.LIBCMT ref: 0040CF07
_fprintf.LIBCMT ref: 0040CF47

Strings

xdelta3: free: %p, xrefs: 0040CE72, 0040CEAC, 0040CEF9, 0040CF39

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf
String ID: xdelta3: free: %p
API String ID: 1654120334-3252779765
Opcode ID: 2830d352bbe9c68415eddea1e4e968cb3e03cc0414bedf0d70f2d78678a40967
Instruction ID: 363d756a8ae9428617fa898f45c2fa13a1a239c4b3e5d345ab1b78d4025ec451
Opcode Fuzzy Hash: 2830d352bbe9c68415eddea1e4e968cb3e03cc0414bedf0d70f2d78678a40967
Instruction Fuzzy Hash: 9A21E4F3800212BBCB20AF55BCC295B3664A751348346917FF804F6392E77D999886AE

Uniqueness

Uniqueness Score: -1.00%

Function 00412599 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 004125B7

Part of subcall function 004155CB: __mtinitlocknum.LIBCMT ref: 004155DF
Part of subcall function 004155CB: __amsg_exit.LIBCMT ref: 004155EB
Part of subcall function 004155CB: EnterCriticalSection.KERNEL32(?,?,?,00418986,00000004,00429560,0000000C,00417608,00000001,00000001,00000000,00000000,00000000,00416EDF,00000001,00000214), ref: 004155F3

___sbh_find_block.LIBCMT ref: 004125C2
___sbh_free_block.LIBCMT ref: 004125D1
RtlFreeHeap.NTDLL(00000000,?,004292B0,0000000C,004155AC,00000000,00429418,0000000C,004155E4,?,?,?,00418986,00000004,00429560,0000000C), ref: 00412601
GetLastError.KERNEL32(?,?,00000000), ref: 00412612

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: ab9024c0a646b11bb89ea521476762969ea0db697559758a2a4994644a8c8cab
Instruction ID: 34a5572fd1abc60fa39364c5b11391a86c4c6ae36a0879bb52a82be2a7117a85
Opcode Fuzzy Hash: ab9024c0a646b11bb89ea521476762969ea0db697559758a2a4994644a8c8cab
Instruction Fuzzy Hash: 0F018431A44211FADB206BA19D06BDA7BA4AF10725F50405FF504D61C2CF7C85D19A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004153FB Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00413D33,00000001), ref: 0041540C
HeapDestroy.KERNEL32 ref: 00415442

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 78bd7b0291c2b86d86b9cf3739766faba4436dba5711dba4f431435e91b3ba3f
Instruction ID: 57b2affc799a1d3d62396e6c664e136c910e3fd8211eaf82589f85daf65fc3a1
Opcode Fuzzy Hash: 78bd7b0291c2b86d86b9cf3739766faba4436dba5711dba4f431435e91b3ba3f
Instruction Fuzzy Hash: 1BE06D317B4701EBDB20AB309D857E63794DBC0357F50443AF540C51A0E77994C3AA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00413F80 Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00413F84

Part of subcall function 00413F5A: GetModuleHandleA.KERNEL32(mscoree.dll,00413F89,00000000,004126AF,000000FF,0000001E,00000001,00000000,00000000,?,004175C2,?,00000001,?,00415555,00000018), ref: 00413F5F
Part of subcall function 00413F5A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00413F6F

ExitProcess.KERNEL32 ref: 00413F8E

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: ebf75169ba4ff0f5e2d98f789d755d748665d71b46724bcc4c540a91451b0875
Instruction ID: f28b959128ea96e11e4e344f01fec86e664dbaefd814035faa10defacd19f4fc
Opcode Fuzzy Hash: ebf75169ba4ff0f5e2d98f789d755d748665d71b46724bcc4c540a91451b0875
Instruction Fuzzy Hash: 4FB00231508201EFEA162F21ED0B45D7B71FF80716F51446DF14D440719B755DE9BA0E

Uniqueness

Uniqueness Score: -1.00%

Function 004141EE Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 004141F6

Part of subcall function 00414120: __lock.LIBCMT ref: 0041412E
Part of subcall function 00414120: __decode_pointer.LIBCMT ref: 0041415D
Part of subcall function 00414120: __decode_pointer.LIBCMT ref: 0041416A

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: __decode_pointer$__lock_doexit
String ID:
API String ID: 3276244213-0
Opcode ID: 44ea3af290a5c0fced421c48bee69f607f8ea4075bd654cc3defe53151bfea1d
Instruction ID: c176d1bc320d54ae4f48426124398f7e964cf9b541010b6323291d60d4e150b4
Opcode Fuzzy Hash: 44ea3af290a5c0fced421c48bee69f607f8ea4075bd654cc3defe53151bfea1d
Instruction Fuzzy Hash: F5A0247454030035D51111007C03F04370317D0F04FF041147704140D151751154400F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410CA0 Relevance: 257.2, APIs: 99, Strings: 47, Instructions: 1702windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00410CC2
_fprintf.LIBCMT ref: 00410CE4

Part of subcall function 004050E0: _memset.LIBCMT ref: 0040510B
Part of subcall function 004050E0: _memset.LIBCMT ref: 0040511B

Part of subcall function 0040DE40: _rand.LIBCMT ref: 0040DE52

_fprintf.LIBCMT ref: 00410D33

Part of subcall function 004134B2: __stbuf.LIBCMT ref: 004135C0
Part of subcall function 004134B2: __output_l.LIBCMT ref: 004135D0
Part of subcall function 004134B2: __ftbuf.LIBCMT ref: 004135DA

_fprintf.LIBCMT ref: 00410DDB
_memset.LIBCMT ref: 00410DFF
_fprintf.LIBCMT ref: 00410E21
_fprintf.LIBCMT ref: 00410E74
_memset.LIBCMT ref: 00410ED6
FormatMessageA.KERNEL32(00001200,00000000,00000001,00000400,00430D78,00000100,00000000), ref: 00410EF5
_fprintf.LIBCMT ref: 00410F1C
_memset.LIBCMT ref: 00410F40
_fprintf.LIBCMT ref: 00410F62
_fprintf.LIBCMT ref: 00410FB2
_memset.LIBCMT ref: 00411014
FormatMessageA.KERNEL32(00001200,00000000,00000001,00000400,00430D78,00000100,00000000), ref: 00411033
_fprintf.LIBCMT ref: 0041105A
_memset.LIBCMT ref: 0041107E
_fprintf.LIBCMT ref: 004110A0
_fprintf.LIBCMT ref: 004110E5
_memset.LIBCMT ref: 00411105
FormatMessageA.KERNEL32(00001200,00000000,00000001,00000400,00430D78,00000100,00000000), ref: 00411124
_fprintf.LIBCMT ref: 0041114B
_memset.LIBCMT ref: 0041116F
_fprintf.LIBCMT ref: 00411191
_fprintf.LIBCMT ref: 004111D6
_memset.LIBCMT ref: 004111F6
FormatMessageA.KERNEL32(00001200,00000000,00000001,00000400,00430D78,00000100,00000000), ref: 00411215
_fprintf.LIBCMT ref: 0041123C
_memset.LIBCMT ref: 00411260
_fprintf.LIBCMT ref: 00411282
_fprintf.LIBCMT ref: 004112B3
_fprintf.LIBCMT ref: 004112E4
_memset.LIBCMT ref: 00411300
_fprintf.LIBCMT ref: 00411322
_fprintf.LIBCMT ref: 00411367
_fprintf.LIBCMT ref: 00411398
_memset.LIBCMT ref: 004113BC
_fprintf.LIBCMT ref: 004113DE
_fprintf.LIBCMT ref: 00411427
_fprintf.LIBCMT ref: 00411458
_memset.LIBCMT ref: 0041147C
_fprintf.LIBCMT ref: 0041149E
_fprintf.LIBCMT ref: 004114E3
_fprintf.LIBCMT ref: 00411514
_memset.LIBCMT ref: 00411538
_fprintf.LIBCMT ref: 0041155A
_fprintf.LIBCMT ref: 0041159F
_fprintf.LIBCMT ref: 004115D0
_memset.LIBCMT ref: 004115F4
_fprintf.LIBCMT ref: 00411616
_fprintf.LIBCMT ref: 0041165B
_fprintf.LIBCMT ref: 0041168C
_memset.LIBCMT ref: 004116B0
_fprintf.LIBCMT ref: 004116D2
_fprintf.LIBCMT ref: 00411717
_fprintf.LIBCMT ref: 00411748
_memset.LIBCMT ref: 0041176C
_fprintf.LIBCMT ref: 0041178E
_fprintf.LIBCMT ref: 004117D3
_fprintf.LIBCMT ref: 00411804
_memset.LIBCMT ref: 00411828
_fprintf.LIBCMT ref: 0041184A
_fprintf.LIBCMT ref: 00411899
_fprintf.LIBCMT ref: 004118CA
_memset.LIBCMT ref: 004118EE
_fprintf.LIBCMT ref: 00411910
_fprintf.LIBCMT ref: 0041196E

Strings

%.3f, xrefs: 00411BD8
xdelta3: testing decode_integer_end_of_input%s..., xrefs: 00410E0C
xdelta3: testing address_cache%s..., xrefs: 0041130D
xdelta3: testing string_matching%s..., xrefs: 004113C9
check failure: p_off == input_size, xrefs: 00411CFA
xdelta3: testing encode_decode_uint64_t%s..., xrefs: 0041117C
(XD3_SEC_DJW), xrefs: 004121E2
success, xrefs: 00410D25, 00410E66, 00410FA4, 004110D7, 004111C8, 004112A5, 00411359, 00411419, 004114D5, 00411591, 0041164D, 00411709, 004117C5, 0041188B, 00411F28, 00411FED, 004120B2, 00412177, 0041223C, 004122FC
xdelta3: testing decompress_single_bit_error%s..., xrefs: 00411F9C, 0041205D, 00412122, 004121E7
XD3_GETSRCBLK, xrefs: 00410D60, 00410EA1, 00410FDF
overflow in read_intger, xrefs: 00410F8E
xdelta3: testing secondary_huff%s..., xrefs: 00411835
aB, xrefs: 00411C74
test %u: decode: %s, xrefs: 00411D4B
xdelta3: testing usize_t_overflow%s..., xrefs: 0041126D
xdelta3: testing iopt_flush_instructions%s..., xrefs: 004116BD
xC, xrefs: 00410EF7
aB, xrefs: 00411A93
test %u: encode: %s, xrefs: 00411B5A
xC, xrefs: 00411126
XD3_INTERNAL, xrefs: 00410D83, 00410EC4, 00411002
XD3_INPUT, xrefs: 00410D52, 00410E93, 00410FD1
XD3_OUTPUT, xrefs: 00410D59, 00410E9A, 00410FD8
xdelta3: testing encode_decode_uint32_t%s..., xrefs: 0041108B
xdelta3: testing identical_behavior%s..., xrefs: 00411601
xdelta3: testing source_cksum_offset%s..., xrefs: 00411779
xdelta3: testing decode_integer_overflow%s..., xrefs: 00410F4D
xdelta3: testing in_memory%s..., xrefs: 00411545
(XD3_ADLER32), xrefs: 00412058
xdelta3: testing choose_instruction%s..., xrefs: 00411489
xdelta3: testing compressed_stream_overflow%s..., xrefs: 004122AC
, xrefs: 004121EC
xC, xrefs: 00410DB6
XD3_WINFINISH, xrefs: 00410D75, 00410EB6, 00410FF4
xC, xrefs: 00412360
end-of-input in read_integer, xrefs: 00410E4D
check failure: p_off == compress_size, xrefs: 00411CB4
XD3_WINSTART, xrefs: 00410D6E, 00410EAF, 00410FED
xdelta3: testing random_numbers%s..., xrefs: 00410CCF
xdelta3: testing secondary_fgk%s..., xrefs: 004118FB
(XD3_SEC_FGK), xrefs: 0041211D
XD3_GOTHEADER, xrefs: 00410D67, 00410EA8, 00410FE6
XD3_TOOFARBACK, xrefs: 00410D7C, 00410EBD, 00410FFB
xC, xrefs: 00411217
..., xrefs: 00411960
failed: %s: %s, xrefs: 00410DCD, 00410F0E, 0041104C, 0041113D, 0041122E, 004112D6, 0041138A, 0041144A, 00411506, 004115C2, 0041167E, 0041173A, 004117F6, 004118BC, 00411F5D, 0041201E, 004120E3, 004121A8, 0041226D, 0041232D
xC, xrefs: 00411035

