Windows
Analysis Report
FQElDjFG5t.exe
Overview
General Information
Detection
Score: | 68 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
FQElDjFG5t.exe (PID: 616 cmdline:
C:\Users\u ser\Deskto p\FQElDjFG 5t.exe MD5: 6B44D99B258C275EE7FCF230DA177F3E)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Sliver | According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army. | No Attribution |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
INDICATOR_TOOL_Sliver | Detects Sliver implant cross-platform adversary emulation/red team | ditekSHen |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Sliver | Yara detected Sliver Implants | Joe Security | ||
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
JoeSecurity_Sliver | Yara detected Sliver Implants | Joe Security | ||
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
INDICATOR_TOOL_Sliver | Detects Sliver implant cross-platform adversary emulation/red team | ditekSHen |
| |
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
INDICATOR_TOOL_Sliver | Detects Sliver implant cross-platform adversary emulation/red team | ditekSHen |
|
Click to jump to signature section
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Static PE information: |
Source: | Code function: | 0_2_00237120 | |
Source: | Code function: | 0_2_00237EC0 |
Source: | TCP traffic: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | Binary or memory string: | memstr_4b7d096d-5 |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 0_2_00256860 | |
Source: | Code function: | 0_2_002160A0 | |
Source: | Code function: | 0_2_002580A0 | |
Source: | Code function: | 0_2_0021D120 | |
Source: | Code function: | 0_2_00239120 | |
Source: | Code function: | 0_2_00237120 | |
Source: | Code function: | 0_2_00216980 | |
Source: | Code function: | 0_2_00234980 | |
Source: | Code function: | 0_2_0022E260 | |
Source: | Code function: | 0_2_00256A40 | |
Source: | Code function: | 0_2_00224B40 | |
Source: | Code function: | 0_2_0021BBA0 | |
Source: | Code function: | 0_2_002433C0 | |
Source: | Code function: | 0_2_0022BCA0 | |
Source: | Code function: | 0_2_00233CC0 | |
Source: | Code function: | 0_2_0022F520 | |
Source: | Code function: | 0_2_0021C560 | |
Source: | Code function: | 0_2_00240560 | |
Source: | Code function: | 0_2_002375A0 | |
Source: | Code function: | 0_2_00223E60 | |
Source: | Code function: | 0_2_00216E40 | |
Source: | Code function: | 0_2_00237EC0 | |
Source: | Code function: | 0_2_00219740 | |
Source: | Code function: | 0_2_00253FA0 | |
Source: | Code function: | 0_2_00228F80 | |
Source: | Code function: | 0_2_00245FE0 |
Source: | ReversingLabs: | ||
Source: | Virustotal: |
Source: | File read: | Jump to behavior |
Source: | Static PE information: |
Source: | Key opened: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Source: | Classification label: |
Source: | Static file information: |
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Code function: | 0_2_0026B7A0 |
Source: | Binary or memory string: |
Anti Debugging |
---|
Source: | Code function: | 0_2_0026B7A0 |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Code function: | 0_2_0026B7A0 |
Source: | Queries volume information: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact | Resource Development | Reconnaissance |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 1 Deobfuscate/Decode Files or Information | 11 Input Capture | 11 Security Software Discovery | Remote Services | 11 Input Capture | Exfiltration Over Other Network Medium | 1 Encrypted Channel | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Abuse Accessibility Features | Acquire Infrastructure | Gather Victim Identity Information |
Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 2 Obfuscated Files or Information | LSASS Memory | 12 System Information Discovery | Remote Desktop Protocol | 1 Archive Collected Data | Exfiltration Over Bluetooth | 1 Non-Standard Port | SIM Card Swap | Obtain Device Cloud Backups | Network Denial of Service | Domains | Credentials |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
50% | ReversingLabs | Win64.Trojan.TangoMarte | ||
60% | Virustotal | Browse |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
94.198.53.143 | unknown | Russian Federation | 56694 | DHUBRU | false |
Joe Sandbox Version: | 38.0.0 Ammolite |
Analysis ID: | 1352543 |
Start date and time: | 2023-12-03 14:50:10 +01:00 |
Joe Sandbox Product: | CloudBasic |
Overall analysis duration: | 0h 5m 22s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 4 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample file name: | FQElDjFG5t.exerenamed because original name is a hash value |
Original Sample Name: | 6b44d99b258c275ee7fcf230da177f3e.exe |
Detection: | MAL |
Classification: | mal68.troj.evad.winEXE@1/0@0/1 |
EGA Information: | Failed |
HCA Information: | Failed |
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target FQElDjFG5t.exe, PID 616 because there are no executed function
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
DHUBRU | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | NetSupport RAT | Browse |
| ||
Get hash | malicious | NetSupport RAT | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | NetSupport RAT | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | NetSupport RAT | Browse |
| ||
Get hash | malicious | NetSupport RAT | Browse |
|
File type: | |
Entropy (8bit): | 6.118170899262842 |
TrID: |
|
File name: | FQElDjFG5t.exe |
File size: | 15'886'848 bytes |
MD5: | 6b44d99b258c275ee7fcf230da177f3e |
SHA1: | 833a461f6d479d164b453cc9f5f51259d991b1b7 |
SHA256: | 1aecadf489a6dd7a3a6e5dfda9425673a9d04d38a5cb6b0b8f961536c11237ed |
SHA512: | 5ed0cb03aa7f84445cd45e51836deb95fb62b9cb6b578f1ee173639464ea850b68ad27f79160207895f92b0cebda6972cfa5937bbd6bb28d0cb074907cdfb8b0 |
SSDEEP: | 98304:KXX+aiZFtuYvgK408HLwkoS9fye+ZV6zEmHyd6ceCSGp:K0tzvf4bHUkT9fd+ZdmPk |
TLSH: | 9BF61A03F8951594C4F9D1B489218262FA70785C0B7973DF6BA1F7B42B327E09EBA790 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........h........".................@.........@...........................................`... ............................ |
Icon Hash: | 00928e8e8686b000 |
Entrypoint: | 0x45d040 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED |
DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x0 [Thu Jan 1 00:00:00 1970 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 6 |
OS Version Minor: | 1 |
File Version Major: | 6 |
File Version Minor: | 1 |
Subsystem Version Major: | 6 |
Subsystem Version Minor: | 1 |
Import Hash: | f0ea7b7844bbc5bfa9bb32efdcea957c |
Instruction |
---|
jmp 00007F947CE227B0h |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
pushfd |
cld |
dec eax |
sub esp, 000000E0h |
dec eax |
mov dword ptr [esp], edi |
dec eax |
mov dword ptr [esp+08h], esi |
dec eax |
mov dword ptr [esp+10h], ebp |
dec eax |
mov dword ptr [esp+18h], ebx |
dec esp |
mov dword ptr [esp+20h], esp |
dec esp |
mov dword ptr [esp+28h], ebp |
dec esp |
mov dword ptr [esp+30h], esi |
dec esp |
mov dword ptr [esp+38h], edi |
movups dqword ptr [esp+40h], xmm6 |
movups dqword ptr [esp+50h], xmm7 |
inc esp |
movups dqword ptr [esp+60h], xmm0 |
inc esp |
movups dqword ptr [esp+70h], xmm1 |
inc esp |
movups dqword ptr [esp+00000080h], xmm2 |
inc esp |
movups dqword ptr [esp+00000090h], xmm3 |
inc esp |
movups dqword ptr [esp+000000A0h], xmm4 |
inc esp |
movups dqword ptr [esp+000000B0h], xmm5 |
inc esp |
movups dqword ptr [esp+000000C0h], xmm6 |
inc esp |
movups dqword ptr [esp+000000D0h], xmm7 |
dec eax |
sub esp, 30h |
dec ecx |
mov ebp, ecx |
dec ecx |
mov edi, eax |
dec eax |
mov edx, dword ptr [00EFDBE3h] |
dec eax |
mov edx, dword ptr [edx] |
dec eax |
cmp edx, 00000000h |
jne 00007F947CE2647Eh |
dec eax |
mov eax, 00000000h |
jmp 00007F947CE26543h |
dec eax |
mov edx, dword ptr [edx] |
dec eax |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0xf6f000 | 0x490 | .idata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xf70000 | 0x279b0 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0xebf040 | 0x148 | .data |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x93e7fd | 0x93e800 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x940000 | 0x57e788 | 0x57e800 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0xebf000 | 0xaf350 | 0x41200 | False | 0.38803832773512476 | data | 4.773375836859468 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.idata | 0xf6f000 | 0x490 | 0x600 | False | 0.3372395833333333 | data | 3.6139814069913854 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.reloc | 0xf70000 | 0x279b0 | 0x27a00 | False | 0.13942355086750788 | data | 5.4438349548067215 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
.symtab | 0xf98000 | 0x4 | 0x200 | False | 0.02734375 | data | 0.020393135236084953 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
DLL | Import |
---|---|
kernel32.dll | WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Dec 3, 2023 14:51:00.311356068 CET | 49705 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:51:00.519615889 CET | 8888 | 49705 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:51:01.030443907 CET | 49705 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:51:01.240024090 CET | 8888 | 49705 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:51:01.749279022 CET | 49705 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:51:01.957565069 CET | 8888 | 49705 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:51:02.467902899 CET | 49705 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:51:02.676217079 CET | 8888 | 49705 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:51:03.186655045 CET | 49705 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:51:03.395139933 CET | 8888 | 49705 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:52:03.397701979 CET | 49713 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:52:03.605952024 CET | 8888 | 49713 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:52:04.115473986 CET | 49713 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:52:04.328780890 CET | 8888 | 49713 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:52:04.834007978 CET | 49713 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:52:05.042041063 CET | 8888 | 49713 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:52:05.552767038 CET | 49713 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:52:05.768969059 CET | 8888 | 49713 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:52:06.271625042 CET | 49713 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:52:06.479882002 CET | 8888 | 49713 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:53:06.482491970 CET | 49716 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:53:06.690773964 CET | 8888 | 49716 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:53:07.201913118 CET | 49716 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:53:07.410693884 CET | 8888 | 49716 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:53:07.920677900 CET | 49716 | 8888 | 192.168.2.5 | 94.198.53.143 |
Dec 3, 2023 14:53:08.158020020 CET | 8888 | 49716 | 94.198.53.143 | 192.168.2.5 |
Dec 3, 2023 14:53:08.670706987 CET | 49716 | 8888 | 192.168.2.5 | 94.198.53.143 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Target ID: | 0 |
Start time: | 14:50:59 |
Start date: | 03/12/2023 |
Path: | C:\Users\user\Desktop\FQElDjFG5t.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x210000 |
File size: | 15'886'848 bytes |
MD5 hash: | 6B44D99B258C275EE7FCF230DA177F3E |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | Go lang |
Yara matches: |
|
Reputation: | low |
Has exited: | false |
Function 0021C560 Relevance: 8.0, Strings: 6, Instructions: 510COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0021BBA0 Relevance: 6.6, Strings: 5, Instructions: 349COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00228F80 Relevance: 5.5, Strings: 4, Instructions: 545COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00216E40 Relevance: 4.2, Strings: 3, Instructions: 418COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002160A0 Relevance: 4.1, Strings: 3, Instructions: 381COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00256860 Relevance: 3.9, Strings: 3, Instructions: 124COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00240560 Relevance: 2.7, Strings: 2, Instructions: 249COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002433C0 Relevance: 2.7, Strings: 2, Instructions: 246COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00245FE0 Relevance: 2.7, Strings: 2, Instructions: 237COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00253FA0 Relevance: 1.6, Strings: 1, Instructions: 391COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002375A0 Relevance: 1.6, Strings: 1, Instructions: 346COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00234980 Relevance: 1.6, Strings: 1, Instructions: 324COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00256A40 Relevance: 1.5, Strings: 1, Instructions: 243COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00223E60 Relevance: 1.5, Strings: 1, Instructions: 219COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00239120 Relevance: 1.4, Strings: 1, Instructions: 172COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00224B40 Relevance: .3, Instructions: 327COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00216980 Relevance: .3, Instructions: 260COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00237120 Relevance: .2, Instructions: 207COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00237EC0 Relevance: .2, Instructions: 193COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022BCA0 Relevance: .2, Instructions: 183COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00219740 Relevance: .2, Instructions: 161COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002580A0 Relevance: .2, Instructions: 155COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022E260 Relevance: .1, Instructions: 130COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022F520 Relevance: .1, Instructions: 108COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0021D120 Relevance: .1, Instructions: 99COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00233CC0 Relevance: .1, Instructions: 78COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0026B7A0 Relevance: .0, Instructions: 11COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002275C0 Relevance: 12.9, Strings: 10, Instructions: 351COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00217A60 Relevance: 12.7, Strings: 10, Instructions: 194COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002184E0 Relevance: 11.4, Strings: 9, Instructions: 167COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0023DEE0 Relevance: 10.1, Strings: 8, Instructions: 68COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00211060 Relevance: 9.1, Strings: 7, Instructions: 306COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00219080 Relevance: 8.9, Strings: 7, Instructions: 170COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00229A60 Relevance: 6.4, Strings: 5, Instructions: 198COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277AA Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277B0 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277B6 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277BC Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00227798 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022779E Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277C2 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277C8 Relevance: 6.4, Strings: 5, Instructions: 112COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00227823 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00227805 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022780B Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00227811 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00227817 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022781D Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277F9 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002277FF Relevance: 6.4, Strings: 5, Instructions: 106COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002115C0 Relevance: 5.4, Strings: 4, Instructions: 445COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0022C620 Relevance: 5.3, Strings: 4, Instructions: 314COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00255B40 Relevance: 5.2, Strings: 4, Instructions: 209COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00254DE0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 0021D3A0 Relevance: 5.2, Strings: 4, Instructions: 163COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002622C0 Relevance: 5.2, Strings: 4, Instructions: 160COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 002258E0 Relevance: 5.1, Strings: 4, Instructions: 131COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |