Edit tour

Windows Analysis Report
SecuriteInfo.com.FileRepMalware.15071.2577.exe

Overview

General Information

Sample name:	SecuriteInfo.com.FileRepMalware.15071.2577.exe
Analysis ID:	1379489
MD5:	4fde8f742e26e3b29dfaecd985385ad1
SHA1:	cf77208b231c723a598e8a053700523ecbdd4d1d
SHA256:	40d6daf0fc26ff5469520993d31e37bcb3c342a3103e2f79a5ddc7322ca84596
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

SecuriteInfo.com.FileRepMalware.15071.2577.exe (PID: 7088 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe MD5: 4FDE8F742E26E3B29DFAECD985385AD1)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://dotdo.net/chkn.php?n=4528372SS	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=2	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=26	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=4528372pData	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=4	Avira URL Cloud: Label: malware
Source: http://dotdo.net/m	Avira URL Cloud: Label: malware
Source: http://dotdo.net/	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=4528372%R3	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=4528372UR	Avira URL Cloud: Label: malware
Source: http://dotdo.net/chkn.php?n=4528372	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: dotdo.net	Virustotal: Detection: 10%			Perma Link
Source: http://dotdo.net/	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	ReversingLabs: Detection: 24%
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	Virustotal: Detection: 30%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_00406268 FindFirstFileA,FindClose,	0_2_00406268
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_0040572D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040572D
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_004026F8 FindFirstFileA,	0_2_004026F8

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /chkn.php?n=4528372 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: dotdo.netConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: dotdo.net

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991932677.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991394447.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=2
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=26
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4528372
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4528372%R3
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4528372SS
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4528372UR
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/chkn.php?n=4528372pData
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dotdo.net/m
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Code function: 0_2_004051CA GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004051CA

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Code function: 0_2_004031F1 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004031F1

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_00406742	0_2_00406742
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_00404A09	0_2_00404A09
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_00406F19	0_2_00406F19

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinetc.dllF vs SecuriteInfo.com.FileRepMalware.15071.2577.exe
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinetc.dllF vs SecuriteInfo.com.FileRepMalware.15071.2577.exe

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.winEXE@1/1@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

0_2_004031F1

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Code function: 0_2_00404496 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404496

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Code function: 0_2_004020CB CoCreateInstance,MultiByteToWideChar,

0_2_004020CB

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

File created: C:\Users\user\Desktop\ok.txt

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

File created: C:\Users\user\AppData\Local\Temp\nsf63F.tmp

Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	ReversingLabs: Detection: 24%
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe	Virustotal: Detection: 30%

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

File created: C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_00406268 FindFirstFileA,FindClose,	0_2_00406268
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_0040572D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040572D
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe	Code function: 0_2_004026F8 FindFirstFileA,	0_2_004026F8

Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991932677.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991932677.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

API call chain: ExitProcess graph end node

graph_0-3010

Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

0_2_004031F1

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Access Token Manipulation	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.FileRepMalware.15071.2577.exe	24%	ReversingLabs	Win32.Adware.RedCap
SecuriteInfo.com.FileRepMalware.15071.2577.exe	30%	Virustotal		Browse
SecuriteInfo.com.FileRepMalware.15071.2577.exe	100%	Avira	HEUR/AGEN.1345555
SecuriteInfo.com.FileRepMalware.15071.2577.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dotdo.net	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://dotdo.net/chkn.php?n=4528372SS	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=2	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=26	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=4528372pData	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=4	100%	Avira URL Cloud	malware
http://dotdo.net/m	100%	Avira URL Cloud	malware
http://dotdo.net/	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=4528372%R3	100%	Avira URL Cloud	malware
http://dotdo.net/chkn.php?n=4528372UR	100%	Avira URL Cloud	malware
http://dotdo.net/	11%	Virustotal		Browse
http://dotdo.net/chkn.php?n=4528372	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dotdo.net	23.106.59.18	true	false	11%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://dotdo.net/chkn.php?n=4528372	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dotdo.net/chkn.php?n=4528372SS	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/chkn.php?n=26	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_Error	SecuriteInfo.com.FileRepMalware.15071.2577.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.FileRepMalware.15071.2577.exe	false		high
http://dotdo.net/chkn.php?n=2	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/chkn.php?n=4528372pData	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/chkn.php?n=4	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991839207.0000000000768000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/m	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991932677.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991394447.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://dotdo.net/chkn.php?n=4528372%R3	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dotdo.net/chkn.php?n=4528372UR	SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000002.1991885606.000000000079C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.15071.2577.exe, 00000000.00000003.1991326426.000000000079C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.106.59.18	dotdo.net	United Kingdom		205544	LEASEWEB-UK-LON-11GB	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1379489
Start date and time:	2024-01-23 13:42:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.FileRepMalware.15071.2577.exe
Detection:	MAL
Classification:	mal76.winEXE@1/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 27 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEASEWEB-UK-LON-11GB	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	23.106.59.52
	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse	23.106.59.52
	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse	23.106.59.52
	5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe	Get hash	malicious	NetSupport RAT	Browse	23.106.59.52

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll	PmRXFyOFkf.exe	Get hash	malicious	GuLoader	Browse
	PmRXFyOFkf.exe	Get hash	malicious	Unknown	Browse
	SetupFA.exe	Get hash	malicious	Unknown	Browse
	https://veryfast.io/downloading.html	Get hash	malicious	Unknown	Browse
	Setup 2.exe	Get hash	malicious	Unknown	Browse
	SetupFA.exe	Get hash	malicious	Unknown	Browse
	Ace_Stream_Media_3.1.32.exe	Get hash	malicious	Unknown	Browse
	KO7UuzwSSQ.exe	Get hash	malicious	Unknown	Browse
	SetupFA.exe	Get hash	malicious	Unknown	Browse
	webExt_DL.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: PmRXFyOFkf.exe, Detection: malicious, Browse Filename: PmRXFyOFkf.exe, Detection: malicious, Browse Filename: SetupFA.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Setup 2.exe, Detection: malicious, Browse Filename: SetupFA.exe, Detection: malicious, Browse Filename: Ace_Stream_Media_3.1.32.exe, Detection: malicious, Browse Filename: KO7UuzwSSQ.exe, Detection: malicious, Browse Filename: SetupFA.exe, Detection: malicious, Browse Filename: webExt_DL.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.883932676096237
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.FileRepMalware.15071.2577.exe
File size:	48'620 bytes
MD5:	4fde8f742e26e3b29dfaecd985385ad1
SHA1:	cf77208b231c723a598e8a053700523ecbdd4d1d
SHA256:	40d6daf0fc26ff5469520993d31e37bcb3c342a3103e2f79a5ddc7322ca84596
SHA512:	1466dbecad6c438c88b4204361723cf3a1ab60095a07ce21546d912142af1c0e365222a11b90b48a70127ecfbdb15dcb5cef4e1ddd53ee38601280b42171d25a
SSDEEP:	768:Nnnw4xRMjJ8FBDOLQmzPjhAVHx10Z0D3yuInmBd0cJbZod4KRxurgNs3d5xM+Ts5:lnw8RSijDtSA5xeZ0DbBCcJbzRQsN5xI
TLSH:	A323AD1737A0D8F7D47203B00E7AAB2BEFFA861811956B4B57841F56BD23582462F387
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L...z..Y.................d...\|.....