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$_memset$FormatMessage$__ftbuf__output_l__stbuf_rand
String ID: ...$ $ (XD3_ADLER32)$ (XD3_SEC_DJW)$ (XD3_SEC_FGK)$ failed: %s: %s$ success$%.3f$XD3_GETSRCBLK$XD3_GOTHEADER$XD3_INPUT$XD3_INTERNAL$XD3_OUTPUT$XD3_TOOFARBACK$XD3_WINFINISH$XD3_WINSTART$check failure: p_off == compress_size$check failure: p_off == input_size$end-of-input in read_integer$overflow in read_intger$test %u: decode: %s$test %u: encode: %s$xC$xC$xC$xC$xC$xC$xdelta3: testing address_cache%s...$xdelta3: testing choose_instruction%s...$xdelta3: testing compressed_stream_overflow%s...$xdelta3: testing decode_integer_end_of_input%s...$xdelta3: testing decode_integer_overflow%s...$xdelta3: testing decompress_single_bit_error%s...$xdelta3: testing encode_decode_uint32_t%s...$xdelta3: testing encode_decode_uint64_t%s...$xdelta3: testing identical_behavior%s...$xdelta3: testing in_memory%s...$xdelta3: testing iopt_flush_instructions%s...$xdelta3: testing random_numbers%s...$xdelta3: testing secondary_fgk%s...$xdelta3: testing secondary_huff%s...$xdelta3: testing source_cksum_offset%s...$xdelta3: testing string_matching%s...$xdelta3: testing usize_t_overflow%s...$aB$aB
API String ID: 2296705132-1227281115
Opcode ID: 7feffe88ac4ab1269971850949d7939e722e5d89e47124f1444d19cff2962ec8
Instruction ID: aa047577db10a34dda27f5ca5d2aa336608f292115637411b214aa15039d92eb
Opcode Fuzzy Hash: 7feffe88ac4ab1269971850949d7939e722e5d89e47124f1444d19cff2962ec8
Instruction Fuzzy Hash: 15C248F2A043405BD720ABA1DC42BDF72989F90748F54482FF549E7242EABDE9D4835E

Uniqueness

Uniqueness Score: -1.00%

Function 0040C160 Relevance: 93.6, APIs: 29, Strings: 24, Instructions: 820timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040C1B2
_memset.LIBCMT ref: 0040C1C5
GetLocalTime.KERNEL32 ref: 0040C222
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040C232
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040C248
_fprintf.LIBCMT ref: 0040C30E
_strtol.LIBCMT ref: 0040C368
_fprintf.LIBCMT ref: 0040C402
_fprintf.LIBCMT ref: 0040CDFC

Strings

djw, xrefs: 0040C2ED
xdelta3: internal error, xrefs: 0040CDEE
xdelta3: unrecognized secondary compressor type: %s, xrefs: 0040C300
xdelta3: compression level: %d, xrefs: 0040C41E
xdelta3: %I64u: in %s: out %s: total in %s: out %s: %s, xrefs: 0040CAB5
xdelta3: warning: output window %I64u does not copy source, xrefs: 0040C6E4
xdelta3: scanner configuration: %s, xrefs: 0040CBA8
xdelta3: %I64u: in %s (%s): out %s (%s): total in %s: out %s: %s, xrefs: 0040CA15
xdelta3: finished in %s; input %I64u output %I64u bytes (%0.2f%%), xrefs: 0040CD9E
xdelta3: %s: %s, xrefs: 0040C552, 0040CDD1
xdelta3: input requires a source file, use -s, xrefs: 0040CB56
xdelta3: target copies: %I64u (%I64u bytes), xrefs: 0040CC63
xdelta3: nothing to output: %s, xrefs: 0040CB36
xdelta3: target hash table size: %u, xrefs: 0040CBC6
xdelta3: adds: %I64u (%I64u bytes), xrefs: 0040CC99
xdelta3: runs: %I64u (%I64u bytes), xrefs: 0040CCCF
, xrefs: 0040C31B
xdelta3: source hash table size: %u, xrefs: 0040CBEA
xdelta3: warning: input position %I64u overflowed instruction buffer, needed %u (vs. %u), consider raising -I, xrefs: 0040C8AF
xdelta3: source copies: %I64u (%I64u bytes), xrefs: 0040CC2D
input read failed, xrefs: 0040C5BC
fgk, xrefs: 0040C2D4
xdelta3: invalid string match specifier (-C) %d: %s, xrefs: 0040C3F4
xdelta3: warning: input window %I64u..%I64u has no source copies, xrefs: 0040C852

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: Time_fprintf$_memset$FileLocalSystemUnothrow_t@std@@@__ehfuncinfo$??2@_strtol
String ID: $djw$fgk$input read failed$xdelta3: %I64u: in %s (%s): out %s (%s): total in %s: out %s: %s$xdelta3: %I64u: in %s: out %s: total in %s: out %s: %s$xdelta3: %s: %s$xdelta3: adds: %I64u (%I64u bytes)$xdelta3: compression level: %d$xdelta3: finished in %s; input %I64u output %I64u bytes (%0.2f%%)$xdelta3: input requires a source file, use -s$xdelta3: internal error$xdelta3: invalid string match specifier (-C) %d: %s$xdelta3: nothing to output: %s$xdelta3: runs: %I64u (%I64u bytes)$xdelta3: scanner configuration: %s$xdelta3: source copies: %I64u (%I64u bytes)$xdelta3: source hash table size: %u$xdelta3: target copies: %I64u (%I64u bytes)$xdelta3: target hash table size: %u$xdelta3: unrecognized secondary compressor type: %s$xdelta3: warning: input position %I64u overflowed instruction buffer, needed %u (vs. %u), consider raising -I$xdelta3: warning: input window %I64u..%I64u has no source copies$xdelta3: warning: output window %I64u does not copy source
API String ID: 2132240471-2679980791
Opcode ID: c34595216da85bd0731b743fbcc7a04f21f3492e5ca10f62491940867d340d7e
Instruction ID: bed8a38ed4c89740abb10915bf89e26e3e2f10b6be73277c6cadcda6ba39037b
Opcode Fuzzy Hash: c34595216da85bd0731b743fbcc7a04f21f3492e5ca10f62491940867d340d7e
Instruction Fuzzy Hash: DE6281B1908340DBD730DF15DC81BABB7E4AB84304F544A3EF989A3381D779A9448B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0C0 Relevance: 91.6, APIs: 23, Strings: 29, Instructions: 645COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(00431678), ref: 0040D0D4
_setvbuf.LIBCMT ref: 0040D0E9
_memset.LIBCMT ref: 0040D0F6
_memset.LIBCMT ref: 0040D110
_memset.LIBCMT ref: 0040D127

Part of subcall function 0040CF80: _getenv.LIBCMT ref: 0040CF89

_fprintf.LIBCMT ref: 0040D50D
_fprintf.LIBCMT ref: 0040D556
_fprintf.LIBCMT ref: 0040D573
_fprintf.LIBCMT ref: 0040D826
_fprintf.LIBCMT ref: 0040D874
_fprintf.LIBCMT ref: 0040D8B1
_fprintf.LIBCMT ref: 0040D900
_fprintf.LIBCMT ref: 0040D93A
_fprintf.LIBCMT ref: 0040D96F
_fprintf.LIBCMT ref: 0040D7F5

Part of subcall function 004134B2: __stbuf.LIBCMT ref: 004135C0
Part of subcall function 004134B2: __output_l.LIBCMT ref: 004135D0
Part of subcall function 004134B2: __ftbuf.LIBCMT ref: 004135DA

Part of subcall function 00412599: __lock.LIBCMT ref: 004125B7
Part of subcall function 00412599: ___sbh_find_block.LIBCMT ref: 004125C2
Part of subcall function 00412599: ___sbh_free_block.LIBCMT ref: 004125D1
Part of subcall function 00412599: RtlFreeHeap.NTDLL(00000000,?,004292B0,0000000C,004155AC,00000000,00429418,0000000C,004155E4,?,?,?,00418986,00000004,00429560,0000000C), ref: 00412601
Part of subcall function 00412599: GetLastError.KERNEL32(?,?,00000000), ref: 00412612

_fprintf.LIBCMT ref: 0040D9A0

Strings

open, xrefs: 0040D6E0
xdelta3: warning: -D option ignored, external compression support was not compiled, xrefs: 0040D4FF
XD3_GETSRCBLK, xrefs: 0040D672
xdelta3: invalid file name: empty string, xrefs: 0040D60A
0123456789cdefhnqvDJNORTVs:B:C:E:F:I:L:O:M:P:W:A::S::, xrefs: 0040D2ED
VERSION=3.0q, xrefs: 0040D582
test, xrefs: 0040D22C
xdelta3: free: %p, xrefs: 0040D7E7, 0040D818, 0040D866, 0040D8A3, 0040D8F2, 0040D92C, 0040D961, 0040D992
encode, xrefs: 0040D1E7
xdelta3: specify only one source file, xrefs: 0040D565
XD3_INTERNAL, xrefs: 0040D695, 0040D6D9
XD3_INPUT, xrefs: 0040D664
XD3_OUTPUT, xrefs: 0040D66B
xdelta3: too many filenames: %s ..., xrefs: 0040D5D6
decode, xrefs: 0040D1C6
xdelta3: warning: -c option overrides output filename: %s, xrefs: 0040D74C
xC, xrefs: 0040D6CF
printhdr, xrefs: 0040D250
XD3_WINFINISH, xrefs: 0040D687
printdelta, xrefs: 0040D29A
xdelta3: file %s failed: %s: %s: %s, xrefs: 0040D6E5
XD3_WINSTART, xrefs: 0040D680
config, xrefs: 0040D208
read, xrefs: 0040D6DB
xdelta3: -%c: requires an argument, xrefs: 0040D548
XD3_GOTHEADER, xrefs: 0040D679
printhdrs, xrefs: 0040D274
xdelta3: warning: -R option ignored, external compression support was not compiled, xrefs: 0040D526
XD3_TOOFARBACK, xrefs: 0040D68E

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$_memset$ErrorFreeHeapInfoLastStartup___sbh_find_block___sbh_free_block__ftbuf__lock__output_l__stbuf_getenv_setvbuf
String ID: 0123456789cdefhnqvDJNORTVs:B:C:E:F:I:L:O:M:P:W:A::S::$VERSION=3.0q$XD3_GETSRCBLK$XD3_GOTHEADER$XD3_INPUT$XD3_INTERNAL$XD3_OUTPUT$XD3_TOOFARBACK$XD3_WINFINISH$XD3_WINSTART$config$decode$encode$open$printdelta$printhdr$printhdrs$read$test$xC$xdelta3: -%c: requires an argument$xdelta3: file %s failed: %s: %s: %s$xdelta3: free: %p$xdelta3: invalid file name: empty string$xdelta3: specify only one source file$xdelta3: too many filenames: %s ...$xdelta3: warning: -D option ignored, external compression support was not compiled$xdelta3: warning: -R option ignored, external compression support was not compiled$xdelta3: warning: -c option overrides output filename: %s
API String ID: 3198944415-2602256574
Opcode ID: 15dac77270cb26487c8acf43366a6c72126822a17b6564c9e56e0dbc96678566
Instruction ID: 9b8da2179774ce916dea7b08226e857232292324e63dad5920dd3750710d5aaa
Opcode Fuzzy Hash: 15dac77270cb26487c8acf43366a6c72126822a17b6564c9e56e0dbc96678566
Instruction Fuzzy Hash: 4B32F0B1E04301ABD720AF919C41B2B76A4AB94354F14893FF845AB3C1E77CD8498B9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F650 Relevance: 28.5, APIs: 9, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040F68D
_fprintf.LIBCMT ref: 0040F840
_fprintf.LIBCMT ref: 0040F8B9
_fprintf.LIBCMT ref: 0040F971
_abort.LIBCMT ref: 0040F979
_fprintf.LIBCMT ref: 0040F9BA
_abort.LIBCMT ref: 0040F9C2
_fprintf.LIBCMT ref: 0040FA04
_fprintf.LIBCMT ref: 0040FA9D

Strings

%.3f, xrefs: 0040F8AB
test %u: decode: %s, xrefs: 0040F9F6
check failure: p_off == compress_size, xrefs: 0040F963
test %u: encode: %s, xrefs: 0040F832
check failure: p_off == input_size, xrefs: 0040F9AC
aB, xrefs: 0040F927
..., xrefs: 0040F67F

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$_abort
String ID: ...$%.3f$check failure: p_off == compress_size$check failure: p_off == input_size$test %u: decode: %s$test %u: encode: %s$aB
API String ID: 2929311799-2853849506
Opcode ID: f67aa9b3102c5c4c77704ba18d6ba0626aae958bc2488314c44c6cff712498b4
Instruction ID: 30ae7d70c24b089ae1e698078d04e21be63510297335e842cd9dbd3ecbbc1ae5
Opcode Fuzzy Hash: f67aa9b3102c5c4c77704ba18d6ba0626aae958bc2488314c44c6cff712498b4
Instruction Fuzzy Hash: 72F19DB16043019FC720DFA9C881A6BB7E5AF88704F04883EF94597741E7BDE919CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402800 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 811COMMON

Download Yara Rule

Strings

``B, xrefs: 0040306E

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset
String ID: ``B
API String ID: 2102423945-1253660969
Opcode ID: e8294ca56f66d56ce4af6ec6d7dc5dc324d7e4496f592a8e64d831dc367cc040
Instruction ID: fed0a18117d76c8e2a95ef93aa4c4143a770f095fe4f1af2b1fbe99ef2a6eeb7
Opcode Fuzzy Hash: e8294ca56f66d56ce4af6ec6d7dc5dc324d7e4496f592a8e64d831dc367cc040
Instruction Fuzzy Hash: 2B62D2716083418BC724CF18C98466BB7E6BFC8344F15893EE885A73C1E7B9E945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041241C Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00413EEB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413F00
UnhandledExceptionFilter.KERNEL32(004241F4), ref: 00413F0B
GetCurrentProcess.KERNEL32(C0000409), ref: 00413F27
TerminateProcess.KERNEL32(00000000), ref: 00413F2E

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 59a1e3e0951bc8bcf3843257b7dcd402e16eaa24fd269c424051526cb17fc53d
Instruction ID: 4f9943922c853b68310e82beda2b5c690eb4637ebacd9f8e714b31cc37a3870d
Opcode Fuzzy Hash: 59a1e3e0951bc8bcf3843257b7dcd402e16eaa24fd269c424051526cb17fc53d
Instruction Fuzzy Hash: 5521CBB4A00309DFC720EF25ED49A447BB8FB98345FD0543AE90992261E7B49982CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004090F0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc4f2c4c4e6231821aec3b75f3737bc73dd696c8cbd2f42607c0bea2930934a
Instruction ID: bfdaaa5c31c23b6754037eea33c79803bdeb4834f692d7d50883a8bc3ee7517b
Opcode Fuzzy Hash: 0bc4f2c4c4e6231821aec3b75f3737bc73dd696c8cbd2f42607c0bea2930934a
Instruction Fuzzy Hash: 01E1D2716087029BD324CF29C99076BB7E2AF94304F58893EE49A97392E738EC45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00409600 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc8013dbd2d401ca9cb039c4059a1c513abc430571fb3202a8b79744ffbb104
Instruction ID: a1f953bb43880397322eb09e5953858c29a0541c5a7afcd85b3779cf948898f1
Opcode Fuzzy Hash: 0dc8013dbd2d401ca9cb039c4059a1c513abc430571fb3202a8b79744ffbb104
Instruction Fuzzy Hash: DDE1D0716087428BD724CF29C59076BBBE2BB84304F18893EE49697392E338FC45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00408BE0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961138e3767220d1b093e4fa02852f3e1b0ac7d7c7f6ae0b1212de131fc08b91
Instruction ID: 32be89c6fab72f131f177511c6d36bb04c05cb98b25b81c36999fe9874a63f47
Opcode Fuzzy Hash: 961138e3767220d1b093e4fa02852f3e1b0ac7d7c7f6ae0b1212de131fc08b91
Instruction Fuzzy Hash: 97E1D4716087028BD324CF25C59076BBBE2AF94304F58893EE4D697392E739F845CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406E40 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf41ed2f0fddf3f18781c486da26122dc6c4860bd12ada61e77046e2654a54e3
Instruction ID: 710d81177ad4225b1c4037e74cb12741c78b931ea92ec05f2fa9f3fc774b7906
Opcode Fuzzy Hash: cf41ed2f0fddf3f18781c486da26122dc6c4860bd12ada61e77046e2654a54e3
Instruction Fuzzy Hash: EBD1A1716083018FD714DF35D980A67B7E5AFD8308F04497EE99AA7392E738E904CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408700 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cf1c6951002f8d65e851a8f3f209dabe1673a35b4df0a485be6bec68292255
Instruction ID: 333f3691e9a1fe821844efa08ff69a787720e9aed00482db8f31ef2f4c4c4020
Opcode Fuzzy Hash: b6cf1c6951002f8d65e851a8f3f209dabe1673a35b4df0a485be6bec68292255
Instruction Fuzzy Hash: 7AE15F756047018BD324DF28C681B6BB7E1AF94304F54893EE4DA97781EB38F845CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 136.7, APIs: 39, Strings: 39, Instructions: 238COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040DADE
_fprintf.LIBCMT ref: 0040DAF4

Part of subcall function 004134B2: __stbuf.LIBCMT ref: 004135C0
Part of subcall function 004134B2: __output_l.LIBCMT ref: 004135D0
Part of subcall function 004134B2: __ftbuf.LIBCMT ref: 004135DA

_fprintf.LIBCMT ref: 0040DB0A
_fprintf.LIBCMT ref: 0040DB20
_fprintf.LIBCMT ref: 0040DB36
_fprintf.LIBCMT ref: 0040DB51
_fprintf.LIBCMT ref: 0040DB67
_fprintf.LIBCMT ref: 0040DB7D
_fprintf.LIBCMT ref: 0040DB93
_fprintf.LIBCMT ref: 0040DBA9
_fprintf.LIBCMT ref: 0040DBBF
_fprintf.LIBCMT ref: 0040DBD5
_fprintf.LIBCMT ref: 0040DBEB
_fprintf.LIBCMT ref: 0040DC01
_fprintf.LIBCMT ref: 0040DC17
_fprintf.LIBCMT ref: 0040DC32
_fprintf.LIBCMT ref: 0040DC48
_fprintf.LIBCMT ref: 0040DC5E
_fprintf.LIBCMT ref: 0040DC74
_fprintf.LIBCMT ref: 0040DC8A
_fprintf.LIBCMT ref: 0040DCA0
_fprintf.LIBCMT ref: 0040DCB6
_fprintf.LIBCMT ref: 0040DCCC
_fprintf.LIBCMT ref: 0040DCE2
_fprintf.LIBCMT ref: 0040DCF8
_fprintf.LIBCMT ref: 0040DD0E
_fprintf.LIBCMT ref: 0040DD24
_fprintf.LIBCMT ref: 0040DD3A
_fprintf.LIBCMT ref: 0040DD50
_fprintf.LIBCMT ref: 0040DD66
_fprintf.LIBCMT ref: 0040DD7C
_fprintf.LIBCMT ref: 0040DD92
_fprintf.LIBCMT ref: 0040DDA8
_fprintf.LIBCMT ref: 0040DDBE
_fprintf.LIBCMT ref: 0040DDD4
_fprintf.LIBCMT ref: 0040DDEA
_fprintf.LIBCMT ref: 0040DE00
_fprintf.LIBCMT ref: 0040DE16
_fprintf.LIBCMT ref: 0040DE2C

Strings

-q be quiet, xrefs: 0040DC66
-c use stdout, xrefs: 0040DBF3
-cf target-x.z.tar.gz.vcdiff target-x.y/, xrefs: 0040DE1E
printhdrs print information about all windows, xrefs: 0040DBB1
-0 .. -9 compression level, xrefs: 0040DBDD
XDELTA="-s source-x.y.tar.gz" \, xrefs: 0040DDF2
printdelta print information about the entire delta, xrefs: 0040DB85
-P size compression duplicates window, xrefs: 0040DCEA
-d decompress, xrefs: 0040DC09
-f force overwrite, xrefs: 0040DC3A
VERSION=3.0q, xrefs: 0040DAD0
usage: xdelta3 [command/options] [input [output]], xrefs: 0040DAE6
-S [djw|fgk] enable/disable secondary compression, xrefs: 0040DD42
-C soft config (encode, undocumented), xrefs: 0040DDB0
memory options:, xrefs: 0040DCA8
the XDELTA environment variable may contain extra args:, xrefs: 0040DDDC
special command names:, xrefs: 0040DAFC
-V show version, xrefs: 0040DC92
-n disable checksum (encode/decode), xrefs: 0040DD9A
tar --use-compress-program=xdelta3 \, xrefs: 0040DE08
compression options:, xrefs: 0040DD16
standard options:, xrefs: 0040DBC7
-D disable external decompression (encode/decode), xrefs: 0040DD6E
-N disable small string-matching compression, xrefs: 0040DD58
decode decompress the input, xrefs: 0040DB28
-W bytes input window size, xrefs: 0040DCD4
special commands for VCDIFF inputs:, xrefs: 0040DB6F
config prints xdelta3 configuration, xrefs: 0040DB12
-h show help, xrefs: 0040DC50
printhdr print information about the first window, xrefs: 0040DB9B
-v be verbose (max 2), xrefs: 0040DC7C
test run the builtin tests, xrefs: 0040DB59
-I size instruction buffer size (0 = unlimited), xrefs: 0040DD00
encode compress the input%s, xrefs: 0040DB43
-B bytes source window size, xrefs: 0040DCBE
-A [apphead] disable/provide application header (encode), xrefs: 0040DDC6
-s source source file to copy from (if any), xrefs: 0040DD2C
-R disable external recompression (decode), xrefs: 0040DD84
-e compress%s, xrefs: 0040DC24

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$__ftbuf__output_l__stbuf
String ID: -cf target-x.z.tar.gz.vcdiff target-x.y/$ config prints xdelta3 configuration$ decode decompress the input$ encode compress the input%s$ printdelta print information about the entire delta$ printhdr print information about the first window$ printhdrs print information about all windows$ test run the builtin tests$ -0 .. -9 compression level$ -A [apphead] disable/provide application header (encode)$ -B bytes source window size$ -C soft config (encode, undocumented)$ -D disable external decompression (encode/decode)$ -I size instruction buffer size (0 = unlimited)$ -N disable small string-matching compression$ -P size compression duplicates window$ -R disable external recompression (decode)$ -S [djw|fgk] enable/disable secondary compression$ -V show version$ -W bytes input window size$ -c use stdout$ -d decompress$ -e compress%s$ -f force overwrite$ -h show help$ -n disable checksum (encode/decode)$ -q be quiet$ -s source source file to copy from (if any)$ -v be verbose (max 2)$ XDELTA="-s source-x.y.tar.gz" \$ tar --use-compress-program=xdelta3 \$VERSION=3.0q$compression options:$memory options:$special command names:$special commands for VCDIFF inputs:$standard options:$the XDELTA environment variable may contain extra args:$usage: xdelta3 [command/options] [input [output]]
API String ID: 1591213610-542097067
Opcode ID: b7ef986e1867e74a2d021af0f4a78638e50226b7936b3be3bbee628ffbdc4d11
Instruction ID: eed095e66bbbc1bcbf26937e2f74c8bf0e7c684b5e6b6da8a864d8977e78a2a5
Opcode Fuzzy Hash: b7ef986e1867e74a2d021af0f4a78638e50226b7936b3be3bbee628ffbdc4d11
Instruction Fuzzy Hash: 7C51EEF3E943513AEE113AB36D07B9E14180D3178B758449BF805E5286F89EE7E8127E

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 155COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00409B1E
_fprintf.LIBCMT ref: 00409B36

Part of subcall function 004134B2: __stbuf.LIBCMT ref: 004135C0
Part of subcall function 004134B2: __output_l.LIBCMT ref: 004135D0
Part of subcall function 004134B2: __ftbuf.LIBCMT ref: 004135DA

_fprintf.LIBCMT ref: 00409B4E
_fprintf.LIBCMT ref: 00409B66
_fprintf.LIBCMT ref: 00409B7E
_fprintf.LIBCMT ref: 00409B96
_fprintf.LIBCMT ref: 00409BAE
_fprintf.LIBCMT ref: 00409BC6
_fprintf.LIBCMT ref: 00409BE1
_fprintf.LIBCMT ref: 00409BF9
_fprintf.LIBCMT ref: 00409C11
_fprintf.LIBCMT ref: 00409C29
_fprintf.LIBCMT ref: 00409C41
_fprintf.LIBCMT ref: 00409C59
_fprintf.LIBCMT ref: 00409C71
_fprintf.LIBCMT ref: 00409C89
_fprintf.LIBCMT ref: 00409CA4
_fprintf.LIBCMT ref: 00409CBF
_fprintf.LIBCMT ref: 00409CDA
_fprintf.LIBCMT ref: 00409CF5
_fprintf.LIBCMT ref: 00409D10
_fprintf.LIBCMT ref: 00409D2B

Strings

GENERIC_ENCODE_TABLES=%d, xrefs: 00409B40
XD3_USE_LARGEFILE64=%d, xrefs: 00409C63
REGRESSION_TEST=%d, xrefs: 00409B70
XD3_DEFAULT_SRCWINSZ=%d, xrefs: 00409CCC
VCDIFF_TOOLS=%d, xrefs: 00409BB8
XD3_STDIO=%d, xrefs: 00409C33
XD3_WIN32=%d, xrefs: 00409C4B
EXTERNAL_COMPRESSION=%d, xrefs: 00409B28
XD3_DEFAULT_LEVEL=%d, xrefs: 00409C7B
XD3_DEFAULT_IOPT_SIZE=%d, xrefs: 00409C96
XD3_ENCODER=%d, xrefs: 00409C03
XD3_DEBUG=%d, xrefs: 00409BEB
VERSION=3.0q, xrefs: 00409B10
SECONDARY_FGK=%d, xrefs: 00409BA0
XD3_NODECOMPRESSSIZE=%d, xrefs: 00409D1D
XD3_POSIX=%d, xrefs: 00409C1B
XD3_ALLOCSIZE=%d, xrefs: 00409BD3
XD3_DEFAULT_WINSIZE=%d, xrefs: 00409CE7
XD3_HARDMAXWINSIZE=%d, xrefs: 00409D02
GENERIC_ENCODE_TABLES_COMPUTE=%d, xrefs: 00409B58
XD3_DEFAULT_SPREVSZ=%d, xrefs: 00409CB1
SECONDARY_DJW=%d, xrefs: 00409B88

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$__ftbuf__output_l__stbuf
String ID: EXTERNAL_COMPRESSION=%d$GENERIC_ENCODE_TABLES=%d$GENERIC_ENCODE_TABLES_COMPUTE=%d$REGRESSION_TEST=%d$SECONDARY_DJW=%d$SECONDARY_FGK=%d$VCDIFF_TOOLS=%d$VERSION=3.0q$XD3_ALLOCSIZE=%d$XD3_DEBUG=%d$XD3_DEFAULT_IOPT_SIZE=%d$XD3_DEFAULT_LEVEL=%d$XD3_DEFAULT_SPREVSZ=%d$XD3_DEFAULT_SRCWINSZ=%d$XD3_DEFAULT_WINSIZE=%d$XD3_ENCODER=%d$XD3_HARDMAXWINSIZE=%d$XD3_NODECOMPRESSSIZE=%d$XD3_POSIX=%d$XD3_STDIO=%d$XD3_USE_LARGEFILE64=%d$XD3_WIN32=%d
API String ID: 1591213610-571660088
Opcode ID: b74708afb919403dcec2504ea26f5835ce94261bc4b94367ce114dd28a8180c6
Instruction ID: 68f90707eba5049fbe9e1363bd20fbd2962929a01969d34e3ca3df8ad4c3ac7e
Opcode Fuzzy Hash: b74708afb919403dcec2504ea26f5835ce94261bc4b94367ce114dd28a8180c6
Instruction Fuzzy Hash: 06411BF3E9035136EA213AB32D07F9A10180F31B89F59445AB505F92C6F8DED6E8126E

Uniqueness

Uniqueness Score: -1.00%

Function 00417066 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00413D45), ref: 0041706C
__mtterm.LIBCMT ref: 00417078

Part of subcall function 00416DB9: __decode_pointer.LIBCMT ref: 00416DCA
Part of subcall function 00416DB9: TlsFree.KERNEL32(00000001,004171E5), ref: 00416DE4

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0041708E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0041709B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004170A8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004170B5
TlsAlloc.KERNEL32 ref: 00417105
TlsSetValue.KERNEL32(00000000), ref: 00417120
__init_pointers.LIBCMT ref: 0041712A
__encode_pointer.LIBCMT ref: 00417135
__encode_pointer.LIBCMT ref: 00417145
__encode_pointer.LIBCMT ref: 00417155
__encode_pointer.LIBCMT ref: 00417165
__decode_pointer.LIBCMT ref: 00417186
__calloc_crt.LIBCMT ref: 0041719F
__decode_pointer.LIBCMT ref: 004171B9
__initptd.LIBCMT ref: 004171C8
GetCurrentThreadId.KERNEL32 ref: 004171CF

Strings

FlsGetValue, xrefs: 00417090
FlsSetValue, xrefs: 0041709D
FlsFree, xrefs: 004170AA
FlsAlloc, xrefs: 00417088
KERNEL32.DLL, xrefs: 00417067

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: AddressProc__encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2657569430-3819984048
Opcode ID: a6499e4239d3f86b4a436f8fe9234ad7bee9ee56388b2d303b213bd0607ba977
Instruction ID: d3cbb86fa9ba5a1638ae6ae1e859364bae43ba85bd9bbd26be9c30b05aafa1cc
Opcode Fuzzy Hash: a6499e4239d3f86b4a436f8fe9234ad7bee9ee56388b2d303b213bd0607ba977
Instruction Fuzzy Hash: 42314D71B153509BC7316B75BE096967BA5EB44364B96053FE910D22A0EF38C4C28F9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB10 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 203COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 0040BB61
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,00800000,00000000), ref: 0040BB6B
_fprintf.LIBCMT ref: 0040BC4D
_fprintf.LIBCMT ref: 0040BC70
_fprintf.LIBCMT ref: 0040BD76

Strings

xC, xrefs: 0040BD55
PC, xrefs: 0040BC2D
xdelta3: source block size: %u, xrefs: 0040BC62
pC, xrefs: 0040BBFF
xdelta3: source %s winsize %s size %I64u, xrefs: 0040BC3F
xdelta3: %s: %s, xrefs: 0040BD68
bC, xrefs: 0040BC0E

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$ErrorFileLastSize
String ID: PC$pC$xC$xdelta3: %s: %s$xdelta3: source %s winsize %s size %I64u$xdelta3: source block size: %u$bC
API String ID: 3480055526-3390289391
Opcode ID: f1858e074ad664bcc69a86c58e3516a8032f762f2571ef27597372ead9b08948
Instruction ID: f5a9081865a84b86171c4559b17a3d3018df6f68e8dbb6ea095c9f1123952d70
Opcode Fuzzy Hash: f1858e074ad664bcc69a86c58e3516a8032f762f2571ef27597372ead9b08948
Instruction Fuzzy Hash: 8771B2B1A00302ABD710DF29DC41A26B7A1FB84714B55867FE805DB395D738E845CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA80 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 244COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040EAD8
_abort.LIBCMT ref: 0040EAE0
_fprintf.LIBCMT ref: 0040EB3E
_abort.LIBCMT ref: 0040EB46

Part of subcall function 0041242B: __NMSG_WRITE.LIBCMT ref: 00412452
Part of subcall function 0041242B: _raise.LIBCMT ref: 00412463
Part of subcall function 0041242B: _memset.LIBCMT ref: 004124E6
Part of subcall function 0041242B: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?), ref: 00412506
Part of subcall function 0041242B: UnhandledExceptionFilter.KERNEL32(?,?,?,?), ref: 00412510

_fprintf.LIBCMT ref: 0040EB62
_abort.LIBCMT ref: 0040EB6A
_memset.LIBCMT ref: 0040ED6C

Strings

check failure: take > 0, xrefs: 0040EACA
header test, xrefs: 0040EBD0
check failure: ret == XD3_OUTPUT, xrefs: 0040EB30
this is a storyabouttttttttttt- his is a stor- about nothing all. boutique -his story is a -about what happens all the time what -am I ttttttt the person said, so what, per son - gory story is - about nothing -tttttt to test -his sto nothing, xrefs: 0040ECB8
check failure: pos == enc_size, xrefs: 0040EB54
dB, xrefs: 0040EBAD

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _abort_fprintf$ExceptionFilterUnhandled_memset$_raise
String ID: dB$check failure: pos == enc_size$check failure: ret == XD3_OUTPUT$check failure: take > 0$header test$this is a storyabouttttttttttt- his is a stor- about nothing all. boutique -his story is a -about what happens all the time what -am I ttttttt the person said, so what, per son - gory story is - about nothing -tttttt to test -his sto nothing
API String ID: 3481615875-3406696395
Opcode ID: b93b68a40fb8c06d0e07f12cfb270602f1f5b460640202d6e5c67905fc017c9b
Instruction ID: 2842cd822838c953873fd1ee06b06a48f7cab80fb48fe35a5ecb74503b11c957
Opcode Fuzzy Hash: b93b68a40fb8c06d0e07f12cfb270602f1f5b460640202d6e5c67905fc017c9b
Instruction Fuzzy Hash: B58159B2A042518BEB219E3BC85076B37A0FF91304F59493BEC85B73C5E63EDD54825A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE20 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 283COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0040BE8B
__aullrem.LIBCMT ref: 0040BEDB
__aullrem.LIBCMT ref: 0040BFEC
_fprintf.LIBCMT ref: 0040C088
_fprintf.LIBCMT ref: 0040C0FE
_fprintf.LIBCMT ref: 0040C12B

Strings

source read failed, xrefs: 0040C051
xdelta3: source file size change: %s, xrefs: 0040C07A
bC, xrefs: 0040BF60
xdelta3: source block %I64u read (lru_hits=%u, lru_misses=%u, lru_filled=%u), xrefs: 0040C11D
pC, xrefs: 0040BFD2
xdelta3: source block %I64u ejects %I64u (lru_hits=%u, lru_misses=%u, lru_filled=%u), xrefs: 0040C0F0

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: __aullrem_fprintf
String ID: pC$source read failed$xdelta3: source block %I64u ejects %I64u (lru_hits=%u, lru_misses=%u, lru_filled=%u)$xdelta3: source block %I64u read (lru_hits=%u, lru_misses=%u, lru_filled=%u)$xdelta3: source file size change: %s$bC
API String ID: 348705442-2405392611
Opcode ID: 96754e89944680e5fcdea3328afa7df629fc6168268c4cecc5b328b0d5cd47ab
Instruction ID: 61811503db1ae96327bcfe30c6fae124393eb87fe9b4ef0bf171478ce39df81d
Opcode Fuzzy Hash: 96754e89944680e5fcdea3328afa7df629fc6168268c4cecc5b328b0d5cd47ab
Instruction Fuzzy Hash: D0B149B5604302DFC314CF29D88096BB7E5FB88324B158A6EE859D73A1E734E845CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040A650 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 0040A610: __vsnprintf.LIBCMT ref: 0040A620

_fprintf.LIBCMT ref: 0040A8B5

Part of subcall function 0040A470: WriteFile.KERNEL32(?,00000000,00000000,0040AE9D,00000000,?,00000000,0040AE9D,print), ref: 0040A47F
Part of subcall function 0040A470: GetLastError.KERNEL32(?,00000000,00000000,0040AE9D,00000000,?,00000000,0040AE9D,print), ref: 0040A48D
Part of subcall function 0040A470: _memset.LIBCMT ref: 0040A4BC
Part of subcall function 0040A470: FormatMessageA.KERNEL32(00001200,00000000,FFFFBAD2,00000400,00430D78,00000100,00000000,?,?,?,0040AE9D,print), ref: 0040A4DD
Part of subcall function 0040A470: _fprintf.LIBCMT ref: 0040A500

_fprintf.LIBCMT ref: 0040A894

Part of subcall function 0040A470: _fprintf.LIBCMT ref: 0040A521
Part of subcall function 0040A470: _fprintf.LIBCMT ref: 0040A54F

Strings

, xrefs: 0040A751
xdelta3: target window size inconsistency, xrefs: 0040A886
xdelta3: address section inconsistency, xrefs: 0040A8EA
%06I64u %03u %s %3u, xrefs: 0040A6E3
@%-6u, xrefs: 0040A739, 0040A7F7
print, xrefs: 0040A67E, 0040A704, 0040A772, 0040A7CD, 0040A818, 0040A84F
xdelta3: target window position inconsistency, xrefs: 0040A8D5
xdelta3: internal print buffer overflow: %d bytes, xrefs: 0040A8A7
Offset Code Type1 Size1 @Addr1 + Type2 Size2 @Addr2, xrefs: 0040A659
%s %3u, xrefs: 0040A7AC

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$ErrorFileFormatLastMessageWrite__vsnprintf_memset
String ID: $ %06I64u %03u %s %3u$ %s %3u$ Offset Code Type1 Size1 @Addr1 + Type2 Size2 @Addr2$ @%-6u$print$xdelta3: address section inconsistency$xdelta3: internal print buffer overflow: %d bytes$xdelta3: target window position inconsistency$xdelta3: target window size inconsistency
API String ID: 2046023046-582609334
Opcode ID: 2f64314286f85b7f326c4702b7453ee353c4bf2d0f1a7acf504b8516265d8a60
Instruction ID: 3e315dbcb74ad613d1d8d5cf319dce78a37ca7def70011002547cea25818a874
Opcode Fuzzy Hash: 2f64314286f85b7f326c4702b7453ee353c4bf2d0f1a7acf504b8516265d8a60
Instruction Fuzzy Hash: 6F5115B2B0070067D710B6729D49B777395EB91308F58843FE689A72C1E67DE872835E

Uniqueness

Uniqueness Score: -1.00%

Function 0040C659 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 218timeCOMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040C6F2
_fprintf.LIBCMT ref: 0040C860
_fprintf.LIBCMT ref: 0040C8BD
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 0040C8D7
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040C8E7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040C8FE
_fprintf.LIBCMT ref: 0040CDDF

Strings

xdelta3: warning: output window %I64u does not copy source, xrefs: 0040C6E4
xdelta3: warning: input position %I64u overflowed instruction buffer, needed %u (vs. %u), consider raising -I, xrefs: 0040C8AF
xdelta3: %I64u: in %s (%s): out %s (%s): total in %s: out %s: %s, xrefs: 0040CA15
xdelta3: warning: input window %I64u..%I64u has no source copies, xrefs: 0040C852

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$Time$FileLocalSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: xdelta3: %I64u: in %s (%s): out %s (%s): total in %s: out %s: %s$xdelta3: warning: input position %I64u overflowed instruction buffer, needed %u (vs. %u), consider raising -I$xdelta3: warning: input window %I64u..%I64u has no source copies$xdelta3: warning: output window %I64u does not copy source
API String ID: 2464776517-3835980559
Opcode ID: 1a4e7a9fbf6c4a9322328c64f662f25f634dd92ea978a7b9f07782cc89b0e150
Instruction ID: a1f74b80040b3f6b1011bd599ed9c576db9eb27da69c4c714494482050790261
Opcode Fuzzy Hash: 1a4e7a9fbf6c4a9322328c64f662f25f634dd92ea978a7b9f07782cc89b0e150
Instruction Fuzzy Hash: A27165B1508341EFD730DB25CC85EAB73A8EBC4304F05492EF949A3281D679AD558B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A470 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 80filewindowCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,00000000,0040AE9D,00000000,?,00000000,0040AE9D,print), ref: 0040A47F
GetLastError.KERNEL32(?,00000000,00000000,0040AE9D,00000000,?,00000000,0040AE9D,print), ref: 0040A48D
_memset.LIBCMT ref: 0040A4BC
FormatMessageA.KERNEL32(00001200,00000000,FFFFBAD2,00000400,00430D78,00000100,00000000,?,?,?,0040AE9D,print), ref: 0040A4DD
_fprintf.LIBCMT ref: 0040A500
_fprintf.LIBCMT ref: 0040A521
_fprintf.LIBCMT ref: 0040A54F

Strings

xdelta3: Incorrect write count, xrefs: 0040A513
xdelta3: main write: %s: %u, xrefs: 0040A541
xdelta3: %s: %s: %s, xrefs: 0040A4F2
xC, xrefs: 0040A4E3

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$ErrorFileFormatLastMessageWrite_memset
String ID: xC$xdelta3: %s: %s: %s$xdelta3: Incorrect write count$xdelta3: main write: %s: %u
API String ID: 2330806397-3951970701
Opcode ID: 3f14ff43247324f056c0bdfbf4089415513c307e0fbb91d3d66556406e5b590b
Instruction ID: c1be8b47a8a5abcdd86612c2091bb16fa2cffef80765a0e0063fd82ef8c4bf86
Opcode Fuzzy Hash: 3f14ff43247324f056c0bdfbf4089415513c307e0fbb91d3d66556406e5b590b
Instruction Fuzzy Hash: A32105F27403117BE610AAA59C06FA76258EF54789F50412AF904E62C1E27CECA087AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5A0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040E621
_memset.LIBCMT ref: 0040E62E
_memset.LIBCMT ref: 0040E661
_memset.LIBCMT ref: 0040E68A
_rand.LIBCMT ref: 0040E6A6
_rand.LIBCMT ref: 0040E6BD
_rand.LIBCMT ref: 0040E6C8
_memset.LIBCMT ref: 0040E7F0
_memset.LIBCMT ref: 0040E819

Strings

aB, xrefs: 0040E79F

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset$_rand
String ID: aB
API String ID: 3289902143-388806
Opcode ID: dec201a12626bdeef4042b6b1ff51a5ce86ae10e3b70a0f9cab0266deea58ac8
Instruction ID: 4731bdf024d357f82b7f5245e91a0100860ac7d99e2e91b2d1fd7a7edc031c04
Opcode Fuzzy Hash: dec201a12626bdeef4042b6b1ff51a5ce86ae10e3b70a0f9cab0266deea58ac8
Instruction Fuzzy Hash: 14A10371B007029BC314DF69DC84BAAB7E4BF84304F44892AE958A7381D77DE975CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004103C0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 205COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041042F
_fprintf.LIBCMT ref: 00410518
_abort.LIBCMT ref: 00410520
_fprintf.LIBCMT ref: 00410656

Strings

%d/%d, xrefs: 0041053C
check failure: 0, xrefs: 0041050A
VB, xrefs: 004103E9
test %u: expected %s: got %s, xrefs: 00410648
%I64d, xrefs: 00410572

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$_abort_memset
String ID: %I64d$%d/%d$check failure: 0$test %u: expected %s: got %s$VB
API String ID: 1893654454-740388804
Opcode ID: 70b02f1614e78850452f411be9deecc84f743fc769a13263540e82e95f47361f
Instruction ID: f7ad14c891882672a3e1eb092f9679f32c81cdf115aa4b8fa67e5539f9aa2761
Opcode Fuzzy Hash: 70b02f1614e78850452f411be9deecc84f743fc769a13263540e82e95f47361f
Instruction Fuzzy Hash: D571F5B16043459FD720CF38C841BABB7E5AF85304F44895EE588C7342E7B9E989CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2B0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77fileCOMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040A2D7
CreateFileA.KERNEL32(00800000,-80000000,00000001,00000000,-00000001,00000080,00000000,?,00000000,0040BB4C,00427498), ref: 0040A31C
GetLastError.KERNEL32 ref: 0040A329
_fprintf.LIBCMT ref: 0040A36E

Strings

xdelta3: invalid file name: empty string, xrefs: 0040A2C9
open, xrefs: 0040A35B
write, xrefs: 0040A34B, 0040A35A
xdelta3: file %s failed: %s: %s: %s, xrefs: 0040A360
read, xrefs: 0040A344

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$CreateErrorFileLast
String ID: open$read$write$xdelta3: file %s failed: %s: %s: %s$xdelta3: invalid file name: empty string
API String ID: 4200196036-2393832087
Opcode ID: 489d000d7102938283df6ed7996188f1939ffb5598820ca124b679e2706050b2
Instruction ID: 5e37b91a7c6b0deb62da34543a5da5f0696cfeec8a1746d1c0bfee4ac32e8869
Opcode Fuzzy Hash: 489d000d7102938283df6ed7996188f1939ffb5598820ca124b679e2706050b2
Instruction Fuzzy Hash: 7121DEB17403026BE7105B29EC01B2B7798AB81314F54813BF909E66C0E77DE8A0875D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1A0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,source,?,0040A23E,source,00000000,0040AE58), ref: 0040A1B0
GetLastError.KERNEL32 ref: 0040A1C0
GetLastError.KERNEL32 ref: 0040A1E8
_fprintf.LIBCMT ref: 0040A215

Strings

close, xrefs: 0040A202
write, xrefs: 0040A1E3
xdelta3: file %s failed: %s: %s: %s, xrefs: 0040A207
read, xrefs: 0040A1DC, 0040A201
source, xrefs: 0040A1AE

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ErrorLast$CloseHandle_fprintf
String ID: close$read$source$write$xdelta3: file %s failed: %s: %s: %s
API String ID: 1381260728-1124401914
Opcode ID: 894bd204f79af348e6930b99a8e836384a63827529e1bc2471af1953783cf3af
Instruction ID: 95d813044c59065c7a50d27da48df0ab0308e3b88b6fdf6f05ed2db50c538fa6
Opcode Fuzzy Hash: 894bd204f79af348e6930b99a8e836384a63827529e1bc2471af1953783cf3af
Instruction Fuzzy Hash: 4E01263270031157CB20A67EBC00B27328C9B96370B4542B3F824EB3D5EA79CC52836E

Uniqueness

Uniqueness Score: -1.00%

Function 00409E00 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 48windowCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00409E02

Part of subcall function 00412676: __FF_MSGBANNER.LIBCMT ref: 00412699
Part of subcall function 00412676: __NMSG_WRITE.LIBCMT ref: 004126A0
Part of subcall function 00412676: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,004175C2,?,00000001,?,00415555,00000018,00429418,0000000C,004155E4,?), ref: 004126EE

_memset.LIBCMT ref: 00409E29
FormatMessageA.KERNEL32(00001200,00000000,0000000C,00000400,00430D78,00000100,00000000,?,?,?,0040B8C9,?,00000000,?,?,0040AE07), ref: 00409E49
_fprintf.LIBCMT ref: 00409E63
_fprintf.LIBCMT ref: 00409E88

Strings

xdelta3: malloc: %u: %p, xrefs: 00409E7A
xC, xrefs: 00409E4F
xdelta3: malloc: %s, xrefs: 00409E55

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$AllocateFormatHeapMessage_malloc_memset
String ID: xC$xdelta3: malloc: %s$xdelta3: malloc: %u: %p
API String ID: 1165338136-4250961212
Opcode ID: 35e116d460288beae08329f4072b9e276feb4a32543610c1986d0170cc202697
Instruction ID: 35067cfaf4b5591becb749631058de9e09c11805fa83595a52ae57b9a4cbe866
Opcode Fuzzy Hash: 35e116d460288beae08329f4072b9e276feb4a32543610c1986d0170cc202697
Instruction Fuzzy Hash: 8FF049B1B8022176F62136A66C07FE729488B55FD9F01427AFA04E92C2E5AC9CD442ED

Uniqueness

Uniqueness Score: -1.00%

Function 00410670 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041069B

Part of subcall function 004050E0: _memset.LIBCMT ref: 0040510B
Part of subcall function 004050E0: _memset.LIBCMT ref: 0040511B

_fprintf.LIBCMT ref: 00410800
_abort.LIBCMT ref: 00410808
_fprintf.LIBCMT ref: 004108AB
_abort.LIBCMT ref: 004108B3

Strings

check failure: memcmp(target, recon, recon_size) == 0, xrefs: 0041089D
check failure: tpos == recon_size, xrefs: 004107F2

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset$_abort_fprintf
String ID: check failure: memcmp(target, recon, recon_size) == 0$check failure: tpos == recon_size
API String ID: 3563680212-3537244434
Opcode ID: 3a36a88b653e83c53a0a8c9cbf0c948b988b0bfcc6aa79a40ffd48590d54dbe3
Instruction ID: bb2cd12cc23465aa88ea312cfd2402e5235c83b1fb47797e3c60c9afec886896
Opcode Fuzzy Hash: 3a36a88b653e83c53a0a8c9cbf0c948b988b0bfcc6aa79a40ffd48590d54dbe3
Instruction Fuzzy Hash: A351FCB29083414BE321B6359C117DB7794BB91308F45452EE9C4D6382E9B9D9C887DA

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA60 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__stat64i32.LIBCMT ref: 0040BA9F
_fprintf.LIBCMT ref: 0040BABD
_fprintf.LIBCMT ref: 0040BB00

Strings

xdelta3: using standard output: %s, xrefs: 0040BA8A
xdelta3: to overwrite output file specify -f: %s, xrefs: 0040BAAF
(stdout), xrefs: 0040BA78, 0040BA85
xdelta3: output file: %s, xrefs: 0040BAF2

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$__stat64i32
String ID: (stdout)$xdelta3: output file: %s$xdelta3: to overwrite output file specify -f: %s$xdelta3: using standard output: %s
API String ID: 4057777869-1964124342
Opcode ID: bf9f3f658c6531fb946d0e7de0f1857a4d7c3b0e68eec4f1080d6104eb8238f7
Instruction ID: 8c64a9c82c28a6ccd0098ae7d9b6ea767ce57b6390761f254b2370e083966063
Opcode Fuzzy Hash: bf9f3f658c6531fb946d0e7de0f1857a4d7c3b0e68eec4f1080d6104eb8238f7
Instruction Fuzzy Hash: 5001C4B1B103029BD720AB62DC07B6733A49F60308F44447EE815D2391F37DE9988B8E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A570 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,00000000,?,0040C03D,?,?,?,00000000,?), ref: 0040A586
GetLastError.KERNEL32 ref: 0040A590
_memset.LIBCMT ref: 0040A5BB
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000400,00430D78,00000100,00000000), ref: 0040A5DC
_fprintf.LIBCMT ref: 0040A5FA

Strings

xdelta3: seek failed: %s: %s, xrefs: 0040A5EC
xC, xrefs: 0040A5E2

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ErrorFileFormatLastMessagePointer_fprintf_memset
String ID: xC$xdelta3: seek failed: %s: %s
API String ID: 1566271167-1147637659
Opcode ID: 7808042b860abd396951378a70f90b19e17f96bd04fb16e35e67ead96a535a45
Instruction ID: d8e1584209d0638e8a134e7695ca1f64ee70e0138ecf95c9a72fd9eaadd5986b
Opcode Fuzzy Hash: 7808042b860abd396951378a70f90b19e17f96bd04fb16e35e67ead96a535a45
Instruction Fuzzy Hash: 2D0120B17403213BE22156609C16FAB665CDF88F45F004116FE40F72C0E678EC90479D

Uniqueness

Uniqueness Score: -1.00%

Function 004103FC Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041042F
_fprintf.LIBCMT ref: 00410518
_abort.LIBCMT ref: 00410520

Strings

%d/%d, xrefs: 0041053C
check failure: 0, xrefs: 0041050A
%I64d, xrefs: 00410572

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _abort_fprintf_memset
String ID: %I64d$%d/%d$check failure: 0
API String ID: 787416719-3688481091
Opcode ID: 1c93071c35640179b1fd8f74d63fc1a05f52a720d7c63df9e3c6964a274c1206
Instruction ID: 8833ecf355402944232ae7289c12939bfcf26791303b629f3be53812b1715e06
Opcode Fuzzy Hash: 1c93071c35640179b1fd8f74d63fc1a05f52a720d7c63df9e3c6964a274c1206
Instruction Fuzzy Hash: 4751E3716043459FD720CF28C9917EBB7E2AF85304F08895EE488D7301E7B9E989CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A100 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_strtol.LIBCMT ref: 0040A111

Part of subcall function 00412A4F: strtoxq.LIBCMT ref: 00412A6E

_fprintf.LIBCMT ref: 0040A14B

Strings

xdelta3: -%c: negative integer: %s, xrefs: 0040A128
xdelta3: -%c: minimum value: %u, xrefs: 0040A16D
xdelta3: -%c: maximum value: %u, xrefs: 0040A18C
xdelta3: -%c: invalid integer: %s, xrefs: 0040A13D

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf_strtolstrtoxq
String ID: xdelta3: -%c: invalid integer: %s$xdelta3: -%c: maximum value: %u$xdelta3: -%c: minimum value: %u$xdelta3: -%c: negative integer: %s
API String ID: 2729484075-3312379364
Opcode ID: 8b6af85d00c7980ad98fb7145df286e3118b2baf890ffda0bf5776eeb59a3fd8
Instruction ID: 2b0f36ee782d36656b34a5a35f5b4a0821a02018dd85a99d9680b7cce00c9975
Opcode Fuzzy Hash: 8b6af85d00c7980ad98fb7145df286e3118b2baf890ffda0bf5776eeb59a3fd8
Instruction Fuzzy Hash: D81148B174431029E61899259C41F7F626ECBC2755F28853FB412ED1C0E67ECC75821F

Uniqueness

Uniqueness Score: -1.00%

Function 0040A900 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0040A610: __vsnprintf.LIBCMT ref: 0040A620

_fprintf.LIBCMT ref: 0040A93E

Strings

XDELTA filename (%s): %s, xrefs: 0040A915
XDELTA ext comp (%s): %s, xrefs: 0040A973
output, xrefs: 0040A914, 0040A972
print, xrefs: 0040A952, 0040A990
xdelta3: internal print buffer overflow: %d bytes, xrefs: 0040A930

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: __vsnprintf_fprintf
String ID: XDELTA ext comp (%s): %s$XDELTA filename (%s): %s$output$print$xdelta3: internal print buffer overflow: %d bytes
API String ID: 1864331155-1463258687
Opcode ID: 738a20da18a640150b410c2cab8a0aca482c7e5107fe78c14562bd0af6afde48
Instruction ID: 2cd89be100ebc818142a06773c3df70ea006c865a3640dcad95b8a09adab4076
Opcode Fuzzy Hash: 738a20da18a640150b410c2cab8a0aca482c7e5107fe78c14562bd0af6afde48
Instruction Fuzzy Hash: 5101C6F67003002BE700A576AC45B2B3398EB95758F59043BF604E7681F67DE830826E

Uniqueness

Uniqueness Score: -1.00%

Function 00410050 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_rand.LIBCMT ref: 00410073
_fprintf.LIBCMT ref: 00410186
_abort.LIBCMT ref: 0041018E

Strings

check failure: delpos + stream->avail_out <= IDB_DELSZ, xrefs: 00410178

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _abort_fprintf_rand
String ID: check failure: delpos + stream->avail_out <= IDB_DELSZ
API String ID: 399396772-3754903434
Opcode ID: 9fbeadd75e334f2fba38904b22af708c35d77207a82858c5a66dc9c86c521c2d
Instruction ID: d3f413e3596d5784bf9692fff4575afde38a4c6a2ad83cfaa3b47e81f6e0bb3c
Opcode Fuzzy Hash: 9fbeadd75e334f2fba38904b22af708c35d77207a82858c5a66dc9c86c521c2d
Instruction Fuzzy Hash: 859104B19043404BC760DF29C8852AFBBE0EFC5314F84496FE89997381E7B9D9C48B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040E951

Part of subcall function 004050E0: _memset.LIBCMT ref: 0040510B
Part of subcall function 004050E0: _memset.LIBCMT ref: 0040511B

_memset.LIBCMT ref: 0040EA56

Strings

this is a storyabouttttttttttt- his is a stor- about nothing all. boutique -his story is a -about what happens all the time what -am I ttttttt the person said, so what, per son - gory story is - about nothing -tttttt to test -his sto nothing, xrefs: 0040E9C9
test, xrefs: 0040E994
,^B, xrefs: 0040E9DB

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset
String ID: ,^B$test$this is a storyabouttttttttttt- his is a stor- about nothing all. boutique -his story is a -about what happens all the time what -am I ttttttt the person said, so what, per son - gory story is - about nothing -tttttt to test -his sto nothing
API String ID: 2102423945-2234346011
Opcode ID: 65d5f63856f11980ed1dd4bc103fb32f9b495586bcdd724b0cc940fce3eaa243
Instruction ID: 52b90f919f53f529172a403a0bd6be58ce32f71b533421eb45458726bf6c7668
Opcode Fuzzy Hash: 65d5f63856f11980ed1dd4bc103fb32f9b495586bcdd724b0cc940fce3eaa243
Instruction Fuzzy Hash: BB3170B17047009BE3309F29984175BB6E4FBC9740F64482FF698E7281D7BCA8058B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B850 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0040B89E
_strncpy.LIBCMT ref: 0040B8D2
_fprintf.LIBCMT ref: 0040B924

Strings

xdelta3: using default %s filename: %s, xrefs: 0040B916
0qB, xrefs: 0040B87B

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf_strncpy_strrchr
String ID: 0qB$xdelta3: using default %s filename: %s
API String ID: 3938189075-463031970
Opcode ID: 3cfcb68b382c0baa1c9bfd0d47ab753c2c2c6a908a111c31492d13b6b0ad05d7
Instruction ID: 51885b14070c0ce271349f48fc9fc53db4b690e5283f9c3581250465f4dd212c
Opcode Fuzzy Hash: 3cfcb68b382c0baa1c9bfd0d47ab753c2c2c6a908a111c31492d13b6b0ad05d7
Instruction Fuzzy Hash: 00318DB59002019FDB10DF15D885B63B7E5EF84314F1884AAEC489B396D338EC84CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B670 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 42COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0040B6B5

Strings

/dev/stdin, xrefs: 0040B67C
/dev/stdout, xrefs: 0040B68E
/dev/stderr, xrefs: 0040B6A0
0qB, xrefs: 0040B6CD

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _strrchr
String ID: /dev/stderr$/dev/stdin$/dev/stdout$0qB
API String ID: 3213747228-159927350
Opcode ID: 3d8ea82f62fed55d97e8da8296d0d3425574a30ce64219921aee43c55a0470e6
Instruction ID: e57488c4e842a6f0f184ee794c2a5ad386fdc57304002c85b290bd24e0b05846
Opcode Fuzzy Hash: 3d8ea82f62fed55d97e8da8296d0d3425574a30ce64219921aee43c55a0470e6
Instruction Fuzzy Hash: A3F08253B1416512EB30141E7C517B78689DFD0336F8D897BB408EB395EB2D8C8211DC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040510B
_memset.LIBCMT ref: 0040511B

Strings

0[B, xrefs: 004052B1
|cB, xrefs: 00405407

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset
String ID: 0[B$|cB
API String ID: 2102423945-3586930868
Opcode ID: 9854e5f49c2be3260de64f89b1fc39139249da65e6dfcd2c1fefd3528073da72
Instruction ID: 522864efe6ac2c5966ae0aff7d518a20c7ecc99cb99218814e602c5a661ed220
Opcode Fuzzy Hash: 9854e5f49c2be3260de64f89b1fc39139249da65e6dfcd2c1fefd3528073da72
Instruction Fuzzy Hash: D1913B75A006048BDB54DF29E88079A77E0FB44350F8480BBED08DB786E779D849DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00407B3E
_memset.LIBCMT ref: 00407B4F
_memset.LIBCMT ref: 00407BF0

Strings

8^B, xrefs: 00407C1D

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset
String ID: 8^B
API String ID: 2102423945-1775451484
Opcode ID: a7b4b07d176aa50da384c34afb3a7dc2bb4a12846affb1a3c99342bcac51db52
Instruction ID: 7604ae2796702f703e5b9a440c34d86fe37d37757565e1aabc00fea581f1fc6d
Opcode Fuzzy Hash: a7b4b07d176aa50da384c34afb3a7dc2bb4a12846affb1a3c99342bcac51db52
Instruction Fuzzy Hash: 12414DB19083449BD3609B15D88179FB7E4EB84754F50483FF684A7380EBB8A589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00407CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00407CEC
_memset.LIBCMT ref: 00407D3E
_memset.LIBCMT ref: 00407D7A

Strings

aB, xrefs: 00407DBB

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _memset
String ID: aB
API String ID: 2102423945-388806
Opcode ID: 283602042321818998c0e9b078767b34f7b76793c9b2d779875a7254e57d7f5e
Instruction ID: f7697014712e27378084d2317c5a44a78c7162e95c41682c6955d5bd37747870
Opcode Fuzzy Hash: 283602042321818998c0e9b078767b34f7b76793c9b2d779875a7254e57d7f5e
Instruction Fuzzy Hash: 1B3162B1A047009BE760CB69DC81B67B3E8AF94718F14482FE95A96781D7BCF844C716

Uniqueness

Uniqueness Score: -1.00%

Function 0040A230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040A25D
_fprintf.LIBCMT ref: 0040A294

Strings

xdelta3: free: %p, xrefs: 0040A24F, 0040A286
source, xrefs: 0040A236

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf
String ID: source$xdelta3: free: %p
API String ID: 1654120334-2575477617
Opcode ID: cedb24491e4d2dc51a270a358deeef36b8170788ed59a125daed88030c8e24fc
Instruction ID: d884ded36b80e3d757b5c84f4e8d51f51d6a8c06ff9932d11cfbd24420ed6b8a
Opcode Fuzzy Hash: cedb24491e4d2dc51a270a358deeef36b8170788ed59a125daed88030c8e24fc
Instruction Fuzzy Hash: 70F0F4F2C0132167CE207B625C4674772146F12714B0941BEE804BF386E77D88A486DF

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,00000002,?,?,?,?,?,?,?,?,00000000), ref: 0040BDAA
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,?,?,00000000), ref: 0040BDB4
_fprintf.LIBCMT ref: 0040BE09

Strings

xdelta3: input window size: %u, xrefs: 0040BDFB

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ErrorFileLastSize_fprintf
String ID: xdelta3: input window size: %u
API String ID: 3186004188-1508254048
Opcode ID: 024b900dcb3b62ec2e3ba4011c27cfc4541b5d8ebdb3772edb506fbb3488e772
Instruction ID: c5e0ac6a9114703366e6a9d6db5c87d88132a852df33fa58559ba4f8cd5b9956
Opcode Fuzzy Hash: 024b900dcb3b62ec2e3ba4011c27cfc4541b5d8ebdb3772edb506fbb3488e772
Instruction Fuzzy Hash: FAF08CB0B00205ABD720BF34ED45A2BB3A4EF44340B51057AE901E6284E73C8856CACE

Uniqueness

Uniqueness Score: -1.00%

Function 0041E872 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(`#A,0040DF2E,0042C550,00412360,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041E84C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,000000FF), ref: 0041E856
__dosmaperr.LIBCMT ref: 0041E865

Strings

`#A, xrefs: 0041E848

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: `#A
API String ID: 1545401867-149165141
Opcode ID: b761b5ad6b573e1914a5c8c0e62fdfde509fa821f40362c7fa0dbb301b248da6
Instruction ID: 9f17402c037701772a6532323bf0a4db9223f76727d6e9b23667d4449c211768
Opcode Fuzzy Hash: b761b5ad6b573e1914a5c8c0e62fdfde509fa821f40362c7fa0dbb301b248da6
Instruction Fuzzy Hash: 59D0C734215501E59E603F339C0955776949F887117940D37B815C20D4EF2DCDC2F51D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041E8E2), ref: 0041F7D0
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0041F7E0

Strings

IsProcessorFeaturePresent, xrefs: 0041F7DA
KERNEL32, xrefs: 0041F7CB

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 6de7a0a9fa753d665444ba25a4429878f8f6581086751924b1b864940627dfff
Instruction ID: d02513843afc6cf0f27fa2dcd871e7e94944032905e29290591ed709a60a720a
Opcode Fuzzy Hash: 6de7a0a9fa753d665444ba25a4429878f8f6581086751924b1b864940627dfff
Instruction Fuzzy Hash: AEC0123078121062EA201BB0BC4ABAA6018ABC0B42FA0007BA225D00C4CF68C087842E

Uniqueness

Uniqueness Score: -1.00%

Function 0041B933 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041B963
__isleadbyte_l.LIBCMT ref: 0041B997
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,?,00000000,?,?,?), ref: 0041B9C8
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,?,00000000,?,?,?), ref: 0041BA36

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8d5b98cbec2e8dfce033a9766fc67a5be3136d74ebb63ea3490a6ec876ca8688
Instruction ID: c70d6cfd035e9ede62d8c9414b718c2a4bd3818f93a34f9c7181de7de1635dff
Opcode Fuzzy Hash: 8d5b98cbec2e8dfce033a9766fc67a5be3136d74ebb63ea3490a6ec876ca8688
Instruction Fuzzy Hash: BE31E27161024AEFDF20DFA4C841AEE3BA4EF01311F04856BE5A58B291D3349D82DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041F6BF Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041F6E3

Part of subcall function 0041F50E: __fltout2.LIBCMT ref: 0041F538

__cftog_l.LIBCMT ref: 0041F709
__cftoe_l.LIBCMT ref: 0041F73B

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 1847f5ae4f15b612ad123e43592d6dae059e874de73c1ea79706daa35d036e03
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 0F018332000149BBCF125E85DC41CEE3F62BB18344B18842AFE2854171C33AC9B6AB89

Uniqueness

Uniqueness Score: -1.00%

Function 00416530 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416F2D: __getptd_noexit.LIBCMT ref: 00416F2E
Part of subcall function 00416F2D: __amsg_exit.LIBCMT ref: 00416F3B

__amsg_exit.LIBCMT ref: 0041655C
__lock.LIBCMT ref: 0041656C
InterlockedDecrement.KERNEL32(?), ref: 00416589
InterlockedIncrement.KERNEL32(00591308), ref: 004165B4

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: bb2087907a74886b176e40e1224e453eea662d2686115c418b5a37a6645a4bef
Instruction ID: 8091d23f1509363e627b4dff52befe54c28da104462b70f88f43b2c858cb2879
Opcode Fuzzy Hash: bb2087907a74886b176e40e1224e453eea662d2686115c418b5a37a6645a4bef
Instruction Fuzzy Hash: A9018E31B01A21BBCA20AB26B4067DA77A2AF04754F56401BE90067284CB2CDDD2CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 0040E930: _memset.LIBCMT ref: 0040E951
Part of subcall function 0040E930: _memset.LIBCMT ref: 0040EA56

Part of subcall function 0040EA80: _fprintf.LIBCMT ref: 0040EAD8
Part of subcall function 0040EA80: _abort.LIBCMT ref: 0040EAE0

_fprintf.LIBCMT ref: 0040EEE2
_fprintf.LIBCMT ref: 0040EF40

Strings

non-failures %u; expected %u, xrefs: 0040EED4

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf$_memset$_abort
String ID: non-failures %u; expected %u
API String ID: 3822703549-128235556
Opcode ID: 9a046ebf246961229425126d15db2fde79a995087ecdf541cd39e151e4120e3a
Instruction ID: c50ea1f71e5f3764863498dfd1ee152bc96fb80f0bb9a4a5a5c8355b6728f186
Opcode Fuzzy Hash: 9a046ebf246961229425126d15db2fde79a995087ecdf541cd39e151e4120e3a
Instruction Fuzzy Hash: 8F4101B26003015BD318DB29DC427ABB3D4FB88304F84483EFA45D2281F778E968869A

Uniqueness

Uniqueness Score: -1.00%

Function 004108E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00410ACB
_abort.LIBCMT ref: 00410AD3

Strings

check failure: r == test_ptr->output, xrefs: 00410ABD

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _abort_fprintf
String ID: check failure: r == test_ptr->output
API String ID: 742544005-77445981
Opcode ID: 8259589c425b3f17d96af9209eafbdf76ca90fc9c4fd9171d80ef9a65e70c9dc
Instruction ID: 2a8f779f883dd4f0ceace08e2df6d465dc79d244704e09f5acf51e1c0fb110ae
Opcode Fuzzy Hash: 8259589c425b3f17d96af9209eafbdf76ca90fc9c4fd9171d80ef9a65e70c9dc
Instruction Fuzzy Hash: 695179B09097819FD378CF2AD58079AFBE1BB88300F508A2EE59D97350E77494848F96

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040FBFD
_abort.LIBCMT ref: 0040FC05

Part of subcall function 0041242B: __NMSG_WRITE.LIBCMT ref: 00412452
Part of subcall function 0041242B: _raise.LIBCMT ref: 00412463
Part of subcall function 0041242B: _memset.LIBCMT ref: 004124E6
Part of subcall function 0041242B: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?), ref: 00412506
Part of subcall function 0041242B: UnhandledExceptionFilter.KERNEL32(?,?,?,?), ref: 00412510

Strings

check failure: d->type1 > 0, xrefs: 0040FBEF

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ExceptionFilterUnhandled$_abort_fprintf_memset_raise
String ID: check failure: d->type1 > 0
API String ID: 1580787292-2088976014
Opcode ID: e46ca6311f207e6cb970682f46ec2f2e5627d47f6770b67943e078d4f15b4fc0
Instruction ID: cc93c8dd0abdc2be4ab1e798a0f6ff31a1d8845b666cdd50692b668e8f2e0fc2
Opcode Fuzzy Hash: e46ca6311f207e6cb970682f46ec2f2e5627d47f6770b67943e078d4f15b4fc0
Instruction Fuzzy Hash: 9241ABB080C3814ED760DF2984912AFBFE0AF85344F44487FE8D8D6B81E338854A9B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBD7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040FBFD
_abort.LIBCMT ref: 0040FC05

Part of subcall function 0041242B: __NMSG_WRITE.LIBCMT ref: 00412452
Part of subcall function 0041242B: _raise.LIBCMT ref: 00412463
Part of subcall function 0041242B: _memset.LIBCMT ref: 004124E6
Part of subcall function 0041242B: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?), ref: 00412506
Part of subcall function 0041242B: UnhandledExceptionFilter.KERNEL32(?,?,?,?), ref: 00412510

Strings

check failure: d->type1 > 0, xrefs: 0040FBEF

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: ExceptionFilterUnhandled$_abort_fprintf_memset_raise
String ID: check failure: d->type1 > 0
API String ID: 1580787292-2088976014
Opcode ID: 2c2d88019861493f129f194ad55fc5dff6a6c90fcfd049471acca8d61f07ecdb
Instruction ID: f2c718ddd8cbb09335cb3cced02785ec371bfcc050f4de5c9758d17ba8cb4fff
Opcode Fuzzy Hash: 2c2d88019861493f129f194ad55fc5dff6a6c90fcfd049471acca8d61f07ecdb
Instruction Fuzzy Hash: 2B214AB080C3815FE760DF39845136ABBE1BB89304F44497FE9D8D3B81E339854A8B4A

Uniqueness

Uniqueness Score: -1.00%

Function 004065D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00406619
__aullrem.LIBCMT ref: 00406633

Strings

,gB, xrefs: 004065F1

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: ,gB
API String ID: 3839614884-2088287050
Opcode ID: ceebf066499f8028388251e967d695089cf1a33f061dd34118c4381a68356eb9
Instruction ID: 0b6cc57d01a942a73c014fc8f7cfebe24c0825ef45b30aa3332e946557c0e635
Opcode Fuzzy Hash: ceebf066499f8028388251e967d695089cf1a33f061dd34118c4381a68356eb9
Instruction Fuzzy Hash: 1A016171300A055BD220DB39A9446B7B3E8EF88329F500A7FE94EC6641D736BC118B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,0041CC26,?,00000000,00000007,00000007,?,0041CD6B,00000000,?,?,00429680,0000000C,00418B7D,?), ref: 0041CBFE

Strings

\, xrefs: 0041CBF6
:, xrefs: 0041CBF2

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 2bc3c8bef575c1dd0502c2fbeb5131ad50e7a7d3696e0b3d01c2de2a6861482c
Instruction ID: 964940f75fc57f7670360abd5f890c92da0b876e2fb729a32312822ce3c26448
Opcode Fuzzy Hash: 2bc3c8bef575c1dd0502c2fbeb5131ad50e7a7d3696e0b3d01c2de2a6861482c
Instruction Fuzzy Hash: 9EE0483034C2889DEF518BB8AC857DB3FCC9B11688F04C056E84CCE201E135D695C796

Uniqueness

Uniqueness Score: -1.00%

Function 0040B620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040B656

Strings

xdelta3: warning: external support not compiled: original input was compressed: %s, xrefs: 0040B648
xdelta3: warning: cannot recompress output: unrecognized external compression ID: %s, xrefs: 0040B635

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: _fprintf
String ID: xdelta3: warning: cannot recompress output: unrecognized external compression ID: %s$xdelta3: warning: external support not compiled: original input was compressed: %s
API String ID: 1654120334-1697500560
Opcode ID: f2680a563dd1b3ebe481298b165ee31b25116d07a14eb686f9d0245c690956de
Instruction ID: 078aa273e9d716f0c2bf821100412726252dede16ee3ef77ba1091a13fec9de4
Opcode Fuzzy Hash: f2680a563dd1b3ebe481298b165ee31b25116d07a14eb686f9d0245c690956de
Instruction Fuzzy Hash: 7AE08671A04302AADE2077756D06F132198CBA0754F0144BBF400E62D1F77E894545AF

Uniqueness

Uniqueness Score: -1.00%

Function 00409EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409F06
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000400,00430D78,00000100,00000000,?,0040A1FC), ref: 00409F27

Strings

xC, xrefs: 00409F2D

Memory Dump Source

Source File: 00000000.00000002.366648507.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.366638362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366668238.0000000000424000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366674766.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.366679351.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XDelta3.jbxd

Similarity

API ID: FormatMessage_memset
String ID: xC
API String ID: 2405959848-4292382365
Opcode ID: ebcb83b9dcf571aab5d68da72e87f7297b7977094f5f8b8041b38d946c9918c7
Instruction ID: 9feebdd9ec90b21b9daf853614203f7db33c6c1e11cef5687d46134b992bded9
Opcode Fuzzy Hash: ebcb83b9dcf571aab5d68da72e87f7297b7977094f5f8b8041b38d946c9918c7
Instruction Fuzzy Hash: 7ED0C9747C470137F16266A51C17FDA15888F58F8EFA09222BB40F81D2E5EC7881406D

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XDelta3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: XDelta3.exePID: 6724, Parent PID: 3524

General

File Activities

File Opened

File Created

File Written

File Read

File Attributes Queried

Volume Information Queried

Device IO

Windows Analysis Report
XDelta3.exe

Function 0040A3A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74
filewindowCOMMON

Function 0040CE50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
COMMON

Function 00412599 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE