Create Interactive Tour

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Analysis ID:	1363621
MD5:	f9661ce57cee8adccef073fcb321b152
SHA1:	db30bbb94fe457d6616e8807e5ea8ad631d1327f
SHA256:	718dd7f63ba8fd0fe55bf43b5ae07a816b0b13d48bf65b93c9c69651aa43c216
Tags:	exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe (PID: 7000 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe MD5: F9661CE57CEE8ADCCEF073FCB321B152)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Virustotal: Detection: 13%

Perma Link

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: 6C:\Users\masir\source\repos\Vinylpyridine\Release\Vinylpyridine.pdb source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Source:	Binary string: C:\Users\masir\source\repos\Vinylpyridine\Release\Vinylpyridine.pdb source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD2DF0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayMonitors,EnumDisplayMonitors,EnumDisplayMonitors,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,CreatePen,SelectObject,SelectObject,SelectObject,BitBlt,AlphaBlend,Arc,DeleteObject,DeleteObject,DeleteObject,Sleep,

0_2_00DD2DF0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DDCC35

0_2_00DDCC35

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/0@0/0

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 6C:\Users\masir\source\repos\Vinylpyridine\Release\Vinylpyridine.pdb source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Source:	Binary string: C:\Users\masir\source\repos\Vinylpyridine\Release\Vinylpyridine.pdb source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD49F6 push ecx; ret

0_2_00DD4A09

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe TID: 6380

Thread sleep time: -40000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD47A3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DD47A3

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD5672 mov eax, dword ptr fs:[00000030h]

0_2_00DD5672

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD9021 GetProcessHeap,

0_2_00DD9021

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Code function: 0_2_00DD48F1 SetUnhandledExceptionFilter,	0_2_00DD48F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Code function: 0_2_00DD42E3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DD42E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Code function: 0_2_00DD47A3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DD47A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	Code function: 0_2_00DD7321 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DD7321

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD4A0B cpuid

0_2_00DD4A0B

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Code function: 0_2_00DD468B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00DD468B

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	19%	ReversingLabs
SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	13%	Virustotal		Browse
SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe	100%	Avira	HEUR/AGEN.1353154

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1363621
Start date and time:	2023-12-17 12:22:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Detection:	MAL
Classification:	mal56.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 15 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

Time	Type	Description
12:23:04	API Interceptor	25x Sleep call for process: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe modified

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.036120126198664
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
File size:	406'016 bytes
MD5:	f9661ce57cee8adccef073fcb321b152
SHA1:	db30bbb94fe457d6616e8807e5ea8ad631d1327f
SHA256:	718dd7f63ba8fd0fe55bf43b5ae07a816b0b13d48bf65b93c9c69651aa43c216
SHA512:	f0e3f89ab7ad1f8f9556011b685d63b070e0857425695590590ec7a9eb7f6c56d4fbed0ab21be1f57f2961a3410ba0dc37bd506ed48336be7a62da72ed520375
SSDEEP:	3072:RuEZIBoDPKpXza3G9f988gwlvKz/gam1bewmE:RN2sKLHlvKDzIbek
TLSH:	B5848AC7BC6CE1D0F95CAA38E051495653D92DB26E865FA7D2B07D3FF05036BAC0260A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W...6.O.6.O.6.O/.eO.6.O/.gO.6.O/.fO.6.O6h.N.6.O6h.N.6.O6h.N.6.O.N.O.6.O.6.O.6.O.h.N.6.O.hkO.6.O.6.O.6.O.h.N.6.ORich.6.O.......

File Icon


Icon Hash:	81a9d9d9d9d9d9a7

Static PE Info

General

Entrypoint:	0x4042d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62CD3947 [Tue Jul 12 09:05:11 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	82ea41bed4a967e32832e763643ef8f1

Entrypoint Preview

Instruction
call 00007FE6DD4FEF62h
jmp 00007FE6DD4FEA43h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [00410098h]
push dword ptr [ebp+08h]
call dword ptr [00410094h]
push C0000409h
call dword ptr [0041009Ch]
push eax
call dword ptr [004100A0h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FE6DD507A96h
test eax, eax
je 00007FE6DD4FEBB7h
push 00000002h
pop ecx
int 29h
mov dword ptr [00417880h], eax
mov dword ptr [0041787Ch], ecx
mov dword ptr [00417878h], edx
mov dword ptr [00417874h], ebx
mov dword ptr [00417870h], esi
mov dword ptr [0041786Ch], edi
mov word ptr [00417898h], ss
mov word ptr [0041788Ch], cs
mov word ptr [00417868h], ds
mov word ptr [00417864h], es
mov word ptr [00417860h], fs
mov word ptr [0041785Ch], gs
pushfd
pop dword ptr [00417890h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00417884h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00417888h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00417894h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [004177D0h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16124	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4c5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0x1148	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x159a0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15a10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe078	0xe200	False	0.522746128318584	data	6.595282194096874	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x69e2	0x6a00	False	0.41549970518867924	data	5.128093097508466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x11a0	0x800	False	0.16259765625	data	1.9918900708463572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x19000	0xac	0x200	False	0.2890625	data	1.439093223937576	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4c5e0	0x4c600	False	0.09891890855155483	data	5.624347560065898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x67000	0x1148	0x1200	False	0.8023003472222222	data	6.526773553928426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a390	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Japanese	Japan	0.26344086021505375
RT_ICON	0x1a678	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Japanese	Japan	0.5135135135135135
RT_ICON	0x1a7a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	Japanese	Japan	0.47707889125799574
RT_ICON	0x1b648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	Japanese	Japan	0.5243682310469314
RT_ICON	0x1bef0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576	Japanese	Japan	0.5627880184331797
RT_ICON	0x1c5b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	Japanese	Japan	0.4458092485549133
RT_ICON	0x1cb20	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 6912	Japanese	Japan	0.2123773173391494
RT_ICON	0x1e7c8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	Japanese	Japan	0.26265432098765434
RT_ICON	0x1f470	0x748	Device independent bitmap graphic, 24 x 48 x 24, image size 1728	Japanese	Japan	0.34334763948497854
RT_ICON	0x1fbb8	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	Japanese	Japan	0.4426605504587156
RT_ICON	0x1ff20	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144	Japanese	Japan	0.06808296594372282
RT_ICON	0x61f48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Japanese	Japan	0.1845435684647303
RT_ICON	0x644f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Japanese	Japan	0.23874296435272044
RT_ICON	0x65598	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Japanese	Japan	0.32008196721311477
RT_ICON	0x65f20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Japanese	Japan	0.42641843971631205
RT_GROUP_ICON	0x66388	0xd8	data	Japanese	Japan	0.5925925925925926
RT_MANIFEST	0x66460	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetProcessHeap, GetStringTypeW, SetStdHandle, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW, DecodePointer, CreateFileW, CreateThread, CloseHandle, TerminateThread, GetFileType, Sleep, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, GetACP, HeapFree, HeapAlloc, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, RaiseException
USER32.dll	SetCursorPos, ReleaseDC, GetCursorPos, LoadCursorA, GetDC, EnumDisplayMonitors, UnionRect, GetSystemMetrics, DrawIcon, RedrawWindow, MessageBoxA
GDI32.dll	CreateCompatibleBitmap, Pie, SelectObject, CreateDIBSection, Arc, CreateCompatibleDC, CreatePatternBrush, CreatePen, Ellipse, DeleteObject, CreateSolidBrush, BitBlt
MSIMG32.dll	AlphaBlend
WINMM.dll	waveOutOpen, waveOutClose, waveOutUnprepareHeader, waveOutWrite, waveOutPrepareHeader

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan
English	United States

• SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Click to jump to process

Target ID:	0
Start time:	12:22:54
Start date:	17/12/2023
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe
Imagebase:	0xdd0000
File size:	406'016 bytes
MD5 hash:	F9661CE57CEE8ADCCEF073FCB321B152
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1702
Total number of Limit Nodes:	38

Executed Functions

Function 00DD2DF0 Relevance: 25.7, APIs: 17, Instructions: 153
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00DD2DFE
GetSystemMetrics.USER32(00000000), ref: 00DD2E10
GetSystemMetrics.USER32(00000001), ref: 00DD2E18
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2E3A
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2E52
GetDC.USER32(00000000), ref: 00DD2E6A
CreateCompatibleDC.GDI32(00000000), ref: 00DD2E77
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00DD2E84
CreatePen.GDI32(00000000,00000019,00000000), ref: 00DD2EC8
SelectObject.GDI32(?,00000000), ref: 00DD2ED9
SelectObject.GDI32(?,?), ref: 00DD2EE3
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD2F01
AlphaBlend.MSIMG32(?,000000E7,000000E7,?,?,?,?,?,?,?,00190000), ref: 00DD2F34
Arc.GDI32(?), ref: 00DD2F8E
DeleteObject.GDI32(?), ref: 00DD2F9E
DeleteObject.GDI32(?), ref: 00DD2FA4
Sleep.KERNELBASE(00000001), ref: 00DD2FA8

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Object$Create$CompatibleDeleteDisplayEnumMetricsMonitorsSelectSystem$AlphaBitmapBlendSleep
String ID:
API String ID: 1632010305-0
Opcode ID: 2c95e7a8374023befce73eb9d97778cf5ac32b62ba01a9d78b567324219b40e3
Instruction ID: f3af944d9989daabe229a525bc7b48a219193b5a1de15858842ad8272d558d83
Opcode Fuzzy Hash: 2c95e7a8374023befce73eb9d97778cf5ac32b62ba01a9d78b567324219b40e3
Instruction Fuzzy Hash: 0941A276504354BFD210EB619C85F2B7FE9EF88750F10091AF5849A2A1C7B0EC54DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DD5672 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,00DD5648,00000003,00DE5DF8,0000000C,00DD579F,00000003,00000002,00000000,?,00DD6844,00000003), ref: 00DD5693
TerminateProcess.KERNEL32(00000000,?,00DD5648,00000003,00DE5DF8,0000000C,00DD579F,00000003,00000002,00000000,?,00DD6844,00000003), ref: 00DD569A
ExitProcess.KERNEL32 ref: 00DD56AC

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6bc5d2a14d2a35033c122e09a753b940f0d2024339bf37e504cf44dc0305ba64
Instruction ID: f5492386c501940c9f0bae0a6beb0b4471503ae0eee89f8ace6d3128734cb986
Opcode Fuzzy Hash: 6bc5d2a14d2a35033c122e09a753b940f0d2024339bf37e504cf44dc0305ba64
Instruction Fuzzy Hash: C7E0B631410A88AFCF217F64ED49A593F6AEB50352F844015F849CA321CB76ED82CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD3CE0 Relevance: 138.6, APIs: 75, Strings: 4, Instructions: 326
threadsleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,!!!WARNING!!!You have ran a Trojan known as Vinylpyridine.exe that has full capacity to delete all of your data and your operating system.By continuing, you keep in mind that the creator will not be responsible for any damage caused by this trojan and it i,Vinylpyridine.exe - !!!WARNING!!!,00000034), ref: 00DD3CF7
MessageBoxA.USER32(00000000,!!!FINAL WARNING!!!This Trojan has a lot of destructive potential. You will lose all of your data if you continue, and the creator will not be responsible for any of the damage caused. This is not meant to be malicious but simply for entertainment and educat,Vinylpyridine.exe - !!!FINAL WARNING!!!,00000034), ref: 00DD3D13
Sleep.KERNELBASE(000009C4), ref: 00DD3D2C
CreateThread.KERNELBASE(00000000,00000000,Function_00001D40,00000000,00000000,00000000), ref: 00DD3D43
CreateThread.KERNELBASE(00000000,00000000,Function_00001BD0,00000000,00000000,00000000), ref: 00DD3D54
CreateThread.KERNELBASE(00000000,00000000,Function_00001DA0,00000000,00000000,00000000), ref: 00DD3D65
Sleep.KERNELBASE(00002710), ref: 00DD3D6E
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3D73
CloseHandle.KERNEL32(00000000), ref: 00DD3D80
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3D93
CreateThread.KERNELBASE(00000000,00000000,Function_00001FE0,00000000,00000000,00000000), ref: 00DD3DA4
Sleep.KERNEL32(00002710), ref: 00DD3DB1
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3DBA
CloseHandle.KERNEL32(00000000), ref: 00DD3DC1
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3DCE
CreateThread.KERNELBASE(00000000,00000000,Function_00002200,00000000,00000000,00000000), ref: 00DD3DDF
Sleep.KERNEL32(00002710), ref: 00DD3DEC
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3DF5
CloseHandle.KERNEL32(00000000), ref: 00DD3DFC
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3E09
CreateThread.KERNELBASE(00000000,00000000,Function_00002420,00000000,00000000,00000000), ref: 00DD3E1A
Sleep.KERNELBASE(00002710), ref: 00DD3E27
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3E30
CloseHandle.KERNEL32(00000000), ref: 00DD3E37
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3E44
CreateThread.KERNELBASE(00000000,00000000,Function_000025B0,00000000,00000000,00000000), ref: 00DD3E55
Sleep.KERNEL32(00002710), ref: 00DD3E62
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3E6B
CloseHandle.KERNEL32(00000000), ref: 00DD3E72
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3E7F
CreateThread.KERNELBASE(00000000,00000000,Function_00002810,00000000,00000000,00000000), ref: 00DD3E90
Sleep.KERNEL32(00002710), ref: 00DD3E9D
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3EA6
CloseHandle.KERNEL32(00000000), ref: 00DD3EAD
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3EBA
CreateThread.KERNELBASE(00000000,00000000,Function_00002A40,00000000,00000000,00000000), ref: 00DD3ECB
Sleep.KERNEL32(00002710), ref: 00DD3ED8
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3EE1
CloseHandle.KERNEL32(00000000), ref: 00DD3EE8
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3EF5
CreateThread.KERNELBASE(00000000,00000000,Function_00002BD0,00000000,00000000,00000000), ref: 00DD3F06
Sleep.KERNEL32(00002710), ref: 00DD3F13
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3F1C
CloseHandle.KERNEL32(00000000), ref: 00DD3F23
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3F30
CreateThread.KERNELBASE(00000000,00000000,Function_00002DF0,00000000,00000000,00000000), ref: 00DD3F41
Sleep.KERNELBASE(00002710), ref: 00DD3F4E
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3F57
CloseHandle.KERNEL32(00000000), ref: 00DD3F5E
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3F6B
CreateThread.KERNELBASE(00000000,00000000,Function_00002FC0,00000000,00000000,00000000), ref: 00DD3F7C
Sleep.KERNEL32(00002710), ref: 00DD3F89
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3F92
CloseHandle.KERNEL32(00000000), ref: 00DD3F99
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3FA6
CreateThread.KERNELBASE(00000000,00000000,Function_000032A0,00000000,00000000,00000000), ref: 00DD3FB7
Sleep.KERNEL32(00002710), ref: 00DD3FC4
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD3FCD
CloseHandle.KERNEL32(00000000), ref: 00DD3FD4
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD3FE1
CreateThread.KERNELBASE(00000000,00000000,Function_000035C0,00000000,00000000,00000000), ref: 00DD3FF8
Sleep.KERNEL32(00002710), ref: 00DD4001
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD400A
CloseHandle.KERNEL32(00000000), ref: 00DD4011
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD4022
CreateThread.KERNELBASE(00000000,00000000,Function_00003800,00000000,00000000,00000000), ref: 00DD4033
Sleep.KERNEL32(00002710), ref: 00DD403C
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD4045
CloseHandle.KERNEL32(00000000), ref: 00DD4052
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD405F
CreateThread.KERNELBASE(00000000,00000000,Function_00003AA0,00000000,00000000,00000000), ref: 00DD4070
Sleep.KERNEL32(00002710), ref: 00DD407B
TerminateThread.KERNELBASE(00000000,00000000), ref: 00DD4084
CloseHandle.KERNEL32(00000000), ref: 00DD408B
RedrawWindow.USER32(00000000,00000000,00000000,00000085), ref: 00DD4098

Strings

Vinylpyridine.exe - !!!FINAL WARNING!!!, xrefs: 00DD3D07
!!!FINAL WARNING!!!This Trojan has a lot of destructive potential. You will lose all of your data if you continue, and the creator will not be responsible for any of the damage caused. This is not meant to be malicious but simply for entertainment and educat, xrefs: 00DD3D0C
Vinylpyridine.exe - !!!WARNING!!!, xrefs: 00DD3CEB
!!!WARNING!!!You have ran a Trojan known as Vinylpyridine.exe that has full capacity to delete all of your data and your operating system.By continuing, you keep in mind that the creator will not be responsible for any damage caused by this trojan and it i, xrefs: 00DD3CF0

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Thread$Create$Sleep$CloseHandleRedrawTerminateWindow$Message
String ID: !!!FINAL WARNING!!!This Trojan has a lot of destructive potential. You will lose all of your data if you continue, and the creator will not be responsible for any of the damage caused. This is not meant to be malicious but simply for entertainment and educat$!!!WARNING!!!You have ran a Trojan known as Vinylpyridine.exe that has full capacity to delete all of your data and your operating system.By continuing, you keep in mind that the creator will not be responsible for any damage caused by this trojan and it i$Vinylpyridine.exe - !!!FINAL WARNING!!!$Vinylpyridine.exe - !!!WARNING!!!
API String ID: 1770148043-1172402299
Opcode ID: 10d739bc57abf4d67f13393cd2352a419cd3511ee2504af473ee58b962225ee9
Instruction ID: 778ad10e56cc4c67e0a5bb2027281b856a03a998a0ef3449b8dd71f398afa785
Opcode Fuzzy Hash: 10d739bc57abf4d67f13393cd2352a419cd3511ee2504af473ee58b962225ee9
Instruction Fuzzy Hash: F0A1CF327C4B94BAF27137A06C8FF1A3915AB45F52F250501F305BE6D09AE478818BBE

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2420 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 126
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00DD2439
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD245D
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2475
CreateCompatibleDC.GDI32 ref: 00DD24BB
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD24D6
SelectObject.GDI32(00000000,00000000), ref: 00DD24E1
GetDC.USER32(00000000), ref: 00DD24E9
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD2509
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 00DD2588
ReleaseDC.USER32(00000000,00000000), ref: 00DD2591
DeleteObject.GDI32(00000000), ref: 00DD2598
Sleep.KERNELBASE(00000019), ref: 00DD25A0

Strings

,, xrefs: 00DD249D

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: ff47922e4c6a29082cce52dd5403627b3e832fe19408ba87f382615731693e79
Instruction ID: b3edaccfd2541a3f4f222fc43d126b2b4c080292144d2c613814f4cfbe620e70
Opcode Fuzzy Hash: ff47922e4c6a29082cce52dd5403627b3e832fe19408ba87f382615731693e79
Instruction Fuzzy Hash: 78416131548341AFD310DF609C85F6FBBF4FB89B10F110A1EF5859A290D7B0A984CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2A40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 124
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00DD2A59
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD2A7D
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD2A95
CreateCompatibleDC.GDI32 ref: 00DD2AD7
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD2AF2
SelectObject.GDI32(00000000,00000000), ref: 00DD2AFD
GetDC.USER32(00000000), ref: 00DD2B05
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD2B25
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD2BA8
ReleaseDC.USER32(00000000,00000000), ref: 00DD2BB1
DeleteObject.GDI32(00000000), ref: 00DD2BB8
Sleep.KERNELBASE(00000019), ref: 00DD2BC0

Strings

,, xrefs: 00DD2AB9

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 267de7fd30c07cda1d863c5f3fdfb3df6cbaa14bb33225e5450bbd730e69e26b
Instruction ID: bedbc006fd5156a90181bc6b850d6824233abb1a62126500a0b19d8997fc2352
Opcode Fuzzy Hash: 267de7fd30c07cda1d863c5f3fdfb3df6cbaa14bb33225e5450bbd730e69e26b
Instruction Fuzzy Hash: CA415371948340AFD310DF249C85F6BBBF4FF99704F114A1EF6859A291D7B0A944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1BD0 Relevance: 18.1, APIs: 12, Instructions: 105
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00DD1BEF
GetSystemMetrics.USER32(00000000), ref: 00DD1BF9
GetSystemMetrics.USER32(00000001), ref: 00DD1BFD
GetDC.USER32(00000000), ref: 00DD1C0F
GetCursorPos.USER32(?), ref: 00DD1C18
LoadCursorA.USER32(00000000,00007F88), ref: 00DD1C25
__libm_sse2_sin_precise.LIBCMT ref: 00DD1C32
__libm_sse2_cos_precise.LIBCMT ref: 00DD1C50
DrawIcon.USER32(00000000,?,?,00000000), ref: 00DD1C69
SetCursorPos.USER32(?,?), ref: 00DD1CD2
SetCursorPos.USER32(?,?), ref: 00DD1D19
Sleep.KERNELBASE(00000001), ref: 00DD1D21

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Cursor$MetricsSystem$DrawIconLoadSleep__libm_sse2_cos_precise__libm_sse2_sin_precise
String ID:
API String ID: 1137526816-0
Opcode ID: b80cfd996963cd2b4b25334dc0b069aa538edbf99329891666ac22107f737a29
Instruction ID: 84e660e1d46f00993aa9d08d0e2b7b8c36a6568b5d676fe789c6adc6723719a9
Opcode Fuzzy Hash: b80cfd996963cd2b4b25334dc0b069aa538edbf99329891666ac22107f737a29
Instruction Fuzzy Hash: ED31EF76604B409BC305FF74AC96B2EB7A6FFC9710F040A1AB149EA395DF74D84486B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DD15D0 Relevance: 7.6, APIs: 5, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,74DF0F00,?,?,00DD1D85), ref: 00DD1638
waveOutPrepareHeader.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD1708
waveOutWrite.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD171D
waveOutUnprepareHeader.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD1732
waveOutClose.WINMM(?,?,74DF0F00,?,?,00DD1D85), ref: 00DD173E

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: 5108244033fffc746b02862100fbec4e08982135f8d87bb055143ee68427c030
Instruction ID: a268c340650bf29fc6921e6e4e89cfe5bf9a561a2dc2231f19c0ed181b76d2a7
Opcode Fuzzy Hash: 5108244033fffc746b02862100fbec4e08982135f8d87bb055143ee68427c030
Instruction Fuzzy Hash: 4031647198C2289BDB108F68CC557E9B6B9FF48310F0442E9E94DDA291D77446E4CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1190 Relevance: 7.6, APIs: 5, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,74DF0F00,?,?,00DD1D61), ref: 00DD11F7
waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12D4
waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12E9
waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12FE
waveOutClose.WINMM(?,?,?,00DD1D61), ref: 00DD130A

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: b7dbeba807a7caaad27545862c0361c3b9c93e0b3b2ca4079653267d2de1f7a0
Instruction ID: 758b7098303f2cf1474f33ca9f0936290e36ca0f1dea198213d813c1ef588334
Opcode Fuzzy Hash: b7dbeba807a7caaad27545862c0361c3b9c93e0b3b2ca4079653267d2de1f7a0
Instruction Fuzzy Hash: 6B41177199C2289FDB208F1DCC957DABBB9EF49304F0051E9E90CAB251C77056A9CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1000 Relevance: 7.6, APIs: 5, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D55), ref: 00DD1066
waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD1139
waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD114E
waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD1163
waveOutClose.WINMM(?,?,?,00DD1D55), ref: 00DD116F

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: 03f40305d47862635cc2bd6e6e6bf61d688308683b49892244deb49a27400f6b
Instruction ID: 935dff822d3a9033d516de57ed58b64d59c22a4d804d1f107e480af69651c095
Opcode Fuzzy Hash: 03f40305d47862635cc2bd6e6e6bf61d688308683b49892244deb49a27400f6b
Instruction Fuzzy Hash: 7A311D7199D2289FDB249F1CCD967D9BBB8EF09300F4001E9E90CEA291C77456A9CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1470 Relevance: 7.6, APIs: 5, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D79), ref: 00DD14D6
waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD1579
waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD158E
waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD15A3
waveOutClose.WINMM(?,?,?,00DD1D79), ref: 00DD15AF

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: c0f7f74d3fcf48a33365239d9fcf253a6dbce384e48c8e260c1ff2d874a766b3
Instruction ID: 99447fcbae63611d01e5ace2c2ba8a81cf69960e0f12c8babf1090bc97952d3a
Opcode Fuzzy Hash: c0f7f74d3fcf48a33365239d9fcf253a6dbce384e48c8e260c1ff2d874a766b3
Instruction Fuzzy Hash: DE31307199C2289FDB209F5CCC967DABBB8FF19304F4001E9E94C9A251C77556A8CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1760 Relevance: 7.6, APIs: 5, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D91), ref: 00DD17C6
waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD1870
waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD1885
waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD189A
waveOutClose.WINMM(?,?,?,00DD1D91), ref: 00DD18A6

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: 47c1543559bc52c98d25bd5f1aa1b5ed917a9530514ba959cedb3131257ab19e
Instruction ID: 3763f94bc82bc4d960829f878ad7f05f4ac45b6b46ff3634c2a765df14e99fb4
Opcode Fuzzy Hash: 47c1543559bc52c98d25bd5f1aa1b5ed917a9530514ba959cedb3131257ab19e
Instruction Fuzzy Hash: 3D313E7199C2289BDB219F68DC957DABBB8EF09304F1001D9E94CEA251D77106E8CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1320 Relevance: 7.6, APIs: 5, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,74DF0F00,?,00DD1D6D), ref: 00DD1386
waveOutPrepareHeader.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD1421
waveOutWrite.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD1436
waveOutUnprepareHeader.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD144B
waveOutClose.WINMM(?,?,00DD1D6D), ref: 00DD1457

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWrite
String ID:
API String ID: 777231989-0
Opcode ID: 2a0b45759d4783e74d2746bd40e7c7d2483e77f9fb2ca91530c0795fbc1c8484
Instruction ID: 6543a04dc398fe87197131148486aa5b22a1088401e96dd49d8f867f358482a3
Opcode Fuzzy Hash: 2a0b45759d4783e74d2746bd40e7c7d2483e77f9fb2ca91530c0795fbc1c8484
Instruction Fuzzy Hash: CE313A7199C2289BDB21DF58CC457EABBB9FF08300F0001D9E94DAA291C7B056E4CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1D40 Relevance: 7.5, APIs: 6, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD1000: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D55), ref: 00DD1066
Part of subcall function 00DD1000: waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD1139
Part of subcall function 00DD1000: waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD114E
Part of subcall function 00DD1000: waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D55), ref: 00DD1163
Part of subcall function 00DD1000: waveOutClose.WINMM(?,?,?,00DD1D55), ref: 00DD116F

Sleep.KERNELBASE(00004E20), ref: 00DD1D5A

Part of subcall function 00DD1190: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,74DF0F00,?,?,00DD1D61), ref: 00DD11F7
Part of subcall function 00DD1190: waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12D4
Part of subcall function 00DD1190: waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12E9
Part of subcall function 00DD1190: waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D61), ref: 00DD12FE
Part of subcall function 00DD1190: waveOutClose.WINMM(?,?,?,00DD1D61), ref: 00DD130A

Sleep.KERNELBASE(00004E20), ref: 00DD1D66

Part of subcall function 00DD1320: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,74DF0F00,?,00DD1D6D), ref: 00DD1386
Part of subcall function 00DD1320: waveOutPrepareHeader.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD1421
Part of subcall function 00DD1320: waveOutWrite.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD1436
Part of subcall function 00DD1320: waveOutUnprepareHeader.WINMM(?,?,00000020,?,00DD1D6D), ref: 00DD144B
Part of subcall function 00DD1320: waveOutClose.WINMM(?,?,00DD1D6D), ref: 00DD1457

Sleep.KERNELBASE(00004E20), ref: 00DD1D72

Part of subcall function 00DD1470: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D79), ref: 00DD14D6
Part of subcall function 00DD1470: waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD1579
Part of subcall function 00DD1470: waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD158E
Part of subcall function 00DD1470: waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D79), ref: 00DD15A3
Part of subcall function 00DD1470: waveOutClose.WINMM(?,?,?,00DD1D79), ref: 00DD15AF

Sleep.KERNELBASE(00004E20), ref: 00DD1D7E

Part of subcall function 00DD15D0: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,74DF0F00,?,?,00DD1D85), ref: 00DD1638
Part of subcall function 00DD15D0: waveOutPrepareHeader.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD1708
Part of subcall function 00DD15D0: waveOutWrite.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD171D
Part of subcall function 00DD15D0: waveOutUnprepareHeader.WINMM(?,?,00000020,?,74DF0F00,?,?,00DD1D85), ref: 00DD1732
Part of subcall function 00DD15D0: waveOutClose.WINMM(?,?,74DF0F00,?,?,00DD1D85), ref: 00DD173E

Sleep.KERNELBASE(00004E20), ref: 00DD1D8A

Part of subcall function 00DD1760: waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000,?,?,00DD1D91), ref: 00DD17C6
Part of subcall function 00DD1760: waveOutPrepareHeader.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD1870
Part of subcall function 00DD1760: waveOutWrite.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD1885
Part of subcall function 00DD1760: waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,00DD1D91), ref: 00DD189A
Part of subcall function 00DD1760: waveOutClose.WINMM(?,?,?,00DD1D91), ref: 00DD18A6

Sleep.KERNEL32(00004E20), ref: 00DD1D96

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareSleepUnprepareWrite
String ID:
API String ID: 1437736867-0
Opcode ID: 8a5636ff8f5a273dc158b6334ebb736020d29dc4a0d0dcfc367f384c9922c1d3
Instruction ID: 13b3663b95100cce5c865ad2c33a76214be6e7db648873dcc24cf8dba4b5783c
Opcode Fuzzy Hash: 8a5636ff8f5a273dc158b6334ebb736020d29dc4a0d0dcfc367f384c9922c1d3
Instruction Fuzzy Hash: 69E04CA8E94BA971F00133F4AE47A1D2D0EEF06B92B140213F750692D21FC8364159FF

Uniqueness

Uniqueness Score: -1.00%

Function 00DD8335 Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DD833E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DD8361

Part of subcall function 00DD675A: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00DDA5F3,?,00000000,?,00DD8FFD,?,00000004,00000000,?,?,?,00DD6425), ref: 00DD678C

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00DD8387
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DD83A9

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap
String ID:
API String ID: 1794362364-0
Opcode ID: 260222b862d5d0d4b44ec8c383ae2255ea9ccdf49d7b23348dac981943b80957
Instruction ID: c74c6f9da0f73c5d1ec4b67b9b8848117a54718c3f8c9011359a977e0087426f
Opcode Fuzzy Hash: 260222b862d5d0d4b44ec8c383ae2255ea9ccdf49d7b23348dac981943b80957
Instruction Fuzzy Hash: F00171B26017557F67227A7AAC88C7B6E6DDBC6FA5318416AF908CA340DE60CC01E1B0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD675A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00DDA5F3,?,00000000,?,00DD8FFD,?,00000004,00000000,?,?,?,00DD6425), ref: 00DD678C

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5a37a26ec81fe2f7ff3f5a1bb3b20e9e0394c81bc077a27c80c29e0ab2944180
Instruction ID: 0ad1ff650f0f4208fe4f5400e1014053bedc65dec7f4290495221e9030476a48
Opcode Fuzzy Hash: 5a37a26ec81fe2f7ff3f5a1bb3b20e9e0394c81bc077a27c80c29e0ab2944180
Instruction Fuzzy Hash: C8E06D3124036A7AEA3137A59C45B9A7ACCDB413BAF190523FC58DAB90DA64EC0182F1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DD7321 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00DD7419
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00DD7423
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00DD7430

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5f9de43eb8c396c593de7b3651c921421a8a6261f226c54d84bd01d2890bedc2
Instruction ID: 32028dee3ee54af5a16b4c66e40e30e02f3ee091e12a5573d7b17edfb7052075
Opcode Fuzzy Hash: 5f9de43eb8c396c593de7b3651c921421a8a6261f226c54d84bd01d2890bedc2
Instruction Fuzzy Hash: 3631B5749012289BCB61DF64D989B9DBBB8EF08310F5041DAE51CA7350E7709F858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4A0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DD4A24

Strings

, xrefs: 00DD4B8B

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 379fb7fd651d0d043293f69abd7cb62989cd3b92ccf5a67e9041adb7ba25d147
Instruction ID: 69b8f5ea2200e7ed445aee301656df4ee19c2689e1081a0909a64a8729ff6a61
Opcode Fuzzy Hash: 379fb7fd651d0d043293f69abd7cb62989cd3b92ccf5a67e9041adb7ba25d147
Instruction Fuzzy Hash: 0D5137729052498FEB64CFA9E88579EBBF4FB48314F19856BD419EB350E3749A00CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DDCC35 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DDCC30,?,?,00000008,?,?,00DDC8D0,00000000), ref: 00DDCE62

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3a5f4188e1d67f3695d1fdd092a2d61036608fd906258d9ae78f8f89c0b03e18
Instruction ID: be7986585404d4c2027d69aab7b24e5a9c56eac8ad5450ecd675074beefc68f4
Opcode Fuzzy Hash: 3a5f4188e1d67f3695d1fdd092a2d61036608fd906258d9ae78f8f89c0b03e18
Instruction Fuzzy Hash: ACB15C7122060A9FD715CF28C48AB647BE1FF45364F298659E8DACF3A1C335D982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DD48F1 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000048FD,00DD4164), ref: 00DD48F6

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 866f232efb5b52d308341698e8f05a9000b44042656667f603d23d5c797037b7
Instruction ID: 6835f4876d13e7fb89d06972e42e9174499039a4e10972be1c158da4cbb17796
Opcode Fuzzy Hash: 866f232efb5b52d308341698e8f05a9000b44042656667f603d23d5c797037b7
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00DD9021 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DD9021

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 212af26a932e0d967e3a725e5990ef5372fd4a68b2a853812866e048446157e4
Instruction ID: 34afa333cd8f9fb644a20798da3ed72ec3660f17abb48de60089f1080c0ddcf9
Opcode Fuzzy Hash: 212af26a932e0d967e3a725e5990ef5372fd4a68b2a853812866e048446157e4
Instruction Fuzzy Hash: 4AA011302023C08B8322AF30BB8830A3BACAA002E03000028A00CCC320EA388080EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2FC0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 213windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD2FE5
GetSystemMetrics.USER32(00000000), ref: 00DD2FF3
GetSystemMetrics.USER32(00000001), ref: 00DD2FFB
GetDC.USER32(00000000), ref: 00DD3003
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD3023
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD303B
CreateCompatibleDC.GDI32 ref: 00DD308A
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD30A8
CreateSolidBrush.GDI32(0000FF00), ref: 00DD30B5
SelectObject.GDI32(?,00000000), ref: 00DD30C6
CreatePen.GDI32(00000000,00000019,00FF00FF), ref: 00DD30D1
SelectObject.GDI32(?,00000000), ref: 00DD30DC
SelectObject.GDI32(?,00000000), ref: 00DD30E3
GetDC.USER32(00000000), ref: 00DD30F2
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD3112
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD3217
Pie.GDI32(?,?,?,?,?,?,?,?,?), ref: 00DD3279
ReleaseDC.USER32(00000000,00000000), ref: 00DD3282
DeleteObject.GDI32(00000000), ref: 00DD3289
Sleep.KERNEL32(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DD3291

Strings

,, xrefs: 00DD3066

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateObject$Select$DisplayEnumMetricsMonitorsSystem$BrushCompatibleDeleteReleaseSectionSleepSolid
String ID: ,
API String ID: 2989342793-3772416878
Opcode ID: 09de5c494be63a69b75b9c45134705389359f259165869b0a2a47998cd4c5b76
Instruction ID: 05578367b69522dc9ee41964c65e82fa12136e12468155a921e31abf1128a2b4
Opcode Fuzzy Hash: 09de5c494be63a69b75b9c45134705389359f259165869b0a2a47998cd4c5b76
Instruction Fuzzy Hash: 09816F75908341ABD310EF719C85B5BBBF4FF89750F104A1DF2849A261D7B0E984CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00DD32A0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 217windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD32BF
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD32E3
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD32FB
CreateCompatibleDC.GDI32 ref: 00DD334A
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD3368
SelectObject.GDI32(?,00000000), ref: 00DD3374
GetDC.USER32(00000000), ref: 00DD3382
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD339D
Sleep.KERNEL32(00000005), ref: 00DD357A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD3599
ReleaseDC.USER32(00000000,?), ref: 00DD35A2
DeleteObject.GDI32(?), ref: 00DD35A9

Strings

,, xrefs: 00DD3326

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 89a95d7373655c8fbab026ac90da74273aec2b072b27578ecf525a0b651abf21
Instruction ID: 6963525ec1745aef83916563ebe1ca6d668066b6690ff4f7c9c22f635fff9f26
Opcode Fuzzy Hash: 89a95d7373655c8fbab026ac90da74273aec2b072b27578ecf525a0b651abf21
Instruction Fuzzy Hash: FD816D71A087819FD311DF24D885B1ABBE5FFC9704F104A2EF585AB350E7B0A985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD25B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 169windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD25CF
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD25F3
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD260B
CreateCompatibleDC.GDI32 ref: 00DD265A
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD2678
SelectObject.GDI32(00000000,00000000), ref: 00DD2684
GetDC.USER32(00000000), ref: 00DD2692
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD26AD
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD27E1
ReleaseDC.USER32(00000000,?), ref: 00DD27EA
DeleteObject.GDI32(?), ref: 00DD27F1
Sleep.KERNEL32(00000019), ref: 00DD27F9

Strings

,, xrefs: 00DD2636

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: af41e8419784b6af4ef19325c5f2a2448ebd51f8f09d336981398ddad5273c20
Instruction ID: 1d570474c57faf0e5a1dae891d74002385cf4f2a217b4606c02976b495ef9228
Opcode Fuzzy Hash: af41e8419784b6af4ef19325c5f2a2448ebd51f8f09d336981398ddad5273c20
Instruction Fuzzy Hash: F9616C71908381AFD310DF64CC85B6BBBE4FF89704F104A1EF585AB251E7B0A885CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00DD35C0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 159windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD35DF
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD3603
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD361B
CreateCompatibleDC.GDI32 ref: 00DD3667
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD3682
SelectObject.GDI32(?,00000000), ref: 00DD368E
GetDC.USER32(00000000), ref: 00DD3696
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD36B1
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD37CC
ReleaseDC.USER32(00000000,?), ref: 00DD37D5
DeleteObject.GDI32(?), ref: 00DD37DC
Sleep.KERNEL32(00000019), ref: 00DD37E4

Strings

,, xrefs: 00DD3646

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 1bc7123a51531baa63b0ba42a880ab33215314189e0f9a5eaa4a58286929cdfa
Instruction ID: 047e1738e796086a887be94b5025cfcd6b416ef8e70085e7b6bb80aa090cd991
Opcode Fuzzy Hash: 1bc7123a51531baa63b0ba42a880ab33215314189e0f9a5eaa4a58286929cdfa
Instruction Fuzzy Hash: 78514A71908381AFD310DF648C85B1BBBF4FF89744F104A1EF584AA391E7B0A585CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2810 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 156windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD282F
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2853
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD286B
CreateCompatibleDC.GDI32 ref: 00DD28B7
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD28D2
SelectObject.GDI32(?,00000000), ref: 00DD28DE
GetDC.USER32(00000000), ref: 00DD28E6
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD2901
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD2A18
ReleaseDC.USER32(00000000,?), ref: 00DD2A21
DeleteObject.GDI32(?), ref: 00DD2A28
Sleep.KERNEL32(00000019), ref: 00DD2A30

Strings

,, xrefs: 00DD2896

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: a108c2e8f04b7ea0659b10d29e0f992dd8776cd2285d665cbdb7b2fb3d4db7a6
Instruction ID: ddf3bdf716f1fc0647728a042cc9ff1a53adf76d2ad51c1e7ecd7e371e291598
Opcode Fuzzy Hash: a108c2e8f04b7ea0659b10d29e0f992dd8776cd2285d665cbdb7b2fb3d4db7a6
Instruction Fuzzy Hash: F3515971948340AFD310DF648C85B6BBBF8EF99754F104A1EF584AA291D7B0A885CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD3AA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 156windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD3ABF
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD3AE3
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD3AFB
CreateCompatibleDC.GDI32 ref: 00DD3B43
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD3B5E
SelectObject.GDI32(00000000,00000000), ref: 00DD3B6A
GetDC.USER32(00000000), ref: 00DD3B72
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD3B8D
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD3CB0
ReleaseDC.USER32(00000000,?), ref: 00DD3CB9
DeleteObject.GDI32(?), ref: 00DD3CC0
Sleep.KERNEL32(00000019), ref: 00DD3CC8

Strings

,, xrefs: 00DD3B22

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 4bb825064c2449bc4f7228a2e27c07df1227f3b69bb10df32cec19a82bfd97dc
Instruction ID: 06d49734195396ade0683de313add0de56ceef8fc2a01d81bd5783f5a6f02da5
Opcode Fuzzy Hash: 4bb825064c2449bc4f7228a2e27c07df1227f3b69bb10df32cec19a82bfd97dc
Instruction Fuzzy Hash: CE515E71908340AFD310DF64DC85B6BBBF4FF89744F104A1EF584AA261E770A585CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1DA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 153windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD1DBF
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD1DE3
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD1DFB
CreateCompatibleDC.GDI32 ref: 00DD1E4A
CreateDIBSection.GDI32(00000000,00200001,00000000,?,00000000,00000000), ref: 00DD1E6A
SelectObject.GDI32(00000000,00000000), ref: 00DD1E72
GetDC.USER32(00000000), ref: 00DD1E82
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD1EA2
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD1FAE
ReleaseDC.USER32(00000000,00000000), ref: 00DD1FB7
DeleteObject.GDI32(00000000), ref: 00DD1FBE
Sleep.KERNEL32(00000019), ref: 00DD1FC6

Strings

,, xrefs: 00DD1E26

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: f25b671f15ab7031c1fef8a0c0e2f063c21ed65dd6e67e4b40ead42a91705cf6
Instruction ID: a26335f0a71a74e912bc555aca921ad29ce2e1e2c195e0d2de2c2cc5a726e695
Opcode Fuzzy Hash: f25b671f15ab7031c1fef8a0c0e2f063c21ed65dd6e67e4b40ead42a91705cf6
Instruction Fuzzy Hash: C4515D71908784AFD310DF648C85B5BBBF4FF89754F144A1EF584AA390E7B0A584CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2200 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 153windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD221F
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2243
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD225B
CreateCompatibleDC.GDI32 ref: 00DD22A7
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD22C2
SelectObject.GDI32(00000000,00000000), ref: 00DD22CE
GetDC.USER32(00000000), ref: 00DD22D6
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD22F1
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD23F5
ReleaseDC.USER32(00000000,?), ref: 00DD23FE
DeleteObject.GDI32(?), ref: 00DD2405
Sleep.KERNEL32(00000019), ref: 00DD240D

Strings

,, xrefs: 00DD2286

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 5432700798eb29220ae3699a883d485ec9ab031630d57b0195195398e21dad64
Instruction ID: 7d60e8c408a4831cbb4762904d7a7c7de5a39bb2d0605deddbe247840d758bb2
Opcode Fuzzy Hash: 5432700798eb29220ae3699a883d485ec9ab031630d57b0195195398e21dad64
Instruction Fuzzy Hash: FD514B71908381AFD310DF648C85B6BBBF4FF99744F104A1EF584AA291D7B0A985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2BD0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 153windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD2BEF
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD2C13
EnumDisplayMonitors.USER32(00000000,00000000,00DD18C0,?), ref: 00DD2C2B
CreateCompatibleDC.GDI32 ref: 00DD2C74
CreateDIBSection.GDI32(00000000,00200001,00000000,?,00000000,00000000), ref: 00DD2C91
SelectObject.GDI32(00000000,00000000), ref: 00DD2C99
GetDC.USER32(00000000), ref: 00DD2CA5
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD2CC5
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00DD2DC7
ReleaseDC.USER32(00000000,00000000), ref: 00DD2DD0
DeleteObject.GDI32(00000000), ref: 00DD2DD7
Sleep.KERNEL32(00000019), ref: 00DD2DDF

Strings

,, xrefs: 00DD2C53

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: 60e3107502bf60bfe59787980335d831c3dca57946bd37d94ea826b22728ee23
Instruction ID: b88ad9520fd0f9a46c13f5e9421e83a3119c423e3820b69e99977a7c5cfc592c
Opcode Fuzzy Hash: 60e3107502bf60bfe59787980335d831c3dca57946bd37d94ea826b22728ee23
Instruction Fuzzy Hash: 63517E71918381AFD310DF748C85B1BBBE4FF99744F104A1EF584AA390E7B0A884CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DD1FE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 152windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD1FFF
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD2023
EnumDisplayMonitors.USER32(00000000,00000000,Function_000018C0,?), ref: 00DD203B
CreateCompatibleDC.GDI32 ref: 00DD2087
CreateDIBSection.GDI32(00000000,00200001,00000000,0000002C,00000000,00000000), ref: 00DD20A2
SelectObject.GDI32(00000000,00000000), ref: 00DD20AE
GetDC.USER32(00000000), ref: 00DD20B6
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD20D1
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00DD21D4
ReleaseDC.USER32(00000000,?), ref: 00DD21DD
DeleteObject.GDI32(?), ref: 00DD21E4
Sleep.KERNEL32(00000019), ref: 00DD21EC

Strings

,, xrefs: 00DD2066

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDisplayEnumMonitorsObject$CompatibleDeleteReleaseSectionSelectSleep
String ID: ,
API String ID: 656003498-3772416878
Opcode ID: a9c3588a775c9f3fb3674b4617209434b458de1ce1e4fb8ec6b90c9e93c897a5
Instruction ID: 0e25a604d73c8e349aa8d4c3fb2255ddb9020e4d14371b1294ae9bdab16309ee
Opcode Fuzzy Hash: a9c3588a775c9f3fb3674b4617209434b458de1ce1e4fb8ec6b90c9e93c897a5
Instruction Fuzzy Hash: A4516C71908381AFD310DF648C85B6BBBF4FF99744F104A1EF584AB291D7B0A585CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDABAF Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DDB324,?,00000000,?,00000000,00000000), ref: 00DDABF1
__fassign.LIBCMT ref: 00DDAC6C
__fassign.LIBCMT ref: 00DDAC87
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00DDACAD
WriteFile.KERNEL32(?,?,00000000,00DDB324,00000000,?,?,?,?,?,?,?,?,?,00DDB324,?), ref: 00DDACCC
WriteFile.KERNEL32(?,?,00000001,00DDB324,00000000,?,?,?,?,?,?,?,?,?,00DDB324,?), ref: 00DDAD05

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 335b355fd9371a62c42cd471875f14d00cae5383b68ecb3655fd55fafbf335e0
Instruction ID: 8999f6587689064881b42c0ae2aae4e0c56e6261c761c959a5480757870d8fd7
Opcode Fuzzy Hash: 335b355fd9371a62c42cd471875f14d00cae5383b68ecb3655fd55fafbf335e0
Instruction Fuzzy Hash: 8E519D71A002499FCB10CFA8D885AEEBBF9EF09310F14815BE955EB391E770A941CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA343 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00DD81DF,00000000,?,?,?,00DDA594,?,?,00000100), ref: 00DDA39D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00DDA594,?,?,00000100,5EFC4D8B,?,?), ref: 00DDA423
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DDA51D
__freea.LIBCMT ref: 00DDA52A

Part of subcall function 00DD675A: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00DDA5F3,?,00000000,?,00DD8FFD,?,00000004,00000000,?,?,?,00DD6425), ref: 00DD678C

__freea.LIBCMT ref: 00DDA533
__freea.LIBCMT ref: 00DDA558

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 57779350f8e0191df7fba8f8b5dd3928c965afec1b6a8d7e60e52330ca0d2ccc
Instruction ID: f62ba014a22abae751c337b5a70582a3967dcbdf5ee41790e383bde1082e947d
Opcode Fuzzy Hash: 57779350f8e0191df7fba8f8b5dd3928c965afec1b6a8d7e60e52330ca0d2ccc
Instruction Fuzzy Hash: 0B51E472610216ABDB259F68EC41EBF77A9EB84750F19862BFC04D6340EB74DC40C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DD56F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00DD56A8,00000003,?,00DD5648,00000003,00DE5DF8,0000000C,00DD579F,00000003,00000002), ref: 00DD5717
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DD572A
FreeLibrary.KERNEL32(00000000,?,?,?,00DD56A8,00000003,?,00DD5648,00000003,00DE5DF8,0000000C,00DD579F,00000003,00000002,00000000), ref: 00DD574D

Strings

CorExitProcess, xrefs: 00DD5722
mscoree.dll, xrefs: 00DD5710

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9b061b876fbc9ba8474885f6733ef559380dbf68150bef8f3402a6855367a1ea
Instruction ID: 864f9c3c506f3a5eba3c68a3e899200c7bb5045c5b8c93e2aa8de965cf633c07
Opcode Fuzzy Hash: 9b061b876fbc9ba8474885f6733ef559380dbf68150bef8f3402a6855367a1ea
Instruction Fuzzy Hash: 78F03130A40348FBCB11AF91EC89BAD7FB9EB04751F144069B909EA350DBB05E84DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DD8ADB Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,00DD81DF,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 00DD8B28
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DD8BB1
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00DD8BC3
__freea.LIBCMT ref: 00DD8BCC

Part of subcall function 00DD675A: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00DDA5F3,?,00000000,?,00DD8FFD,?,00000004,00000000,?,?,?,00DD6425), ref: 00DD678C

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 983b2b20eef72fa1d1dce3c143457e068ca6563d8af22439f2618684fb3fd516
Instruction ID: c0dfd997ab783584dd3c003b437b2b78a2751650aed913c4dbe319e453561616
Opcode Fuzzy Hash: 983b2b20eef72fa1d1dce3c143457e068ca6563d8af22439f2618684fb3fd516
Instruction Fuzzy Hash: F231B2B1A0020AABDF269F64CC81DAE7BA5EB40710B1A016AFC04DB350EB35DD51DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD6A61 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00DD6A08,00000000,00000000,00000000,00000000,?,00DD6C05,00000006,FlsSetValue), ref: 00DD6A93
GetLastError.KERNEL32(?,0000000A,00000000), ref: 00DD6A9F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0000000A,00000000), ref: 00DD6AAD

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 806f96ca94ba7f74895f62d23641c620cd29171f8d673ab756f2074ef8755067
Instruction ID: ab3b55a2e31d28331061a09233aae63ed32f1c0ca68d1cf87f4aec4b0d4731e3
Opcode Fuzzy Hash: 806f96ca94ba7f74895f62d23641c620cd29171f8d673ab756f2074ef8755067
Instruction Fuzzy Hash: DD01FC36651373ABC7219A689C84E567B58EF05760B159521F986EB340E760D800CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD71D2 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,00000000,00DD57F7,00DD1C9B), ref: 00DD71D6
SetLastError.KERNEL32(00000000), ref: 00DD723E
SetLastError.KERNEL32(00000000), ref: 00DD724A
_abort.LIBCMT ref: 00DD7250

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: e737d843b0d10be16a25f93f23a741d3963682c72ab4f1620c5a051c43846d81
Instruction ID: 60dc37cb733e1a2483f199454066ae5a722a36d7500d7566c6bd8aa31f575080
Opcode Fuzzy Hash: e737d843b0d10be16a25f93f23a741d3963682c72ab4f1620c5a051c43846d81
Instruction Fuzzy Hash: 59F0C23624878167C2523724AC4AF1A2E2ADFC2779F290097F918EA3D1FE74CC0291F4

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4D66 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00DD4D66
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00DD4D6B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00DD4D70

Part of subcall function 00DD50D8: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00DD50E9

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00DD4D85

Memory Dump Source

Source File: 00000000.00000002.1766731301.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.1766717441.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766746946.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766762450.0000000000DE7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000DF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766775912.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 42cfafaaf29d4f7fdf202ad325c91aa28037371ee4c1ad4e7deb3511513870bf
Instruction ID: 398ff9b04ffd029c61ae5e7eb2442f1781412f416fc28e49866ff0df4cc0cefe
Opcode Fuzzy Hash: 42cfafaaf29d4f7fdf202ad325c91aa28037371ee4c1ad4e7deb3511513870bf
Instruction Fuzzy Hash: 13C04818004F00EA6CA03AF076136BD1712CC62BC5B9C64C7B8921BB1F8EA6440BA8B2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: SecuriteInfo.com.W32.PossibleThreat.32545.23667.exePID: 7000, Parent PID: 2580

General

File Activities

File Opened

File Read

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Registry Activities

Key Opened

Key Value Queried

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.32545.23667.exe

Function 00DD2DF0 Relevance: 25.7, APIs: 17, Instructions: 153
windowsleepCOMMON

Function 00DD5672 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 00DD3CE0 Relevance: 138.6, APIs: 75, Strings: 4, Instructions: 326
threadsleepwindowCOMMON

Function 00DD2420 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 126
windowsleepCOMMON

Function 00DD2A40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 124
windowsleepCOMMON

Function 00DD1BD0 Relevance: 18.1, APIs: 12, Instructions: 105
sleepwindowCOMMON

Function 00DD15D0 Relevance: 7.6, APIs: 5, Instructions: 98
COMMON

Function 00DD1190 Relevance: 7.6, APIs: 5, Instructions: 96
COMMON

Function 00DD1000 Relevance: 7.6, APIs: 5, Instructions: 92
COMMON

Function 00DD1470 Relevance: 7.6, APIs: 5, Instructions: 80
COMMON

Function 00DD1760 Relevance: 7.6, APIs: 5, Instructions: 79
COMMON

Function 00DD1320 Relevance: 7.6, APIs: 5, Instructions: 76
COMMON

Function 00DD1D40 Relevance: 7.5, APIs: 6, Instructions: 26
sleepCOMMON

Function 00DD8335 Relevance: 6.1, APIs: 4, Instructions: 68
COMMON