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4031f1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x597FCC7A [Tue Aug 1 00:34:02 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3abe302b6d9a1256e6a915429af4ffd2

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080A0h]
call dword ptr [0040809Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042F40Ch], eax
je 00007F5D38FA9A03h
push ebx
call 00007F5D38FACABAh
cmp eax, ebx
je 00007F5D38FA99F9h
push 00000C00h
call eax
mov esi, 00408298h
push esi
call 00007F5D38FACA36h
push esi
call dword ptr [00408098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F5D38FA99DDh
push 0000000Ah
call 00007F5D38FACA8Eh
push 00000008h
call 00007F5D38FACA87h
push 00000006h
mov dword ptr [0042F404h], eax
call 00007F5D38FACA7Bh
cmp eax, ebx
je 00007F5D38FA9A01h
push 0000001Eh
call eax
test eax, eax
je 00007F5D38FA99F9h
or byte ptr [0042F40Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [00408288h]
mov dword ptr [0042F4D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00429830h
call dword ptr [00408178h]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8534	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f000	0xa50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6254	0x6400	d550b03059038df9bf82548da8080ff6	False	0.6676171875	data	6.4338643172916266	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1354	0x1400	5143a41b917c20afc11d259fd85b6ffc	False	0.4599609375	data	5.236269898436511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x25518	0x600	4c97d95c0fc95b712d16eb7b0ee5a871	False	0.4557291666666667	data	4.044625496015545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x30000	0xf000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3f000	0xa50	0xc00	5bfda947161c3b71f20623138f0170d9	False	0.40234375	data	4.187622894680572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3f190	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x3f478	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3f578	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3f698	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3f6f8	0x14	data	English	United States	1.2
RT_MANIFEST	0x3f710	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2024 13:42:55.179413080 CET	49705	80	192.168.2.5	23.106.59.18
Jan 23, 2024 13:42:55.381151915 CET	80	49705	23.106.59.18	192.168.2.5
Jan 23, 2024 13:42:55.381269932 CET	49705	80	192.168.2.5	23.106.59.18
Jan 23, 2024 13:42:55.381587029 CET	49705	80	192.168.2.5	23.106.59.18
Jan 23, 2024 13:42:55.600811958 CET	80	49705	23.106.59.18	192.168.2.5
Jan 23, 2024 13:42:55.601082087 CET	49705	80	192.168.2.5	23.106.59.18
Jan 23, 2024 13:42:55.706619024 CET	49705	80	192.168.2.5	23.106.59.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2024 13:42:54.974947929 CET	50893	53	192.168.2.5	1.1.1.1
Jan 23, 2024 13:42:55.151702881 CET	53	50893	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2024 13:42:54.974947929 CET	192.168.2.5	1.1.1.1	0x45a3	Standard query (0)	dotdo.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2024 13:42:55.151702881 CET	1.1.1.1	192.168.2.5	0x45a3	No error (0)	dotdo.net		23.106.59.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dotdo.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	23.106.59.18	80	7088	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 13:42:55.381587029 CET	136	OUT	GET /chkn.php?n=4528372 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: dotdo.net Connection: Keep-Alive Cache-Control: no-cache
Jan 23, 2024 13:42:55.600811958 CET	254	IN	HTTP/1.1 200 OK Date: Tue, 23 Jan 2024 12:42:53 GMT Server: Apache/2.2.22 (Win64) mod_ssl/2.2.22 OpenSSL/1.0.1c PHP/5.3.13 X-Powered-By: PHP/5.3.13 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html

Target ID:	0
Start time:	13:42:53
Start date:	23/01/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe
Imagebase:	0x400000
File size:	48'620 bytes
MD5 hash:	4FDE8F742E26E3B29DFAECD985385AD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.2%
Total number of Nodes:	1269
Total number of Limit Nodes:	31

Executed Functions

Function 004031F1 Relevance: 89.6, APIs: 34, Strings: 17, Instructions: 368
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00403216
GetVersion.KERNEL32 ref: 0040321C
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040324F
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040328B
OleInitialize.OLE32(00000000), ref: 00403292
SHGetFileInfoA.SHELL32(00429830,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 004032AE
GetCommandLineA.KERNEL32(update Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004032C3
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",00000000,?,00000006,00000008,0000000A), ref: 004032D6
CharNextA.USER32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",00000020,?,00000006,00000008,0000000A), ref: 00403301
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 004033FE
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 0040340F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 0040341B
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 0040342F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403437
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403448
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403450
DeleteFileA.KERNEL32(1033,?,00000006,00000008,0000000A), ref: 00403464

Part of subcall function 004062FD: GetModuleHandleA.KERNEL32(?,?,?,00403264,0000000A), ref: 0040630F
Part of subcall function 004062FD: GetProcAddress.KERNEL32(00000000,?), ref: 0040632A

Part of subcall function 00405F65: lstrcpynA.KERNEL32(?,?,00000400,004032C3,update Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F72

Part of subcall function 004037B5: GetUserDefaultUILanguage.KERNEL32(00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",00000000), ref: 004037CF
Part of subcall function 004037B5: lstrlenA.KERNEL32(get,?,?,?,get,00000000,00435400,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 004038A5
Part of subcall function 004037B5: lstrcmpiA.KERNEL32(?,.exe), ref: 004038B8
Part of subcall function 004037B5: GetFileAttributesA.KERNEL32(get), ref: 004038C3
Part of subcall function 004037B5: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00435400), ref: 0040390C
Part of subcall function 004037B5: RegisterClassA.USER32(0042EBA0), ref: 00403949

ExitProcess.KERNEL32(?,?,00000006,00000008,0000000A), ref: 0040350D

Part of subcall function 004036DB: CloseHandle.KERNEL32(FFFFFFFF,00403512,?,?,00000006,00000008,0000000A), ref: 004036E6

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 00403512
ExitProcess.KERNEL32 ref: 00403533
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403650
OpenProcessToken.ADVAPI32(00000000), ref: 00403657
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040366F
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 0040368E
ExitWindowsEx.USER32(00000002,80040002), ref: 004036B2
ExitProcess.KERNEL32 ref: 004036D5

Part of subcall function 00405681: MessageBoxIndirectA.USER32(0040A218), ref: 004056DC

Strings

1033, xrefs: 0040345F
\Temp, xrefs: 00403415
C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe, xrefs: 004035F0
update Setup, xrefs: 004032B9
C:\Users\user\AppData\Local\Temp\, xrefs: 004033F3, 004033F8, 0040340E, 0040341A, 00403429, 00403436, 00403442, 0040344A, 00403543, 00403554, 0040355F, 0040356B, 00403578, 00403587, 00403636
~nsu, xrefs: 0040353E
Error launching installer, xrefs: 004034CA
TMP, xrefs: 0040344B
C:\Users\user\Desktop, xrefs: 00403565, 0040356A, 00403596
TEMP, xrefs: 00403443
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 004032C9, 004032CF, 00403488
NSIS Error, xrefs: 004032B4
SeShutdownPrivilege, xrefs: 00403669
.tmp, xrefs: 0040355A
Low, xrefs: 00403431
", xrefs: 00403326
UXTHEME, xrefs: 00403243, 00403248, 0040324E

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$Exit$FileHandle$EnvironmentModulePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDefaultDeleteDirectoryErrorImageIndirectInfoInitializeLanguageLineLoadLookupMessageModeNextOpenPrivilegePrivilegesProcRegisterUninitializeUserValueVersionlstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$update Setup$~nsu
API String ID: 3861850387-507022447
Opcode ID: a934492e7eb9864df341da432a3e1cc9575c5f809a7bed8d112cb4b01729c0eb
Instruction ID: 41c275c355797b12fd9b138c60a2ad170ddd3a1f93bd6a9867a2704463122372
Opcode Fuzzy Hash: a934492e7eb9864df341da432a3e1cc9575c5f809a7bed8d112cb4b01729c0eb
Instruction Fuzzy Hash: 0DC1E470604741AAD7216F759E49B2F3EACAF45706F44053FF581B61E2CB7C8A098B2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040572D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405756
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040579E
lstrcatA.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057BF
lstrlenA.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057C5
FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057D6
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405883
FindClose.KERNEL32(00000000), ref: 00405894

Strings

\*.*, xrefs: 00405798
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 0040572D
C:\Users\user\AppData\Local\Temp\, xrefs: 0040573A
C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*, xrefs: 00405786, 0040578C, 0040579D, 004057D3

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsf640.tmp\*.*$\*.*
API String ID: 2035342205-2086002146
Opcode ID: 5a75186390c9518ef53bc7868eb0b51ef72d35058a64af47be824dbaeb8436d1
Instruction ID: 2a0351abb2716448ee460da7bfccfa5d3c7c3698b554042fcfc8e424752a7a40
Opcode Fuzzy Hash: 5a75186390c9518ef53bc7868eb0b51ef72d35058a64af47be824dbaeb8436d1
Instruction Fuzzy Hash: 2551B132900A04AAEF217B268C45FBF7A78DF42754F14817BF841B61D1D73C8952DEA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(75923410,0042C0C0,C:\,00405A2E,C:\,C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00406273
FindClose.KERNEL32(00000000), ref: 0040627F

Strings

C:\, xrefs: 00406268

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: f33084ac43254253387421f94672507a8f359bb84d60abe7f61aad8f4daa312f
Instruction ID: e0279db6a2f9a876ecb4b02bc738002a428a13ad585e0dc9357aaf1afb57e826
Opcode Fuzzy Hash: f33084ac43254253387421f94672507a8f359bb84d60abe7f61aad8f4daa312f
Instruction Fuzzy Hash: 9DD012365060209FC25027786D0C85B7A589F053317118B7FF8AAF21E0C7348CA386DC

Uniqueness

Uniqueness Score: -1.00%

Function 004037B5 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FD: GetModuleHandleA.KERNEL32(?,?,?,00403264,0000000A), ref: 0040630F
Part of subcall function 004062FD: GetProcAddress.KERNEL32(00000000,?), ref: 0040632A

GetUserDefaultUILanguage.KERNEL32(00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",00000000), ref: 004037CF

Part of subcall function 00405EC3: wsprintfA.USER32 ref: 00405ED0

lstrcatA.KERNEL32(1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",00000000), ref: 00403830
lstrlenA.KERNEL32(get,?,?,?,get,00000000,00435400,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 004038A5
lstrcmpiA.KERNEL32(?,.exe), ref: 004038B8
GetFileAttributesA.KERNEL32(get), ref: 004038C3
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00435400), ref: 0040390C
RegisterClassA.USER32(0042EBA0), ref: 00403949
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403961
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403996
ShowWindow.USER32(00000005,00000000), ref: 004039CC
GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 004039F8
GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403A05
RegisterClassA.USER32(0042EBA0), ref: 00403A0E
DialogBoxParamA.USER32(?,00000000,00403B52,00000000), ref: 00403A2D

Strings

1033, xrefs: 004037D5, 0040382B
RichEdit, xrefs: 004039FF
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 004037B9
C:\Users\user\AppData\Local\Temp\, xrefs: 004037BA
RichEdit20A, xrefs: 004039F0, 004039F6
RichEd20, xrefs: 004039D2
get, xrefs: 00403873, 0040387B, 00403888, 004038A4, 004038C2, 004038D2, 004038D8
RichEd32, xrefs: 004039E0
.exe, xrefs: 004038B2
_Nb, xrefs: 00403928, 00403990
Control Panel\Desktop\ResourceLocale, xrefs: 004037E9
.DEFAULT\Control Panel\International, xrefs: 0040381B

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$get
API String ID: 606308-1916490003
Opcode ID: e7acd2a6494bceed2f0d1790c8c795125d1bc5b972d8e893fdd29642874af84d
Instruction ID: cf57693f3f88dc886a5042f17341946b18930627488d4c28d640959b633c26bb
Opcode Fuzzy Hash: e7acd2a6494bceed2f0d1790c8c795125d1bc5b972d8e893fdd29642874af84d
Instruction Fuzzy Hash: 3E61D770240600AED620BB669D45F373EACEB44749F40447EF985B22E2DB7C9D029A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D48 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D59
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,00000400), ref: 00402D75

Part of subcall function 00405AFE: GetFileAttributesA.KERNEL32(00000003,00402D88,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 00405B02
Part of subcall function 00405AFE: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B24

GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 00402DC1

Strings

C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe, xrefs: 00402D5F, 00402D6E, 00402D82, 00402DA2
C:\Users\user\Desktop, xrefs: 00402DA3, 00402DA8, 00402DAE
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 00402D48
soft, xrefs: 00402E36
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D4F
Error launching installer, xrefs: 00402D98
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F20
Inst, xrefs: 00402E2D
Null, xrefs: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3276705621
Opcode ID: 3d8226c6182f45256fef3b08a8e24db4a20154253ee5507602079156fa8385bc
Instruction ID: b7ea9236aecaa86e611592eb70b2ed5589fa10121b1bd9207fea2451aa196312
Opcode Fuzzy Hash: 3d8226c6182f45256fef3b08a8e24db4a20154253ee5507602079156fa8385bc
Instruction Fuzzy Hash: 9D51F431A00215ABDB20AF64DE89B9F7BB8FB14358F50413BE504B72D1C7B88D858B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F81 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402FE8
GetTickCount.KERNEL32 ref: 0040308F
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 004030B8
wsprintfA.USER32 ref: 004030C8

Strings

(TA, xrefs: 00403142
(A, xrefs: 0040306C, 00403087, 004030FE
... %d%%, xrefs: 004030C2
(TA, xrefs: 0040303E

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: (TA$(TA$(A$... %d%%
API String ID: 551687249-3855943882
Opcode ID: 219cae2b91f3bf38bad7132d0a8990421fc9c3883ef73589e1e6bd7f052db87f
Instruction ID: f4b3021151c61e236b0315b1fcc5adb3b60be84788d5942dbd3e7f3cce39453d
Opcode Fuzzy Hash: 219cae2b91f3bf38bad7132d0a8990421fc9c3883ef73589e1e6bd7f052db87f
Instruction Fuzzy Hash: 86517D71900219EBDB10DF65DA4469E7BB8EF48356F14853BE800BB2D0C7789E41CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,get,00435800,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00435800,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405F65: lstrcpynA.KERNEL32(?,?,00000400,004032C3,update Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F72

Part of subcall function 0040508C: lstrlenA.KERNEL32(0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000,?), ref: 004050C5
Part of subcall function 0040508C: lstrlenA.KERNEL32(004030DC,0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000), ref: 004050D5
Part of subcall function 0040508C: lstrcatA.KERNEL32(0042A050,004030DC,004030DC,0042A050,00000000,0041EA28,759223A0), ref: 004050E8
Part of subcall function 0040508C: SetWindowTextA.USER32(0042A050,0042A050), ref: 004050FA
Part of subcall function 0040508C: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405120
Part of subcall function 0040508C: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513A
Part of subcall function 0040508C: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405148

Strings

get, xrefs: 00401775, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll, xrefs: 00401826, 00401842

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll$get
API String ID: 1941528284-2348429422
Opcode ID: d5b44f832fdb25be28d2b543a9b61bfb24a32d76e5489e3aa463aebb2df8a026
Instruction ID: 024705dcfdf044f05b4b82656432081f20986447a00b4521f0a60d415ab43704
Opcode Fuzzy Hash: d5b44f832fdb25be28d2b543a9b61bfb24a32d76e5489e3aa463aebb2df8a026
Instruction Fuzzy Hash: 4841B431A04515BECB107BB58C45EAF3679EF05369F60833BF421F20E1D67C89428A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405552 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405595
GetLastError.KERNEL32 ref: 004055A9
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004055BE
GetLastError.KERNEL32 ref: 004055C8

Strings

C:\Users\user\Desktop, xrefs: 00405552
C:\Users\user\AppData\Local\Temp\, xrefs: 00405578

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1521822154
Opcode ID: 5ed0d1f38f2075833211856a8ebf7d2689aced5b3dcb66e6179e3f4d9a7ce916
Instruction ID: d93b5df8f7ffc7c008eac1e7bdc238e6dcac3e6f5ce479452586b7e310885e58
Opcode Fuzzy Hash: 5ed0d1f38f2075833211856a8ebf7d2689aced5b3dcb66e6179e3f4d9a7ce916
Instruction Fuzzy Hash: 550108B1C00219EADF11DBA1CD047EFBFB9EF04354F00803AD545B6290D77896088FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040628F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062A6
wsprintfA.USER32 ref: 004062DF
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 004062F3

Strings

\, xrefs: 004062B7
%s%s.dll, xrefs: 004062D9
UXTHEME, xrefs: 00406298

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction ID: 90c405808a5079913e9fc86ee6967ca4c100a0af48b71fe7beb271d56a4ee20c
Opcode Fuzzy Hash: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction Fuzzy Hash: 89F0F630510609AADB15AB64DD0DFEB365CAB08304F1405BEA686F11C1EA78E9398B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405B2D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405B41
GetTempFileNameA.KERNEL32(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405B5B

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 00405B2D
nsa, xrefs: 00405B38
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B30

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1723881821
Opcode ID: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction ID: 439a7608ba980c1fff97265348ba0c774925dff8d33d3cb941cf273fff524f8a
Opcode Fuzzy Hash: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction Fuzzy Hash: B0F082363042086BDB108F66DD04B9B7BA9DF91750F14803BFA48AA280D6B4E9588799

Uniqueness

Uniqueness Score: -1.00%

Function 004059EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F65: lstrcpynA.KERNEL32(?,?,00000400,004032C3,update Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F72

Part of subcall function 00405996: CharNextA.USER32(?,?,C:\,?,00405A02,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A4
Part of subcall function 00405996: CharNextA.USER32(00000000), ref: 004059A9
Part of subcall function 00405996: CharNextA.USER32(00000000), ref: 004059BD

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A3E
GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00405A4E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059EB
C:\, xrefs: 004059F1, 004059F6, 004059FC, 00405A37, 00405A3D, 00405A45, 00405A4D

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1964270705
Opcode ID: abce9bb9807016b4c276db8bae45b4b3eed95d690bc7d0fbdb1e72e6f8ad0fcb
Instruction ID: 1f06baf1138d21f74630751e728cacf5283a8138a78bcc2982ba797f27b9272c
Opcode Fuzzy Hash: abce9bb9807016b4c276db8bae45b4b3eed95d690bc7d0fbdb1e72e6f8ad0fcb
Instruction Fuzzy Hash: 53F0C831315DA256C622323A1D45AAF1B45CE87338709477FF891B12D2EB3C89439EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00401FFD Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00402028

Part of subcall function 0040508C: lstrlenA.KERNEL32(0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000,?), ref: 004050C5
Part of subcall function 0040508C: lstrlenA.KERNEL32(004030DC,0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000), ref: 004050D5
Part of subcall function 0040508C: lstrcatA.KERNEL32(0042A050,004030DC,004030DC,0042A050,00000000,0041EA28,759223A0), ref: 004050E8
Part of subcall function 0040508C: SetWindowTextA.USER32(0042A050,0042A050), ref: 004050FA
Part of subcall function 0040508C: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405120
Part of subcall function 0040508C: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513A
Part of subcall function 0040508C: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405148

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402038
GetProcAddress.KERNEL32(00000000,?), ref: 00402048
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B2

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: c269c81cb85478e00bfc3d4b8c9c0837da33454893b7d03bdc32fa3c52a9d6d9
Instruction ID: 3b54ba627a5d3606a08c88bc2c88048367fe0e0edc5ddf34d35ff9eabd327fef
Opcode Fuzzy Hash: c269c81cb85478e00bfc3d4b8c9c0837da33454893b7d03bdc32fa3c52a9d6d9
Instruction Fuzzy Hash: A721DB71A04225ABCF207FA48E49B6E7670AB14358F20413BFB11B62D0CBBD4942966E

Uniqueness

Uniqueness Score: -1.00%

Function 004023D0 Relevance: 4.6, APIs: 3, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(0040AC18,00000023,00000011,00000002), ref: 0040241B
RegSetValueExA.ADVAPI32(?,?,?,?,0040AC18,00000000,00000011,00000002), ref: 00402458
RegCloseKey.KERNEL32(?,?,?,0040AC18,00000000,00000011,00000002), ref: 0040253C

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: 40e48cbbd769b2ddb4f8648729e7aecfaa2ba646ef1a89aa45d066a868b0220d
Instruction ID: f3bc197a49376025d104d1766b7c26e04d62aafcfa214307c08bf0afb556c6f3
Opcode Fuzzy Hash: 40e48cbbd769b2ddb4f8648729e7aecfaa2ba646ef1a89aa45d066a868b0220d
Instruction Fuzzy Hash: AD117271F00215BEDF10AFA59E89A9E7A74DB54314F20403AF908B61D1CAB84D419B68

Uniqueness

Uniqueness Score: -1.00%

Function 004024DF Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402511
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 00402524
RegCloseKey.KERNEL32(?,?,?,0040AC18,00000000,00000011,00000002), ref: 0040253C

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: ef5c3727a20db656ff5052f27e775ba80b940bc42b506935cef35a5b807bc4bf
Instruction ID: 7cc4705ec6358afed730085f06e11861ce0f90fa753b06a9139c19a758a622df
Opcode Fuzzy Hash: ef5c3727a20db656ff5052f27e775ba80b940bc42b506935cef35a5b807bc4bf
Instruction Fuzzy Hash: D801B171A04105BFE7159F699E9CABF7A7CDF40348F10003EF405A61C0DAB84A459769

Uniqueness

Uniqueness Score: -1.00%

Function 004056E5 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405AD9: GetFileAttributesA.KERNEL32(?,?,004056F1,?,?,00000000,004058D4,?,?,?,?), ref: 00405ADE
Part of subcall function 00405AD9: SetFileAttributesA.KERNEL32(?,00000000), ref: 00405AF2

RemoveDirectoryA.KERNEL32(?,?,?,00000000,004058D4), ref: 00405700
DeleteFileA.KERNEL32(?,?,?,00000000,004058D4), ref: 00405708
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405720

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4390be6e2ef8d2df5986f304b1f187f42b365e072cd754739d21517cc83f2d57
Instruction ID: ab3c30a2a51d8520bfc91e36631e3b158bafcebe445a439927c7769123fd08c9
Opcode Fuzzy Hash: 4390be6e2ef8d2df5986f304b1f187f42b365e072cd754739d21517cc83f2d57
Instruction Fuzzy Hash: E4E0E531115A91D6C2106774AE0865B2AD8EFC6364F05493BF892B30C0DB78880BAA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405996: CharNextA.USER32(?,?,C:\,?,00405A02,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A4
Part of subcall function 00405996: CharNextA.USER32(00000000), ref: 004059A9
Part of subcall function 00405996: CharNextA.USER32(00000000), ref: 004059BD

GetFileAttributesA.KERNEL32(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 00405552: CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405595

SetCurrentDirectoryA.KERNEL32(00000000,00435800,00000000,00000000,000000F0), ref: 0040163C

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 6e9d8b0bdd6535f5ad521cfe25d2546e39bd3477eb11d702e3e3618c9b95e55c
Instruction ID: 323619fe81b3529d61600e1e0eff0ce417d4ac591c1c2d39a63079fc07480124
Opcode Fuzzy Hash: 6e9d8b0bdd6535f5ad521cfe25d2546e39bd3477eb11d702e3e3618c9b95e55c
Instruction Fuzzy Hash: 2B11C431608152EBCB217BA54D415BF2AB4DA96324B28093FE9D1B22E2D63D4D425A2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040246D Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,?,?,?,?), ref: 0040249D
RegCloseKey.KERNEL32(?,?,?,0040AC18,00000000,00000011,00000002), ref: 0040253C

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 7d3c6902f9d33eca87671391b91be3ed48a1ca6425a0692cb99cfd7bae844a24
Instruction ID: 63e30908c11e451fd6d37fbe2862c18829a27713504d584fb03aa75526d5f0f4
Opcode Fuzzy Hash: 7d3c6902f9d33eca87671391b91be3ed48a1ca6425a0692cb99cfd7bae844a24
Instruction Fuzzy Hash: 0D110471A00205EECB14CF64DA889AF7AB4DF04304F20403FE446B72C0D6B88A42DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 99d94b6b7251e12d57a26b250e6e72915567ed6026f147eeb310830d1348a8a6
Instruction ID: f90ead50954d10692fd747fd35726c7c61e2fcf071c036ef7d407bcf2d164b43
Opcode Fuzzy Hash: 99d94b6b7251e12d57a26b250e6e72915567ed6026f147eeb310830d1348a8a6
Instruction Fuzzy Hash: 4601F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678EC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 004062FD Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403264,0000000A), ref: 0040630F
GetProcAddress.KERNEL32(00000000,?), ref: 0040632A

Part of subcall function 0040628F: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062A6
Part of subcall function 0040628F: wsprintfA.USER32 ref: 004062DF
Part of subcall function 0040628F: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 004062F3

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 30985bc18176bda4dfc46ca2d396654736e9499ca8d22b71f2c1527f66d3312f
Instruction ID: 0a5867ae11c12db0e7684f2d0d3995392d51af775f5f68958dac655171f1c28e
Opcode Fuzzy Hash: 30985bc18176bda4dfc46ca2d396654736e9499ca8d22b71f2c1527f66d3312f
Instruction Fuzzy Hash: 83E08C32604221ABD210AB749E0493B63A8EF98740306483EF94AF2240DB3C9C7296A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405AFE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402D88,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 00405B02
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B24

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction ID: 6905ba7dec075751c4c8bdaf1e97cd52a4ed4154a0977e2bcfee25d1bc4df630
Opcode Fuzzy Hash: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction Fuzzy Hash: F5D09E31254201EFEF098F20DE16F2EBBA2EB94B00F11952CB682944E1DA715819AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD9 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,004056F1,?,?,00000000,004058D4,?,?,?,?), ref: 00405ADE
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405AF2

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d21186c4df97c8b90cedd4d9d2ae0fe59d501b3437fd2b8c2b63dc03c6f7d79a
Instruction ID: a8f15113e5c9b75401305b8f42f7b900fd80c9315a1f16fe78aaf2180abbdc87
Opcode Fuzzy Hash: d21186c4df97c8b90cedd4d9d2ae0fe59d501b3437fd2b8c2b63dc03c6f7d79a
Instruction Fuzzy Hash: B8D0C972504122ABC2102728AE0889BBB55DB54271702CB35F9B9A26B1DB304C56AA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036DB Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403512,?,?,00000006,00000008,0000000A), ref: 004036E6

Strings

C:\Users\user\AppData\Local\Temp\nsf640.tmp\, xrefs: 004036FA

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsf640.tmp\
API String ID: 2962429428-1036879740
Opcode ID: 7bb9d04c8b35ddb385cf310f384fb45be282d55caa20868854ffc01acd183563
Instruction ID: a1bde45f6d244ba91e802d61d3971a42b11b03c2813ac8242e2f7427b9539a77
Opcode Fuzzy Hash: 7bb9d04c8b35ddb385cf310f384fb45be282d55caa20868854ffc01acd183563
Instruction Fuzzy Hash: 5DC01270504701A6C5346F74AE4F6093A14AB44735F604725B0B5F21F1CB7C565A556E

Uniqueness

Uniqueness Score: -1.00%

Function 004055CF Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,004031E4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 004055D5
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004055E3

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction ID: ff59ce228810ab0b399ea54ffc24e93d20618ce1ebfa51e1db99450e15aaec59
Opcode Fuzzy Hash: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction Fuzzy Hash: FAC08C30200101ABDB010B318F08B073A62AB80380F0288396042E00B4CA308004C92E

Uniqueness

Uniqueness Score: -1.00%

Function 00405B76 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031A6,00000000,00000000,00402FD0,000000FF,00000004,00000000,00000000,00000000), ref: 00405B8A

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction ID: d6e1a33fd195441beba49eedd959afadaf6b56434895abd4101947bffd5346ea
Opcode Fuzzy Hash: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction Fuzzy Hash: 21E0EC3221065EABDF10AE559C04AEB7B6CEB05360F004437F915E3150D635F9219BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA5 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040315C,00000000,00415428,000000FF,00415428,000000FF,000000FF,00000004,00000000), ref: 00405BB9

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction ID: 823d1a00ca840d25d454e1cdeec80758da7ba5e35e2b738bcb0e321267d0793f
Opcode Fuzzy Hash: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction Fuzzy Hash: DEE0EC3222075EAFDF50AE559C00AEB7B7CEB05760F004437F925E2190E631F9219BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00405DEB Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,?,?,0042A050,?,?,00405E79,0042A050,?,?,?,00000002,get), ref: 00405E0F

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: dc79c12829c29cd0bf07e2dbeefb197667dc07549b84f10616122407915bdb74
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: E4D0123210060DBBDF115F90ED05FAB371DEB48314F004826FE45A4091E775D670AF98

Uniqueness

Uniqueness Score: -1.00%

Function 004031A9 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402F0F,?), ref: 004031B7

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404A09 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404A21
GetDlgItem.USER32(?,00000408), ref: 00404A2C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A76
LoadBitmapA.USER32(0000006E), ref: 00404A89
SetWindowLongA.USER32(?,000000FC,00405000), ref: 00404AA2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404AB6
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404AC8
SendMessageA.USER32(?,00001109,00000002), ref: 00404ADE
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404AEA
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404AFC
DeleteObject.GDI32(00000000), ref: 00404AFF
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B2A
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404B36
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404BCB
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404BF6
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C0A
GetWindowLongA.USER32(?,000000F0), ref: 00404C39
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404C47
ShowWindow.USER32(?,00000005), ref: 00404C58
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404D55
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404DBA
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404DCF
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404DF3
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E13
ImageList_Destroy.COMCTL32(?), ref: 00404E28
GlobalFree.KERNEL32(?), ref: 00404E38
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404EB1
SendMessageA.USER32(?,00001102,?,?), ref: 00404F5A
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404F69
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F89
ShowWindow.USER32(?,00000000), ref: 00404FD7
GetDlgItem.USER32(?,000003FE), ref: 00404FE2
ShowWindow.USER32(00000000), ref: 00404FE9

Strings

, xrefs: 00404FC1
N, xrefs: 00404C93
M, xrefs: 00404BB2

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 3b740f44a2b1d633ad343a76b016798f79b98c3f4b333677a90c7392331c9530
Instruction ID: 5e7fd9033250abe3372a8cc080de2667683fe8f184775387c018329cb0bba4e6
Opcode Fuzzy Hash: 3b740f44a2b1d633ad343a76b016798f79b98c3f4b333677a90c7392331c9530
Instruction Fuzzy Hash: 9502A1B0A00209AFEB20DF55DD85AAE7BB5FB84315F14413AFA10B62E1C7789D42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004051CA Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405229
GetDlgItem.USER32(?,000003EE), ref: 00405238
GetClientRect.USER32(?,?), ref: 00405275
GetSystemMetrics.USER32(00000002), ref: 0040527C
SendMessageA.USER32(?,0000101B,00000000,?), ref: 0040529D
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004052AE
SendMessageA.USER32(?,00001001,00000000,?), ref: 004052C1
SendMessageA.USER32(?,00001026,00000000,?), ref: 004052CF
SendMessageA.USER32(?,00001024,00000000,?), ref: 004052E2
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405304
ShowWindow.USER32(?,00000008), ref: 00405318
GetDlgItem.USER32(?,000003EC), ref: 00405339
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405349
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405362
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040536E
GetDlgItem.USER32(?,000003F8), ref: 00405247

Part of subcall function 0040405B: SendMessageA.USER32(00000028,?,00000001,00403E8B), ref: 00404069

GetDlgItem.USER32(?,000003EC), ref: 0040538A
CreateThread.KERNEL32(00000000,00000000,Function_0000515E,00000000), ref: 00405398
CloseHandle.KERNEL32(00000000), ref: 0040539F
ShowWindow.USER32(00000000), ref: 004053C2
ShowWindow.USER32(?,00000008), ref: 004053C9
ShowWindow.USER32(00000008), ref: 0040540F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405443
CreatePopupMenu.USER32 ref: 00405454
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405469
GetWindowRect.USER32(?,000000FF), ref: 00405489
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004054A2
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054DE
OpenClipboard.USER32(00000000), ref: 004054EE
EmptyClipboard.USER32 ref: 004054F4
GlobalAlloc.KERNEL32(00000042,?), ref: 004054FD
GlobalLock.KERNEL32(00000000), ref: 00405507
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040551B
GlobalUnlock.KERNEL32(00000000), ref: 00405534
SetClipboardData.USER32(00000001,00000000), ref: 0040553F
CloseClipboard.USER32 ref: 00405545

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: d5273281f7ca55948d0d67e565d88e3eec44a4adc77553a27c5bfa0cd5b41917
Instruction ID: ba98567820032f63b871bd6861c5d6e43a3521a54ecc658c1b1e5281d96d67ec
Opcode Fuzzy Hash: d5273281f7ca55948d0d67e565d88e3eec44a4adc77553a27c5bfa0cd5b41917
Instruction Fuzzy Hash: D6A14971900608BFDF11AF61DE89AAF7F79EB04354F40403AFA41B61A0CB755E519F68

Uniqueness

Uniqueness Score: -1.00%

Function 00404496 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044E5
SetWindowTextA.USER32(00000000,?), ref: 0040450F
SHBrowseForFolderA.SHELL32(?,00429C48,?), ref: 004045C0
CoTaskMemFree.OLE32(00000000), ref: 004045CB
lstrcmpiA.KERNEL32(get,0042A870), ref: 004045FD
lstrcatA.KERNEL32(?,get), ref: 00404609
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040461B

Part of subcall function 00405665: GetDlgItemTextA.USER32(?,?,00000400,00404652), ref: 00405678

Part of subcall function 004061CF: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406227
Part of subcall function 004061CF: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406234
Part of subcall function 004061CF: CharNextA.USER32(?,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406239
Part of subcall function 004061CF: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406249

GetDiskFreeSpaceA.KERNEL32(00429840,?,?,0000040F,?,00429840,00429840,?,00000001,00429840,?,?,000003FB,?), ref: 004046D9
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046F4

Part of subcall function 0040484D: lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404768,000000DF,00000000,00000400,?), ref: 004048EB
Part of subcall function 0040484D: wsprintfA.USER32 ref: 004048F3
Part of subcall function 0040484D: SetDlgItemTextA.USER32(?,0042A870), ref: 00404906

Strings

get, xrefs: 004045F7, 004045FC, 00404607
A, xrefs: 004045B9

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$get
API String ID: 2624150263-2392541679
Opcode ID: 20b6d9ced992337b1412f46738ab000ca340b2c21d94be4f2955b414de4e2f25
Instruction ID: e7c3eafb31c7d15e6a6da749512948d226074c80576101813d8e7fa34d4e7a23
Opcode Fuzzy Hash: 20b6d9ced992337b1412f46738ab000ca340b2c21d94be4f2955b414de4e2f25
Instruction Fuzzy Hash: 44A190B1900209ABDB11AFA6CD45AAFB7B8EF85314F14843BF605B72D1D77C89418B2D

Uniqueness

Uniqueness Score: -1.00%

Function 004020CB Relevance: 3.1, APIs: 2, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408514,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214D
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021FC

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3ab9ca111cfd16ea316d8908730db186f13cf70328ad1dfde5033f2efd3f2ba1
Instruction ID: 70e90dd273e36d6cf470b0c6c9ff695bb876e65ea6d8ae05c01ad1deac9bcbee
Opcode Fuzzy Hash: 3ab9ca111cfd16ea316d8908730db186f13cf70328ad1dfde5033f2efd3f2ba1
Instruction Fuzzy Hash: D9512775A00208BFCF10DFE4C988A9DBBB5EF48318F2045AAF915EB2D1DA799941CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004026F8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402707

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 35474e701519af4a3bfe5b21ab3a1074e282d3bfb0b95cafabb6a5a8f21aa47d
Instruction ID: 5589ad20af1132df25b1d4da55578e461c11660e8300270abb34f4e41d1b37c2
Opcode Fuzzy Hash: 35474e701519af4a3bfe5b21ab3a1074e282d3bfb0b95cafabb6a5a8f21aa47d
Instruction Fuzzy Hash: 8BF0A0726041119AD710E7B49999EEEB778DB21324F60057BE685F20C1C6B88A469B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00406742 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4aeacf9715bb3b10a0377ad2d0224b4eefc29aff23ed095be582f5b156e71c
Instruction ID: 12ef56279526f9f53f22afc89151adbe845766d01d6fb7ada6890335ffbed449
Opcode Fuzzy Hash: 8a4aeacf9715bb3b10a0377ad2d0224b4eefc29aff23ed095be582f5b156e71c
Instruction Fuzzy Hash: 5EE19A7190070ADFCB24CF58C980BAABBF1EB45305F15852EE497A72D1E338AA91CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406F19 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca4b55698b2abcc8e5cbf272b741b12ffb4e3b740e9774b5bdfc5da95159218
Instruction ID: 968ea090ea57439d934916100a42e081e4144f1e312078ddc892fc3721ce49e9
Opcode Fuzzy Hash: fca4b55698b2abcc8e5cbf272b741b12ffb4e3b740e9774b5bdfc5da95159218
Instruction Fuzzy Hash: 18C14A31E0421ACBCF14CF68D4905EEBBB2BF99314F25866AD8567B380D734A942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00403B52 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B8E
ShowWindow.USER32(?), ref: 00403BAB
DestroyWindow.USER32 ref: 00403BBF
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BDB
GetDlgItem.USER32(?,?), ref: 00403BFC
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C10
IsWindowEnabled.USER32(00000000), ref: 00403C17
GetDlgItem.USER32(?,00000001), ref: 00403CC5
GetDlgItem.USER32(?,00000002), ref: 00403CCF
SetClassLongA.USER32(?,000000F2,?), ref: 00403CE9
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D3A
GetDlgItem.USER32(?,00000003), ref: 00403DE0
ShowWindow.USER32(00000000,?), ref: 00403E01
EnableWindow.USER32(?,?), ref: 00403E13
EnableWindow.USER32(?,?), ref: 00403E2E
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E44
EnableMenuItem.USER32(00000000), ref: 00403E4B
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403E63
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E76
lstrlenA.KERNEL32(0042A870,?,0042A870,00000000), ref: 00403EA0
SetWindowTextA.USER32(?,0042A870), ref: 00403EAF
ShowWindow.USER32(?,0000000A), ref: 00403FE3

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 73a332412999680b2dcb521756cc8655f7b5c6597c26b8181da5b9882737dc52
Instruction ID: 825bbfaa6b66e15a56cde4951677423d70b10f791e0768be12abaf391e468a8e
Opcode Fuzzy Hash: 73a332412999680b2dcb521756cc8655f7b5c6597c26b8181da5b9882737dc52
Instruction Fuzzy Hash: 80C19F71604205AFDB206F22EE45E2B3EBCFB4570AF40053EFA42B11E1CB7999429B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040416F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004041FA
GetDlgItem.USER32(00000000,000003E8), ref: 0040420E
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040422C
GetSysColor.USER32(?), ref: 0040423D
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040424C
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040425B
lstrlenA.KERNEL32(?), ref: 0040425E
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040426D
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404282
GetDlgItem.USER32(?,0000040A), ref: 004042E4
SendMessageA.USER32(00000000), ref: 004042E7
GetDlgItem.USER32(?,000003E8), ref: 00404312
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404352
LoadCursorA.USER32(00000000,00007F02), ref: 00404361
SetCursor.USER32(00000000), ref: 0040436A
LoadCursorA.USER32(00000000,00007F00), ref: 00404380
SetCursor.USER32(00000000), ref: 00404383
SendMessageA.USER32(00000111,00000001,00000000), ref: 004043AF
SendMessageA.USER32(00000010,00000000,00000000), ref: 004043C3

Strings

get, xrefs: 0040433D
N, xrefs: 00404300
:A@, xrefs: 0040436E

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: :A@$N$get
API String ID: 3103080414-2868807659
Opcode ID: cd245b479e67a0965af24715bd7e729d27bd81987a0dae74a39f742a14bba925
Instruction ID: 4cc5751811e84191dd39768f0d3a0055f5535ab869bb222e46a2b56927204bf5
Opcode Fuzzy Hash: cd245b479e67a0965af24715bd7e729d27bd81987a0dae74a39f742a14bba925
Instruction Fuzzy Hash: DA6183B1A00205BFEB10AF61DD45F6A7B69EB84715F00413AFB05BA1D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,update Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

update Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$update Setup
API String ID: 941294808-505284142
Opcode ID: 7a376c2f3ff8560e710422255b7ff54b6ff7317a13ba8817f722ed9a279a5648
Instruction ID: bc05fa60d2536021e17fc8d2ced0f843766159cda975d832d6f25ccf31630e85
Opcode Fuzzy Hash: 7a376c2f3ff8560e710422255b7ff54b6ff7317a13ba8817f722ed9a279a5648
Instruction Fuzzy Hash: C8419C71800209AFCF058F95DE459AFBBB9FF44310F00802EF9A1AA1A0C774D955DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405BD4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405D65,?,?), ref: 00405C05
GetShortPathNameA.KERNEL32(?,0042C600,00000400), ref: 00405C0E

Part of subcall function 00405A63: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CBE,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A73
Part of subcall function 00405A63: lstrlenA.KERNEL32(00000000,?,00000000,00405CBE,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AA5

GetShortPathNameA.KERNEL32(?,0042CA00,00000400), ref: 00405C2B
wsprintfA.USER32 ref: 00405C49
GetFileSize.KERNEL32(00000000,00000000,0042CA00,C0000000,00000004,0042CA00,?,?,?,?,?), ref: 00405C84
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405C93
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CCB
SetFilePointer.KERNEL32(0040A3B8,00000000,00000000,00000000,00000000,0042C200,00000000,-0000000A,0040A3B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D21
GlobalFree.KERNEL32(00000000), ref: 00405D32
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405D39

Part of subcall function 00405AFE: GetFileAttributesA.KERNEL32(00000003,00402D88,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 00405B02
Part of subcall function 00405AFE: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B24

Strings

[Rename], xrefs: 00405CB3, 00405CC5
%s=%s, xrefs: 00405C3F

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 19f304a619b6baa61da18707e398eef91e4d1c241cf3942778bb5909504f8d3d
Instruction ID: 17f8f1309641d4637e2ed4fc5cbc189083b9795c86085c8cd532ee5919f79a85
Opcode Fuzzy Hash: 19f304a619b6baa61da18707e398eef91e4d1c241cf3942778bb5909504f8d3d
Instruction Fuzzy Hash: 61310131601B19ABD2206B65AD8DF6B3A5CDF45714F14053BBA01F62D2EA7CA8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405F87 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(get,00000400), ref: 004060B2
GetWindowsDirectoryA.KERNEL32(get,00000400,?,0042A050,00000000,004050C4,0042A050,00000000), ref: 004060C5
SHGetSpecialFolderLocation.SHELL32(004050C4,759223A0,?,0042A050,00000000,004050C4,0042A050,00000000), ref: 00406101
SHGetPathFromIDListA.SHELL32(759223A0,get), ref: 0040610F
CoTaskMemFree.OLE32(759223A0), ref: 0040611B
lstrcatA.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040613F
lstrlenA.KERNEL32(get,?,0042A050,00000000,004050C4,0042A050,00000000,00000000,0041EA28,759223A0), ref: 00406191

Strings

get, xrefs: 00405FB1, 0040607E, 0040607F, 00406080, 0040609C, 004060B1, 004060C4, 004060E0, 0040610B, 0040613E, 00406144, 0040615C, 0040616F, 0040618A, 00406190, 00406198, 004061C2
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406081
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406139

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
API String ID: 717251189-1821354785
Opcode ID: 93175b9e86ceeaf5bc26d2662ee9bcff77ced71dd0aab543063507f0a11e8a4f
Instruction ID: 1b13e8ff18f2312f61c88a614d7ce51b6c0fc9f7833a06fa9902b6248b39176d
Opcode Fuzzy Hash: 93175b9e86ceeaf5bc26d2662ee9bcff77ced71dd0aab543063507f0a11e8a4f
Instruction Fuzzy Hash: D561F170A00105AEDF20AF24CC90BBB3BA5EB55314F56413FE903BA2D2C67D4962CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004061CF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406227
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406234
CharNextA.USER32(?,"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406239
CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,004031CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00406249

Strings

"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe", xrefs: 0040620B
C:\Users\user\AppData\Local\Temp\, xrefs: 004061D0
*?|<>/":, xrefs: 00406217

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2654551402
Opcode ID: 5f1665aab2a45dc98a0c2aad5c019af140aadccb050e4449eaa375ca2787231f
Instruction ID: ed3a47555f86895cac8e455d85beb05a749fa7fcd8deb799c497f9efd275ca90
Opcode Fuzzy Hash: 5f1665aab2a45dc98a0c2aad5c019af140aadccb050e4449eaa375ca2787231f
Instruction Fuzzy Hash: D111E26180579029FB3226380C44B776F884F6A760F1900BFE8D2722C3CA7C5C62966E

Uniqueness

Uniqueness Score: -1.00%

Function 0040408D Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004040AA
GetSysColor.USER32(00000000), ref: 004040C6
SetTextColor.GDI32(?,00000000), ref: 004040D2
SetBkMode.GDI32(?,?), ref: 004040DE
GetSysColor.USER32(?), ref: 004040F1
SetBkColor.GDI32(?,?), ref: 00404101
DeleteObject.GDI32(?), ref: 0040411B
CreateBrushIndirect.GDI32(?), ref: 00404125

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
Instruction ID: 2d9fb341b818c34885f35f6e6d755d1b55c6e7706bb7847a6dc6733995099f15
Opcode Fuzzy Hash: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
Instruction Fuzzy Hash: 1A216F71500704ABCB219F68DE08A4BBBF8AF41714F048939EAD5F66A0C734E948CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040508C Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000,?), ref: 004050C5
lstrlenA.KERNEL32(004030DC,0042A050,00000000,0041EA28,759223A0,?,?,?,?,?,?,?,?,?,004030DC,00000000), ref: 004050D5
lstrcatA.KERNEL32(0042A050,004030DC,004030DC,0042A050,00000000,0041EA28,759223A0), ref: 004050E8
SetWindowTextA.USER32(0042A050,0042A050), ref: 004050FA
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405120
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513A
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405148

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 57bc30585033a45ff0503b142d8cfa380acccc19d4d3abea87a767d6a2fe19a3
Instruction ID: 508789985144291932d060d6ef0b432b589b283746e8f0e3613f73f9cddaab2c
Opcode Fuzzy Hash: 57bc30585033a45ff0503b142d8cfa380acccc19d4d3abea87a767d6a2fe19a3
Instruction Fuzzy Hash: 9E217A71A00518BFDB119FA5CD85EDFBFA9EB05354F14807AF944AA290C6398A418F98

Uniqueness

Uniqueness Score: -1.00%

Function 00404957 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404972
GetMessagePos.USER32 ref: 0040497A
ScreenToClient.USER32(?,?), ref: 00404994
SendMessageA.USER32(?,00001111,00000000,?), ref: 004049A6
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004049CC

Strings

f, xrefs: 004049A8

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
Instruction ID: 403e93763916a0c69708d0661a5269b1e580af1e573dd698745729a1614bb606
Opcode Fuzzy Hash: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
Instruction Fuzzy Hash: 02015EB190021DBAEB01DBA4DD85BFFBBFCAF55711F10412BBA50B61C0C7B499018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402C61 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C7C
MulDiv.KERNEL32(0000BDE8,00000064,0000BDEC), ref: 00402CA7
wsprintfA.USER32 ref: 00402CB7
SetWindowTextA.USER32(?,?), ref: 00402CC7
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402CD9

Strings

verifying installer: %d%%, xrefs: 00402CB1

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 8cf66896cf3f33f8ea8d40d262e26d06426d7b5af9806429cf1dba26c1fd6b47
Instruction ID: 537944924eabc97b3cccf86cf440a0916c3cc685b10ad000e4021125f5d30dc2
Opcode Fuzzy Hash: 8cf66896cf3f33f8ea8d40d262e26d06426d7b5af9806429cf1dba26c1fd6b47
Instruction Fuzzy Hash: 3401FF7164020DFBEF209F61DD09EEE37A9AB04305F008039FA06A92D0DBB999558F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402736 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040278A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027A6
GlobalFree.KERNEL32(?), ref: 004027E5
GlobalFree.KERNEL32(00000000), ref: 004027F8
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402810
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402824

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 6803d74f51fefc5aae55b065fac9c87e9e8d6a4e026ec4b13ab89996610ab644
Instruction ID: 6644526d81fa5c7ff175c86addd85cc92bc24fd3ec06af29a2511a4f4fc8a5d3
Opcode Fuzzy Hash: 6803d74f51fefc5aae55b065fac9c87e9e8d6a4e026ec4b13ab89996610ab644
Instruction Fuzzy Hash: 3B21BC71800124BBDF216FA5DE89D9E7B79EF04324F10423AF924762E0CA784D418FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040B820), ref: 00401E1A

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 308e053560ee70820e3614aee6e3ae82a2990e303a595f115dffdce8e5cbd147
Instruction ID: e9269c0f41cd5a79e17a17131fa0488204b4df503fc5c3e11bd14e9e74a55962
Opcode Fuzzy Hash: 308e053560ee70820e3614aee6e3ae82a2990e303a595f115dffdce8e5cbd147
Instruction Fuzzy Hash: 24014072944344AEE7006BB4AE49BA97FE8EB15705F109439F141B61F2CB790405CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: e7b13135481585f1ae21f8f3a2a21f2ebc81ae0f190e6cb519dc2edadbd9593c
Instruction ID: b94dd0b2fc2efe961c915ac3dbaedcbaa59703da1128c811c259d0727350af9e
Opcode Fuzzy Hash: e7b13135481585f1ae21f8f3a2a21f2ebc81ae0f190e6cb519dc2edadbd9593c
Instruction Fuzzy Hash: 6EF0FFB2600515BFDB00EBA4DE88DAFB7BCEB44301B04447AF645F2191CA748D018B38

Uniqueness

Uniqueness Score: -1.00%

Function 0040484D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404768,000000DF,00000000,00000400,?), ref: 004048EB
wsprintfA.USER32 ref: 004048F3
SetDlgItemTextA.USER32(?,0042A870), ref: 00404906

Strings

%u.%u%s%s, xrefs: 004048D5

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: fc360b60deb29158253d5225dc841659dab03716f0da90b14001ba2338fc6a71
Instruction ID: 46e1028d5dd9cf3fa3a12b124fa319e283dc00677a7b855ac62dacd231200cde
Opcode Fuzzy Hash: fc360b60deb29158253d5225dc841659dab03716f0da90b14001ba2338fc6a71
Instruction Fuzzy Hash: 8D11E477A041282BEB0075699C41EBF3298DB82374F24463BFE65F21D1E979CC1246E9

Uniqueness

Uniqueness Score: -1.00%

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 8c877d5979cff4b3ce41adc99c27d6fc77d82e5cc3f5856b61787971cd0c7bbc
Instruction ID: bdc01a124477b6dd133b62af0939e03034df0dda3ad70936a50ebcebbcd9d6cc
Opcode Fuzzy Hash: 8c877d5979cff4b3ce41adc99c27d6fc77d82e5cc3f5856b61787971cd0c7bbc
Instruction Fuzzy Hash: 9F218F71A44209BEEB15DFA5D946AED7BB0EB84304F14803EF505F61D1DA7889408F28

Uniqueness

Uniqueness Score: -1.00%

Function 004058FD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031DE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 00405903
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031DE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403405,?,00000006,00000008,0000000A), ref: 0040590C
lstrcatA.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 0040591D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004058FD

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 00f54151576635bf1518ba316310c1363eddf8ffcac7d82473bc198909657139
Instruction ID: 647ad7e742d71b16062aa4f61d1124f0b3f0fcedfae467302285f0529c6cb9e2
Opcode Fuzzy Hash: 00f54151576635bf1518ba316310c1363eddf8ffcac7d82473bc198909657139
Instruction Fuzzy Hash: 46D0C9A2606A317AD21227159C09EDB6A4CCF57755B054076F640B61A1CA7C4D428BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BB4 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C19
RegCloseKey.ADVAPI32(?), ref: 00402C22
RegCloseKey.ADVAPI32(?), ref: 00402C43

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 11be2661f8599cd0237f1c1554e4f8b4188825d64962de0b1740bf644c97f38e
Instruction ID: b62f4967d327be975f6bbb281b4945b449d6b6e398a7fc8ef6fb9c274ae0afe8
Opcode Fuzzy Hash: 11be2661f8599cd0237f1c1554e4f8b4188825d64962de0b1740bf644c97f38e
Instruction Fuzzy Hash: 9A118832500109BBEF01AF91CF09B9E3B79EF08341F104036BA05B50E0E7B4EE52AB68

Uniqueness

Uniqueness Score: -1.00%

Function 00405996 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405A02,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,0040574D,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A4
CharNextA.USER32(00000000), ref: 004059A9
CharNextA.USER32(00000000), ref: 004059BD

Strings

C:\, xrefs: 00405997

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 6f1ffd314258f60c9d8d37a97cd5dc7cb97b0114338afd6930da08174d9d3dc4
Instruction ID: 692bca14cad493fa5f8fffeffcf9af39aa377604f3823295436d19c4138fc52d
Opcode Fuzzy Hash: 6f1ffd314258f60c9d8d37a97cd5dc7cb97b0114338afd6930da08174d9d3dc4
Instruction Fuzzy Hash: CDF0C2E1918F50ABFB3252245C41B6B5F9CCB56374F04047BE240672C2C27858408B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402CE4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EC4,00000001), ref: 00402CF7
GetTickCount.KERNEL32 ref: 00402D15
CreateDialogParamA.USER32(0000006F,00000000,00402C61,00000000), ref: 00402D32
ShowWindow.USER32(00000000,00000005), ref: 00402D40

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 2469aab9b0bab78131693435c259bb338fdfc1179cff7f610c16a2f3c60769c5
Instruction ID: 5343e4f3fd542578671bd54a8d6f819db7b5394acccd132b40ed42660498aa91
Opcode Fuzzy Hash: 2469aab9b0bab78131693435c259bb338fdfc1179cff7f610c16a2f3c60769c5
Instruction Fuzzy Hash: 01F05430601521EBC7207F24FE8CA8F7A64BB08B11791047AF445B21F4DBB448C28B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00405000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040502F
CallWindowProcA.USER32(?,?,?,?), ref: 00405080

Part of subcall function 00404072: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404084

Strings

, xrefs: 00405010

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b5703a8dab1bd1bd7dd9e2c337de487c6e053b4983eba3ecfb903a9c205ce24
Instruction ID: 2f0027df7ddfe28b71d6e39f600ecebaf2ba5c74aec8f2e947ae9809186c917a
Opcode Fuzzy Hash: 0b5703a8dab1bd1bd7dd9e2c337de487c6e053b4983eba3ecfb903a9c205ce24
Instruction Fuzzy Hash: 48017171500609ABDF205F51DD80E6F3B65EB84754F14403BFA01751D2C77A8CA29F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405E4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,get,0042A050,?,?,?,00000002,get,?,00406090,80000002), ref: 00405E92
RegCloseKey.ADVAPI32(?,?,00406090,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,?,0042A050), ref: 00405E9D

Strings

get, xrefs: 00405E4F, 00405E83

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseQueryValue
String ID: get
API String ID: 3356406503-4248514160
Opcode ID: 792f73651c5f0961c7d778f0fa8b648c5274768340d5a4a072e3937443cccb1f
Instruction ID: 9bec2c93df88531f10cf132d6bbbb6393b4a4aad9e102c5e2669e285c315f56d
Opcode Fuzzy Hash: 792f73651c5f0961c7d778f0fa8b648c5274768340d5a4a072e3937443cccb1f
Instruction Fuzzy Hash: B7015A72500619ABEF228F61CD09FDB3BACEF55365F00802AF955A2191D378DA54CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405604 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C078,Error launching installer), ref: 0040562D
CloseHandle.KERNEL32(?), ref: 0040563A

Strings

Error launching installer, xrefs: 00405617

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction ID: a14d50d96640d218925096829ca07d1800dc2b789f456133151d87fd2ad2a836
Opcode Fuzzy Hash: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction Fuzzy Hash: 9EE046F0640209BFEB109FA0ED49F7F7AACEB00704F404921BD00F2290E67499088A7C

Uniqueness

Uniqueness Score: -1.00%

Function 00403720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923410,00000000,C:\Users\user\AppData\Local\Temp\,004036F8,00403512,?,?,00000006,00000008,0000000A), ref: 0040373A
GlobalFree.KERNEL32(?), ref: 00403741

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403720

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 6450b972aff65fe59d26657d82cdbaa5e3cda0ee416f3077b3e42c8154ca0fa8
Instruction ID: 7d8ce370987dd57b7bf148727d206b09ac62311aee63c146eb442539f55f5a8e
Opcode Fuzzy Hash: 6450b972aff65fe59d26657d82cdbaa5e3cda0ee416f3077b3e42c8154ca0fa8
Instruction Fuzzy Hash: 39E0C27391212097C7313F54EE0871ABBA86F46B22F0A403AE8407B26487745C428BCC

Uniqueness

Uniqueness Score: -1.00%

Function 00405944 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402DB4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 0040594A
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DB4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.15071.2577.exe,80000000,00000003), ref: 00405958

Strings

C:\Users\user\Desktop, xrefs: 00405944

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: a2cb5c10c54eab45be364f275a3e0fd7f40b7dc80b72c69925d8ec85e0f8a492
Instruction ID: 9e2646df26482555437471894173605ef17f2c9d125cfcd2b42401f98a5df656
Opcode Fuzzy Hash: a2cb5c10c54eab45be364f275a3e0fd7f40b7dc80b72c69925d8ec85e0f8a492
Instruction Fuzzy Hash: D6D0C9A240DDB1AEE70363249C04B9F6A88DF17710F0944A6E180B61A5C77C4D828BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405A63 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CBE,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A73
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405A8B
CharNextA.USER32(00000000,?,00000000,00405CBE,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A9C
lstrlenA.KERNEL32(00000000,?,00000000,00405CBE,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AA5

Memory Dump Source

Source File: 00000000.00000002.1991630163.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991618391.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991641830.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991653035.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991732596.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 63752835767028d7570d3bd2c367202728d3e51619cdcd0ff30af86384407b43
Instruction ID: de8867e187cffd76a1833f018909c3af52f45fcf8c0597c8515af2ce59788131
Opcode Fuzzy Hash: 63752835767028d7570d3bd2c367202728d3e51619cdcd0ff30af86384407b43
Instruction Fuzzy Hash: F5F0C231201818AFCB02DBA4CD80D9EBBA8EF46350B2540B9E840F7211D774DE019FA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.FileRepMalware.15071.2577.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsf640.tmp\INetC.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
SecuriteInfo.com.FileRepMalware.15071.2577.exe

Function 004031F1 Relevance: 89.6, APIs: 34, Strings: 17, Instructions: 368
stringcomfileCOMMON

Function 0040572D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Function 00406268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 004037B5 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402D48 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00402F81 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Function 00401759 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Function 00405552 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Function 0040628F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405B2D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 004059EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Function 00401FFD Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 004023D0 Relevance: 4.6, APIs: 3, Instructions: 64
registrystringCOMMON

Function 004024DF Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Function 004056E5 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON