Edit tour

Windows Analysis Report
Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Overview

General Information

Sample name:	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Analysis ID:	1439434
MD5:	8991a0a2a0d5d03e40f7f7c57110637f
SHA1:	8a68c35c8d94eb9612194b43198cbf0764401bd0
SHA256:	71eea3c3d6de8b4666d87e3771155bb9c372615eeb5519999ad2fda159f13968
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe (PID: 368 cmdline: "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe" MD5: 8991A0A2A0D5D03E40F7F7C57110637F)

Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe (PID: 2576 cmdline: "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe" MD5: 8991A0A2A0D5D03E40F7F7C57110637F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.wapination.net", "Username": "pop@wapination.net", "Password": "sync@#1235"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2036631746.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2029605971.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 2576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 2576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3312b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33247:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33323:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33449:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30433:$s2: GetPrivateProfileString 0x2fb1a:$s3: get_OSFullName 0x311a7:$s5: remove_Key 0x3134f:$s5: remove_Key 0x3225c:$s6: FtpWebRequest 0x3309b:$s7: logins 0x3360d:$s7: logins 0x362fc:$s7: logins 0x363d0:$s7: logins 0x37cce:$s7: logins 0x36f6a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3132b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31447:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31523:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31649:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e633:$s2: GetPrivateProfileString 0x2dd1a:$s3: get_OSFullName 0x2f3a7:$s5: remove_Key 0x2f54f:$s5: remove_Key 0x3045c:$s6: FtpWebRequest 0x3129b:$s7: logins 0x3180d:$s7: logins 0x344fc:$s7: logins 0x345d0:$s7: logins 0x35ece:$s7: logins 0x3516a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3132b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31447:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31523:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31649:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e633:$s2: GetPrivateProfileString 0x2dd1a:$s3: get_OSFullName 0x2f3a7:$s5: remove_Key 0x2f54f:$s5: remove_Key 0x3045c:$s6: FtpWebRequest 0x3129b:$s7: logins 0x3180d:$s7: logins 0x344fc:$s7: logins 0x345d0:$s7: logins 0x35ece:$s7: logins 0x3516a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d4d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3312b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d54b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d5d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33247:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d667:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d6d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33323:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d743:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d7d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33449:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d869:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30433:$s2: GetPrivateProfileString 0x6a853:$s2: GetPrivateProfileString 0x2fb1a:$s3: get_OSFullName 0x69f3a:$s3: get_OSFullName 0x311a7:$s5: remove_Key 0x3134f:$s5: remove_Key 0x6b5c7:$s5: remove_Key 0x6b76f:$s5: remove_Key 0x3225c:$s6: FtpWebRequest 0x6c67c:$s6: FtpWebRequest 0x3309b:$s7: logins 0x3360d:$s7: logins 0x362fc:$s7: logins 0x363d0:$s7: logins 0x37cce:$s7: logins 0x6d4bb:$s7: logins 0x6da2d:$s7: logins 0x7071c:$s7: logins 0x707f0:$s7: logins 0x720ee:$s7: logins 0x36f6a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d6d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa7af9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3312b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d74b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa7b6b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d7d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa7bf5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33247:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d867:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7c87:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d8d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa7cf1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33323:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d943:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7d63:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d9d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa7df9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30433:$s2: GetPrivateProfileString 0x6aa53:$s2: GetPrivateProfileString 0xa4e73:$s2: GetPrivateProfileString 0x2fb1a:$s3: get_OSFullName 0x6a13a:$s3: get_OSFullName 0xa455a:$s3: get_OSFullName 0x311a7:$s5: remove_Key 0x3134f:$s5: remove_Key 0x6b7c7:$s5: remove_Key 0x6b96f:$s5: remove_Key 0xa5be7:$s5: remove_Key 0xa5d8f:$s5: remove_Key 0x3225c:$s6: FtpWebRequest 0x6c87c:$s6: FtpWebRequest 0xa6c9c:$s6: FtpWebRequest 0x3309b:$s7: logins 0x3360d:$s7: logins 0x362fc:$s7: logins 0x363d0:$s7: logins 0x37cce:$s7: logins 0x6d6bb:$s7: logins
Click to see the 21 entries

FTP traffic detected: 108.179.234.136:21 -> 192.168.2.5:49708 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.wapination.net

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.wapination.net
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wapination.net
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, cPKWk.cs	.Net Code: arfI
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, cPKWk.cs	.Net Code: arfI

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_0268DDD4	0_2_0268DDD4
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04D99318	0_2_04D99318
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04D90040	0_2_04D90040
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04D90007	0_2_04D90007
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04D99308	0_2_04D99308
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04DFC7B8	0_2_04DFC7B8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04DFC7A8	0_2_04DFC7A8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06BC4690	0_2_06BC4690
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06BC4681	0_2_06BC4681
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06BC4E18	0_2_06BC4E18
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06BCB7D8	0_2_06BCB7D8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06BCF528	0_2_06BCF528
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C4B338	0_2_06C4B338
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C4CDB0	0_2_06C4CDB0
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C44940	0_2_06C44940
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C4F6C0	0_2_06C4F6C0
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C47578	0_2_06C47578
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C49520	0_2_06C49520
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C490E8	0_2_06C490E8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C40F48	0_2_06C40F48
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C40F38	0_2_06C40F38
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C47DD8	0_2_06C47DD8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C47DE8	0_2_06C47DE8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C479A1	0_2_06C479A1
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C479B0	0_2_06C479B0
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C44931	0_2_06C44931
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_078585D0	0_2_078585D0
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_07857EF8	0_2_07857EF8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_03084A58	3_2_03084A58
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_0308AA8D	3_2_0308AA8D
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_03083E40	3_2_03083E40
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_0308E315	3_2_0308E315
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_03084188	3_2_03084188
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F28E90	3_2_06F28E90
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F2B835	3_2_06F2B835
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F366B8	3_2_06F366B8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F35678	3_2_06F35678
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F3B2E8	3_2_06F3B2E8
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F33130	3_2_06F33130
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F37E40	3_2_06F37E40
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F37760	3_2_06F37760
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F3E458	3_2_06F3E458
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F30347	3_2_06F30347
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F35DC5	3_2_06F35DC5
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F30006	3_2_06F30006

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2028340929.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000037E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2029605971.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d777ff5-1b53-46dc-bb82-ea82ab1c7757.exe4 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d777ff5-1b53-46dc-bb82-ea82ab1c7757.exe4 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2036082489.0000000006B90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2037294328.0000000007B10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d777ff5-1b53-46dc-bb82-ea82ab1c7757.exe4 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271876511.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Binary or memory string: OriginalFilenameHhlF.exe4 vs Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3801390.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3801390.4.raw.unpack, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3801390.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, BNU5fGa8LvJyr7ccAs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, BNU5fGa8LvJyr7ccAs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Mutant created: NULL

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	ReversingLabs: Detection: 66%
Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Virustotal: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process created: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process created: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: HhlF.pdb source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Source:	Binary string: HhlF.pdbSHA256 source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, frmShoppingBasket.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3801390.4.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	.Net Code: AIbF5OeL0P System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	.Net Code: AIbF5OeL0P System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6b90000.5.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_04DF2448 pushfd ; retf	0_2_04DF2449
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_06C4B038 push eax; iretd	0_2_06C4B041
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 0_2_0785691F push eax; mov dword ptr [esp], ecx	0_2_07856924
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_03080C3D push edi; ret	3_2_03080CC2
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F2F749 push es; retf	3_2_06F2F74C
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Code function: 3_2_06F2F734 push es; retf	3_2_06F2F748

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Static PE information: section name: .text entropy: 7.982040591188711

Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, IV8MZRGnZiG8kEE1vlc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'leYYXWbcGx', 'NuNYj6UWNr', 'BC7YNftUBj', 'gRxYBAKJDZ', 'UAdYeqiIuG', 'PjVYh4dSDI', 'XglYfwrANS'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, HIVVd5GRvqKVZfnaUpS.cs	High entropy of concatenated method names: 'pK0YwagqTa', 'hIvYDkRjse', 'icbY55OAea', 'or2JdfDKRjIFHpieGEJ', 'QxYY6nDBte6EelUNEaL', 'oqyXUyDXRtCeSOuQ7bw', 'Ao6FUZDqLPd8cjythN3', 'Fj00brDfAX0Yy91WXEK'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, fSIKvLEp8cwMuVrQEP.cs	High entropy of concatenated method names: 'Dispose', 'cbeWa8VKT0', 'gAyCGEFbND', 'WOtKKQsTog', 'u3tWUecoqe', 'wdAWzvYGwp', 'ProcessDialogKey', 'PT7CQkMu3L', 'cFxCW53ZZ4', 'C1WCCpsYcw'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	High entropy of concatenated method names: 'TBR6sT96D8', 'Wnt6cVQeQG', 'ADB6PWWE3l', 'lgv6uuqRdu', 'aVo6JgAbE4', 'GXd69bUTU5', 'Q5D6kiy50N', 'hNh6dbDbcq', 'wwM6ZVWGq1', 'u1n63XhvAu'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, jeTmSns61rmGfxvm9q.cs	High entropy of concatenated method names: 'nW3WkJpkBX', 'MBYWd6oijd', 'kgQW3ud5dK', 'Gl0WTht6Hw', 'kTBWtZdYr8', 'pH5W8RL52U', 'lLxD70uaGC5BRXBtdI', 'BmYTO6SuxPxC3JCeXb', 'UqCWW2FxoO', 'p0xW6EYHGT'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, fvEkkSOpL9ur69MFas.cs	High entropy of concatenated method names: 'XHq9sBnChS', 'Wu59PIu9kA', 'iiX9JlQpYY', 'cvv9kHV3NE', 'yBa9dN8vLN', 'c8WJey8NnU', 'GRSJh3asFX', 's6wJf7gb4q', 'KegJ4ukgu2', 'OeJJabFggp'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, defVr9pqOO0kf1gHOa.cs	High entropy of concatenated method names: 'luyqEEswo5', 'HEYqr7MsTs', 's2Tq0DtPtK', 'GKAqGPqco6', 'Eiyqgm0Hq9', 'mZsqvpZ7vS', 'J0PqL8AwDa', 'oePq1EwJh6', 'ngAqpMTveE', 'nJ5qoVXX94'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, nBAD71Age1l6I0MI87.cs	High entropy of concatenated method names: 'scEkwFL0xR', 'FJpkDpDr6f', 'xWPk5TXvqF', 'YEJk2GtLLj', 'r7Vk7W2vns', 'BIDkOmuXbH', 'zW4kIDv3bR', 'luakEDKNTZ', 'n0JkrPQM5O', 'kIRknoG0Fu'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, BNU5fGa8LvJyr7ccAs.cs	High entropy of concatenated method names: 'xiNPXpyAMM', 'zAkPjB2drc', 'D6gPNu3eBF', 'WQePBC8RM6', 'f7GPetxmb5', 'FVgPh3vTgt', 'YR9PfTuN7w', 'hnrP49p8uG', 'n9bPapB2Wj', 'qrbPU2I43d'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, yhBxa8RGg1Gh4hd6BE.cs	High entropy of concatenated method names: 'pVg5MuAhf', 'Fxl2GLbby', 'QfyOj31w4', 'qWfIVoKMM', 'Ga3rATGG2', 'c9FnsXgUK', 'GoJgcLfxlMolZOQxpK', 'vMLj99EDIWHRbxKOZ0', 'NBYSMLbGa', 'pDZYSVWWW'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, Dse8TlWffGZwM7uDd1.cs	High entropy of concatenated method names: 'l4PS0W4TKu', 'KpJSGiW5BM', 'CSJSVgf4GJ', 'wD9SgjClA9', 'EktSXKBsZc', 'G3nSvLdYmx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, AC1f6luAHvGfW2bddA.cs	High entropy of concatenated method names: 'QaqAWGaEwZ', 'sLcA6mdUTH', 'Wa4AFFc5pE', 'psrAc7vf4T', 'YhsAPRNOEB', 'Io8AJsK3AG', 'ImgA9gEQHW', 'RPFSfkZ3nZ', 'J7ES4ngpeo', 'NAiSaEfXRR'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, nrZiPMMRRhwXKU7o1x.cs	High entropy of concatenated method names: 'wAUkcrMni5', 'nZHkuLaovC', 'Fwhk9xK5Ig', 'mdu9UKtOam', 'tbp9zAnSHV', 'hKVkQCeqon', 'ic0kWUM0oT', 'NBdkC7W8R2', 'T95k6kPoTj', 'RunkFqc3Ly'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, x0pgdeUaLsXROU4Dd0.cs	High entropy of concatenated method names: 'NSjScanFJX', 'coKSPy8upm', 'KXNSuvyi5F', 'kkTSJ7eSul', 'ruHS9bfkdX', 'lKrSkoCbpO', 'JAoSdL1Ujy', 'TeVSZ5pE9K', 'u0AS33ML8J', 'ilbSToo7H3'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, aFUgF8SKY6IVL5ZYgb.cs	High entropy of concatenated method names: 'odCb4VFLxc', 'S3ybUdAJXO', 'VvPSQCoJIp', 'fvRSWOgiNB', 'FoRbo8qJ1Q', 'cpUbx2YEkY', 'UmpbMIPCgO', 'XIMbXJhAow', 'bygbjblvyX', 'r1UbNfQXIo'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, WuhYNi3RBK5mVfi1JI.cs	High entropy of concatenated method names: 'KgGu2pMqss', 'R7quOKX293', 'S3duEYqvw1', 'Oyxur1X29P', 'vRsuteE3UK', 'tCeu8bSEhW', 'jFyubnIgfj', 'zIFuS8OxDY', 'xUPuAYRJZ5', 'TwDuY6bsjp'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, gRjMeHfv2Ml8hGGXx5.cs	High entropy of concatenated method names: 'qt1b3a9SEv', 'FBKbTyB181', 'ToString', 'xLObc0FHgi', 'QBSbP85ulL', 'KYSbuHUM0P', 'seObJXVb3S', 'rKtb9tPMv4', 'B83bkKaAVd', 'YMvbdg0MIq'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, BSX09iGC76e0MA1E1ov.cs	High entropy of concatenated method names: 'av8AwK7FMV', 'Va6AD8Gtb9', 'd33A5GoACS', 'xw0A2AhUZg', 'oqGA7rPYik', 'jahAOP1p7a', 'otcAIumiEy', 'icWAEOefiC', 'TwQAr3WJMI', 'EnuAnxBJQC'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3b6be70.3.raw.unpack, TwY0UOIqFbDR9j9xjB.cs	High entropy of concatenated method names: 'c2hJ7VfUWQ', 'gesJIOY5fw', 'oIOuVOTaNF', 'wxBuggM2pd', 'JHUuvlhPP6', 'hCFuyKhGbY', 'FcVuLe0Fhf', 'tgou1Vdmex', 'xX4uRdV0yw', 'CI6upisfEO'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, IV8MZRGnZiG8kEE1vlc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'leYYXWbcGx', 'NuNYj6UWNr', 'BC7YNftUBj', 'gRxYBAKJDZ', 'UAdYeqiIuG', 'PjVYh4dSDI', 'XglYfwrANS'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, HIVVd5GRvqKVZfnaUpS.cs	High entropy of concatenated method names: 'pK0YwagqTa', 'hIvYDkRjse', 'icbY55OAea', 'or2JdfDKRjIFHpieGEJ', 'QxYY6nDBte6EelUNEaL', 'oqyXUyDXRtCeSOuQ7bw', 'Ao6FUZDqLPd8cjythN3', 'Fj00brDfAX0Yy91WXEK'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, fSIKvLEp8cwMuVrQEP.cs	High entropy of concatenated method names: 'Dispose', 'cbeWa8VKT0', 'gAyCGEFbND', 'WOtKKQsTog', 'u3tWUecoqe', 'wdAWzvYGwp', 'ProcessDialogKey', 'PT7CQkMu3L', 'cFxCW53ZZ4', 'C1WCCpsYcw'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aQK1E1o8kfZxUkMJ0N.cs	High entropy of concatenated method names: 'TBR6sT96D8', 'Wnt6cVQeQG', 'ADB6PWWE3l', 'lgv6uuqRdu', 'aVo6JgAbE4', 'GXd69bUTU5', 'Q5D6kiy50N', 'hNh6dbDbcq', 'wwM6ZVWGq1', 'u1n63XhvAu'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, jeTmSns61rmGfxvm9q.cs	High entropy of concatenated method names: 'nW3WkJpkBX', 'MBYWd6oijd', 'kgQW3ud5dK', 'Gl0WTht6Hw', 'kTBWtZdYr8', 'pH5W8RL52U', 'lLxD70uaGC5BRXBtdI', 'BmYTO6SuxPxC3JCeXb', 'UqCWW2FxoO', 'p0xW6EYHGT'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, fvEkkSOpL9ur69MFas.cs	High entropy of concatenated method names: 'XHq9sBnChS', 'Wu59PIu9kA', 'iiX9JlQpYY', 'cvv9kHV3NE', 'yBa9dN8vLN', 'c8WJey8NnU', 'GRSJh3asFX', 's6wJf7gb4q', 'KegJ4ukgu2', 'OeJJabFggp'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, defVr9pqOO0kf1gHOa.cs	High entropy of concatenated method names: 'luyqEEswo5', 'HEYqr7MsTs', 's2Tq0DtPtK', 'GKAqGPqco6', 'Eiyqgm0Hq9', 'mZsqvpZ7vS', 'J0PqL8AwDa', 'oePq1EwJh6', 'ngAqpMTveE', 'nJ5qoVXX94'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, nBAD71Age1l6I0MI87.cs	High entropy of concatenated method names: 'scEkwFL0xR', 'FJpkDpDr6f', 'xWPk5TXvqF', 'YEJk2GtLLj', 'r7Vk7W2vns', 'BIDkOmuXbH', 'zW4kIDv3bR', 'luakEDKNTZ', 'n0JkrPQM5O', 'kIRknoG0Fu'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, BNU5fGa8LvJyr7ccAs.cs	High entropy of concatenated method names: 'xiNPXpyAMM', 'zAkPjB2drc', 'D6gPNu3eBF', 'WQePBC8RM6', 'f7GPetxmb5', 'FVgPh3vTgt', 'YR9PfTuN7w', 'hnrP49p8uG', 'n9bPapB2Wj', 'qrbPU2I43d'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, yhBxa8RGg1Gh4hd6BE.cs	High entropy of concatenated method names: 'pVg5MuAhf', 'Fxl2GLbby', 'QfyOj31w4', 'qWfIVoKMM', 'Ga3rATGG2', 'c9FnsXgUK', 'GoJgcLfxlMolZOQxpK', 'vMLj99EDIWHRbxKOZ0', 'NBYSMLbGa', 'pDZYSVWWW'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, Dse8TlWffGZwM7uDd1.cs	High entropy of concatenated method names: 'l4PS0W4TKu', 'KpJSGiW5BM', 'CSJSVgf4GJ', 'wD9SgjClA9', 'EktSXKBsZc', 'G3nSvLdYmx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, AC1f6luAHvGfW2bddA.cs	High entropy of concatenated method names: 'QaqAWGaEwZ', 'sLcA6mdUTH', 'Wa4AFFc5pE', 'psrAc7vf4T', 'YhsAPRNOEB', 'Io8AJsK3AG', 'ImgA9gEQHW', 'RPFSfkZ3nZ', 'J7ES4ngpeo', 'NAiSaEfXRR'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, nrZiPMMRRhwXKU7o1x.cs	High entropy of concatenated method names: 'wAUkcrMni5', 'nZHkuLaovC', 'Fwhk9xK5Ig', 'mdu9UKtOam', 'tbp9zAnSHV', 'hKVkQCeqon', 'ic0kWUM0oT', 'NBdkC7W8R2', 'T95k6kPoTj', 'RunkFqc3Ly'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, x0pgdeUaLsXROU4Dd0.cs	High entropy of concatenated method names: 'NSjScanFJX', 'coKSPy8upm', 'KXNSuvyi5F', 'kkTSJ7eSul', 'ruHS9bfkdX', 'lKrSkoCbpO', 'JAoSdL1Ujy', 'TeVSZ5pE9K', 'u0AS33ML8J', 'ilbSToo7H3'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, aFUgF8SKY6IVL5ZYgb.cs	High entropy of concatenated method names: 'odCb4VFLxc', 'S3ybUdAJXO', 'VvPSQCoJIp', 'fvRSWOgiNB', 'FoRbo8qJ1Q', 'cpUbx2YEkY', 'UmpbMIPCgO', 'XIMbXJhAow', 'bygbjblvyX', 'r1UbNfQXIo'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, WuhYNi3RBK5mVfi1JI.cs	High entropy of concatenated method names: 'KgGu2pMqss', 'R7quOKX293', 'S3duEYqvw1', 'Oyxur1X29P', 'vRsuteE3UK', 'tCeu8bSEhW', 'jFyubnIgfj', 'zIFuS8OxDY', 'xUPuAYRJZ5', 'TwDuY6bsjp'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, gRjMeHfv2Ml8hGGXx5.cs	High entropy of concatenated method names: 'qt1b3a9SEv', 'FBKbTyB181', 'ToString', 'xLObc0FHgi', 'QBSbP85ulL', 'KYSbuHUM0P', 'seObJXVb3S', 'rKtb9tPMv4', 'B83bkKaAVd', 'YMvbdg0MIq'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, BSX09iGC76e0MA1E1ov.cs	High entropy of concatenated method names: 'av8AwK7FMV', 'Va6AD8Gtb9', 'd33A5GoACS', 'xw0A2AhUZg', 'oqGA7rPYik', 'jahAOP1p7a', 'otcAIumiEy', 'icWAEOefiC', 'TwQAr3WJMI', 'EnuAnxBJQC'
Source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.7b10000.8.raw.unpack, TwY0UOIqFbDR9j9xjB.cs	High entropy of concatenated method names: 'c2hJ7VfUWQ', 'gesJIOY5fw', 'oIOuVOTaNF', 'wxBuggM2pd', 'JHUuvlhPP6', 'hCFuyKhGbY', 'FcVuLe0Fhf', 'tgou1Vdmex', 'xX4uRdV0yw', 'CI6upisfEO'

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 47E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 7C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 8C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 8E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 9E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Memory allocated: 5230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598793	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598569	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596811	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594490	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Window / User API: threadDelayed 7825			Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Window / User API: threadDelayed 2027			Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 1372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 1480	Thread sleep count: 7825 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 1480	Thread sleep count: 2027 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598793s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598685s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598569s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -595046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -594827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe TID: 3480	Thread sleep time: -594490s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598793	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598569	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596811	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594827	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Thread delayed: delay time: 594490	Jump to behavior

Source: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271908550.00000000013FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Memory written: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Process created: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe "C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 2576, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036631746.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2029605971.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 2576, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3aadef0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.3a738d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe PID: 2576, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.6bf0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.2822344.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036631746.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2029605971.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	67%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	63%	Virustotal		Browse
Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
wapination.net	0%	Virustotal		Browse
ftp.wapination.net	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ftp.wapination.net	0%	Avira URL Cloud	safe
http://wapination.net	0%	Avira URL Cloud	safe
http://wapination.net	0%	Virustotal		Browse
http://ftp.wapination.net	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
wapination.net	108.179.234.136	true	false	0%, Virustotal, Browse	unknown
ftp.wapination.net	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ftp.wapination.net	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wapination.net	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe, 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
108.179.234.136	wapination.net	United States		46606	UNIFIEDLAYER-AS-1US	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1439434
Start date and time:	2024-05-10 12:29:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 288 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:29:58	API Interceptor	2574649x Sleep call for process: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
108.179.234.136	Payment_Advice-pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Yeni siparisleri listele.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	swift copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	3681321154248.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://docu578.sharefile.com/public/share/web-aeb1a3de99b24ec0	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	stub.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	stub.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://app.asana.com/app/asana/-/log?dest=https%3A%2F%2Fapp.asana.com%2F-%2Fmobile_web_email_login%3Fwa%3D127821c9468d9061b22a0dcde981af4a%26e%3Dbfanguy%2540uscortec.com&se=%7B%22name%22%3A%22AsanaLoaded%22%2C%22action%22%3A%22AsanaLoaded%22%2C%22sub_action%22%3A%22MagicLogin%22%2C%22location%22%3A%22MagicLoginEmail%22%2C%22domain%22%3Anull%2C%22domain_user%22%3Anull%2C%22user%22%3A1195607135831890%2C%22from_amp_email%22%3Afalse%2C%22non_user_action_event%22%3Afalse%2C%22email_uuid%22%3A%221715188399672Idf6803-3d26De4-a3ff3e4e9b9ccd%22%2C%22app_name%22%3A%22email%22%7D&rp=1195607135831890&hash=55999a967007d54aa7f5ae7781466d3ecff5abdb4784c581e8491f53c210d547	Get hash	malicious	Unknown	Browse	104.26.12.205
	8PCVwdtb1O.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	8PCVwdtb1O.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://4papc.bcryptoexpert.top/hdpp367loimg0	Get hash	malicious	Unknown	Browse	1.1.1.1
	qtgRmbqxXx.exe	Get hash	malicious	LummaC, PrivateLoader, RisePro Stealer	Browse	104.21.30.191
	https://urlz.fr/qBEk	Get hash	malicious	Unknown	Browse	162.159.136.66
	UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe	Get hash	malicious	FormBook	Browse	172.67.131.93
	20240506_120821.xls	Get hash	malicious	Unknown	Browse	104.21.71.191
	20240506_120821.xls	Get hash	malicious	Unknown	Browse	104.21.71.191
	20240506_120821.xls	Get hash	malicious	Unknown	Browse	104.21.71.191
	Pepsico LLC Company Profile.xls	Get hash	malicious	Unknown	Browse	172.67.148.22
	Pepsico LLC Company Profile.xls	Get hash	malicious	Unknown	Browse	104.21.71.191
	PO DTL20-041.doc	Get hash	malicious	Lokibot	Browse	104.21.25.202
UNIFIEDLAYER-AS-1US	shipping document.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.214.80.31
	PO_INdllc0987633.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.185.96.244
	Credit confirmation.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	Shipping documents_PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.166.221
	http://premierpointmortgage.com	Get hash	malicious	Unknown	Browse	162.241.194.39
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fcwconfeccoes.com.br%25252Fimages%25252Fportfolio%25252F893746354278945372465289049736275368923453%25252F987654r6849878675436834945%25252F589765345783909324849434w336452%252FLxSB%252FVDS1AQ%252FAQ%252Fcd4f3188-392c-428c-ac63-bc4ae3b44e15%252F1%252FxVxcH6z_PJ%2FLxSB%2FVDS1AQ%2FAQ%2F2a49c7ab-aefe-4029-ba47-cccb14ac5016%2F1%2Fp-Kk1qAP6N/LxSB/VTS1AQ/AQ/fc5370ab-5cbb-4beb-a06d-5c10ecbd947e/1/m6N65vctnP	Get hash	malicious	HTMLPhisher	Browse	162.215.219.157
	https://opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://royalgourmet.com.br/logs/8656/new/new/bgarcia@sedbud.com##	Get hash	malicious	HTMLPhisher	Browse	108.179.192.228
	Benefits_Policy.docx	Get hash	malicious	Unknown	Browse	173.254.28.234
	Benefits_Policy.docx	Get hash	malicious	Unknown	Browse	173.254.28.234
	https://qrco.de/WntxebLzUZRPvkbE7lS0v1K3POsozeEK	Get hash	malicious	Unknown	Browse	162.240.162.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	e-dekont.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.26.13.205
	Yeni siparisleri listele.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	swift copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	3681321154248.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://xtrfr.com/t/1/m3hVkr?p=1kpU6P0NN-6RM7EO4H_1kpU72q8p-6PSUvf2p	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win32.PWSX-gen.13680.28943.exe	Get hash	malicious	RedLine	Browse	104.26.13.205
	SecuriteInfo.com.Trojan-PSW.Agent.7485.24815.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	104.26.13.205
	Oferta 10935 planta GNL GRANDES VINOS Y VI#U00d1EDOS.eml	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://kitchenmagics.site/click/	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.log

Download File

Process:	C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9770493596537815
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
File size:	718'848 bytes
MD5:	8991a0a2a0d5d03e40f7f7c57110637f
SHA1:	8a68c35c8d94eb9612194b43198cbf0764401bd0
SHA256:	71eea3c3d6de8b4666d87e3771155bb9c372615eeb5519999ad2fda159f13968
SHA512:	37d53a99c2091e2e6bfafc6031e7752f996c4cf38a55c93a1e81a0145117599dad41a9cf7f3ad01cc0c8c0961ad254843b8d4a3709021546d0e53b5370cfe3af
SSDEEP:	12288:+ReLAfP7wDfYdCP7H59RJj6dBfPtUyED2sx8ytCahZQZ4Jme+UE8SmUtW8:4537wDgdCb5ZwHtFEHxgxSJIW
TLSH:	F3E42369F3EC491BDFE58CB1AD328496C378A322BED4F9C69D9100EA4A7D7109B40717
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@<f..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	0e175757414140a0

Static PE Info

General

Entrypoint:	0x4affbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x663C407F [Thu May 9 03:18:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, dword ptr [eax]
add eax, dword ptr [eax]
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax+0000000Eh], al
pop eax
add byte ptr [eax], al
adc byte ptr [eax], 00000000h
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
mov eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
jnle 00007F33D8D87E82h
add byte ptr [eax+00h], dh
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
je 00007F33D8D87E92h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaff6a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x12e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xaec14	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xadfc4	0xae000	8bf30d272663410be8071e46526533d0	False	0.9792129691989943	data	7.982040591188711	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x12e8	0x1400	a6c68eb0b51b4dbe31068a3e71d08b13	False	0.7859375	data	7.021896647859084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	0d4df5cbce02a80b2363339f33722e3c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb00c8	0xfaa	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9152119700748129
RT_GROUP_ICON	0xb1084	0x14	data	1.05
RT_VERSION	0xb10a8	0x23c	data	0.46678321678321677

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2024 12:30:00.570882082 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.570925951 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:00.570996046 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.575833082 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.575850964 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:00.806834936 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:00.806910038 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.809777021 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.809783936 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:00.809998989 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:00.861080885 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.901062012 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:00.948122978 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:01.127166986 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:01.127228022 CEST	443	49706	104.26.13.205	192.168.2.5
May 10, 2024 12:30:01.127357960 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:01.132949114 CEST	49706	443	192.168.2.5	104.26.13.205
May 10, 2024 12:30:01.886917114 CEST	49708	21	192.168.2.5	108.179.234.136
May 10, 2024 12:30:02.013478994 CEST	21	49708	108.179.234.136	192.168.2.5
May 10, 2024 12:30:02.013797045 CEST	49708	21	192.168.2.5	108.179.234.136
May 10, 2024 12:30:02.017132044 CEST	49708	21	192.168.2.5	108.179.234.136
May 10, 2024 12:30:02.141314030 CEST	21	49708	108.179.234.136	192.168.2.5
May 10, 2024 12:30:02.143399954 CEST	21	49708	108.179.234.136	192.168.2.5
May 10, 2024 12:30:02.143580914 CEST	49708	21	192.168.2.5	108.179.234.136
May 10, 2024 12:30:02.143580914 CEST	49708	21	192.168.2.5	108.179.234.136
May 10, 2024 12:30:02.143816948 CEST	21	49708	108.179.234.136	192.168.2.5
May 10, 2024 12:30:02.147496939 CEST	49708	21	192.168.2.5	108.179.234.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2024 12:30:00.386018991 CEST	55869	53	192.168.2.5	1.1.1.1
May 10, 2024 12:30:00.495366096 CEST	53	55869	1.1.1.1	192.168.2.5
May 10, 2024 12:30:01.668061018 CEST	53830	53	192.168.2.5	1.1.1.1
May 10, 2024 12:30:01.885653019 CEST	53	53830	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 10, 2024 12:30:00.386018991 CEST	192.168.2.5	1.1.1.1	0xd19	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 10, 2024 12:30:01.668061018 CEST	192.168.2.5	1.1.1.1	0x3c66	Standard query (0)	ftp.wapination.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 10, 2024 12:30:00.495366096 CEST	1.1.1.1	192.168.2.5	0xd19	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
May 10, 2024 12:30:00.495366096 CEST	1.1.1.1	192.168.2.5	0xd19	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
May 10, 2024 12:30:00.495366096 CEST	1.1.1.1	192.168.2.5	0xd19	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
May 10, 2024 12:30:01.885653019 CEST	1.1.1.1	192.168.2.5	0x3c66	No error (0)	ftp.wapination.net	wapination.net		CNAME (Canonical name)	IN (0x0001)	false
May 10, 2024 12:30:01.885653019 CEST	1.1.1.1	192.168.2.5	0x3c66	No error (0)	wapination.net		108.179.234.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.26.13.205	443	2576	C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 10:30:00 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-10 10:30:01 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 10:30:01 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 881940605e84114b-ORD
2024-05-10 10:30:01 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 32 2e 33 34 Data Ascii: 81.181.62.34

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 10, 2024 12:30:02.141314030 CEST	21	49708	108.179.234.136	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 05:30. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 10, 2024 12:30:02.143399954 CEST	21	49708	108.179.234.136	192.168.2.5	220 Logout.

Target ID:	0
Start time:	12:29:58
Start date:	10/05/2024
Path:	C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"
Imagebase:	0x460000
File size:	718'848 bytes
MD5 hash:	8991A0A2A0D5D03E40F7F7C57110637F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2036631746.0000000006BF0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2029605971.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2030143435.00000000039ED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:29:59
Start date:	10/05/2024
Path:	C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe"
Imagebase:	0xea0000
File size:	718'848 bytes
MD5 hash:	8991A0A2A0D5D03E40F7F7C57110637F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3273352127.00000000032AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3271702870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3273352127.0000000003281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	233
Total number of Limit Nodes:	15

Executed Functions

Function 04D99318 Relevance: 51.1, Strings: 39, Instructions: 2326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 04D99D0B
, xrefs: 04D99FFF
, xrefs: 04D9A2C1
, xrefs: 04D9A160
H, xrefs: 04D99DCD
_, xrefs: 04D9B634
_, xrefs: 04D9B1DE
_, xrefs: 04D9AC1B
$, xrefs: 04D99F38
, xrefs: 04D9A6A8
l, xrefs: 04D9A566
O, xrefs: 04D9A69E
U, xrefs: 04D9B29F
f, xrefs: 04D9A2B7
P, xrefs: 04D99917
., xrefs: 04D9B4F2
$, xrefs: 04D99DD7
2, xrefs: 04D9B49F
E, xrefs: 04D99C44
&, xrefs: 04D9A570
_, xrefs: 04D9A91B
&, xrefs: 04D999C4
&, xrefs: 04D9B083
_, xrefs: 04D9AA9B
_, xrefs: 04D9AD9B
(, xrefs: 04D9B403
z, xrefs: 04D99FF5
$, xrefs: 04D9A099
&, xrefs: 04D99B92
(, xrefs: 04D9B40D
H, xrefs: 04D9A1F0
b, xrefs: 04D9AFCE
_, xrefs: 04D99AD4
, xrefs: 04D99E9E
_, xrefs: 04D9991E
_, xrefs: 04D9AF1B
&, xrefs: 04D9A7F6
H, xrefs: 04D9A351
, xrefs: 04D9A422

Memory Dump Source

Source File: 00000000.00000002.2031746868.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $$$$$$$&$&$&$&$&$($($.$2$E$H$H$H$O$P$U$_$_$_$_$_$_$_$_$_$_$b$f$l$z
API String ID: 0-576466357
Opcode ID: 357b31fbfee9204cb217d5199bcc608036fbc148c615ff3e6ef1591a0780884c
Instruction ID: 37cb67b4b3e914683067c28193739e4d02f6741b01678410922e3bbdcab5196e
Opcode Fuzzy Hash: 357b31fbfee9204cb217d5199bcc608036fbc148c615ff3e6ef1591a0780884c
Instruction Fuzzy Hash: A1435670A10719CFDB21EF34C894A99B3B2FF8A304F108699D549AB350EB75AE85CF41

Function 04D99308 Relevance: 51.0, Strings: 39, Instructions: 2241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 04D99D0B
, xrefs: 04D99FFF
, xrefs: 04D9A2C1
, xrefs: 04D9A160
H, xrefs: 04D99DCD
_, xrefs: 04D9B634
_, xrefs: 04D9B1DE
_, xrefs: 04D9AC1B
$, xrefs: 04D99F38
, xrefs: 04D9A6A8
l, xrefs: 04D9A566
O, xrefs: 04D9A69E
U, xrefs: 04D9B29F
f, xrefs: 04D9A2B7
P, xrefs: 04D99917
., xrefs: 04D9B4F2
$, xrefs: 04D99DD7
2, xrefs: 04D9B49F
E, xrefs: 04D99C44
&, xrefs: 04D9A570
_, xrefs: 04D9A91B
&, xrefs: 04D999C4
&, xrefs: 04D9B083
_, xrefs: 04D9AA9B
_, xrefs: 04D9AD9B
(, xrefs: 04D9B403
z, xrefs: 04D99FF5
$, xrefs: 04D9A099
&, xrefs: 04D99B92
(, xrefs: 04D9B40D
H, xrefs: 04D9A1F0
b, xrefs: 04D9AFCE
_, xrefs: 04D99AD4
, xrefs: 04D99E9E
_, xrefs: 04D9991E
_, xrefs: 04D9AF1B
&, xrefs: 04D9A7F6
H, xrefs: 04D9A351
, xrefs: 04D9A422

Memory Dump Source

Source File: 00000000.00000002.2031746868.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $$$$$$$&$&$&$&$&$($($.$2$E$H$H$H$O$P$U$_$_$_$_$_$_$_$_$_$_$b$f$l$z
API String ID: 0-576466357
Opcode ID: 6920b22e6fadbbb114e621d6d49bbb404703be84c38407e33ebb8eddb72cbba8
Instruction ID: ccfe21f98a954098dc5d7bbee4ddcdc210c734a347a2e5ba5fd4d73592daa151
Opcode Fuzzy Hash: 6920b22e6fadbbb114e621d6d49bbb404703be84c38407e33ebb8eddb72cbba8
Instruction Fuzzy Hash: BB335770A10719CFDB21EF34C894A99B3B2FF8A304F508699D549AB350EB75AE85CF41

Function 078585D0 Relevance: 15.1, Strings: 10, Instructions: 2603COMMON

Download Yara Rule

Strings

4']q, xrefs: 0785B26E
4']q, xrefs: 0785B23E
(o]q, xrefs: 078586A6
4|bq, xrefs: 0785B3B8
$]q, xrefs: 0785B290
4']q, xrefs: 078595BB
4']q, xrefs: 07859433
4|bq, xrefs: 0785B3D3
4']q, xrefs: 0785B1E3
4']q, xrefs: 0785A4A1

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q$4']q$4']q$4']q$4|bq$4|bq$$]q
API String ID: 0-3618750947
Opcode ID: 1e9c87c3ba5bdfdd0d396652ea328b042505745153829ad7c5ce682d017a1f9c
Instruction ID: 8664c3ba06473944e1635e3b53ecb89ee902351ff56384ca3ce615c9ae45cc77
Opcode Fuzzy Hash: 1e9c87c3ba5bdfdd0d396652ea328b042505745153829ad7c5ce682d017a1f9c
Instruction Fuzzy Hash: 2643FBB4A00219CFCB24DF28C898A9DBBB2BF59310F158595D919EB3A1CB35ED81CF51

Function 06C4CDB0 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f58aad8d0dc3e6cd48c14af02d92bb11df97ccfebd5e6f6cab78cd2616e49b
Instruction ID: 099d45a09fff28f4030e23a272fb99ebcd10d195911355cb589ad2a0808cd726
Opcode Fuzzy Hash: 43f58aad8d0dc3e6cd48c14af02d92bb11df97ccfebd5e6f6cab78cd2616e49b
Instruction Fuzzy Hash: 6D328B70B022049FDB55EBA9C490BAEBBF6AF88700F24446DE546DB3A0DB35ED41CB51

Function 04DFC7B8 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a57d4e91c5cbac9dcd7e22a85733f0fd6648f553a3c989c136e1053dddd0ea4
Instruction ID: bb8ef00ecacc6559e50905b6e56f65f9b4fcc683a30fe42690c5e0689c123dff
Opcode Fuzzy Hash: 2a57d4e91c5cbac9dcd7e22a85733f0fd6648f553a3c989c136e1053dddd0ea4
Instruction Fuzzy Hash: 57526D30A0034A8FDB14DF28C844B99B7F2FF85314F2586A9D5586F3A1DB71A986CF91

Function 04DFC7A8 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd534e55da9da7693b25286dc212bc4a83d0e4e01cc36c90281a5ff23fabe3b
Instruction ID: b611e10b9d153a119d26d827df4eff0528421b5cd8b33588c973655423b9fc26
Opcode Fuzzy Hash: dbd534e55da9da7693b25286dc212bc4a83d0e4e01cc36c90281a5ff23fabe3b
Instruction Fuzzy Hash: 12525D70A0034A8FDB14DF28C844B99B7F2FF85314F2586A9D5586F3A1DB71A986CF81

Function 06C4B338 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0b1aded65d8840ecec12157312b0812901da49338938741be929daf79aead3
Instruction ID: 7cee276684344d65cb93990fe7ca63bfa79242ca36354c330b6ece17edb7445a
Opcode Fuzzy Hash: 6e0b1aded65d8840ecec12157312b0812901da49338938741be929daf79aead3
Instruction Fuzzy Hash: 9551E871D056298FEB68DF67C8407D9FBB6AFC9300F14D1AAD40DA6251EB704A85CF81

Function 06C44931 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8057d04f8e83c613f365383e1565d5f3b13ac1f7ac3745fc772a4eaadd3fdbec
Instruction ID: 436eee32e0bbdb0e694130b4de9614e7685b210f08fe4ab4ced347bea01ac5da
Opcode Fuzzy Hash: 8057d04f8e83c613f365383e1565d5f3b13ac1f7ac3745fc772a4eaadd3fdbec
Instruction Fuzzy Hash: B321C4B1D056589BEB18CFABC9453DEFFF6AFC9300F18C06AD409A6264DB740946CB90

Function 06C44940 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b975932933fda2936f9dc6a267eb556825017361626541174bc0f610e502cd56
Instruction ID: 1cdac66828f051177d9410700372a9fe097ea61e58e07cc635993eb8c52b1fa0
Opcode Fuzzy Hash: b975932933fda2936f9dc6a267eb556825017361626541174bc0f610e502cd56
Instruction Fuzzy Hash: 2721A2B0D016589BEB18DFABC9497DEFAF6AFC8300F14C06AD50966264DB7509468F90

Function 0785C63E Relevance: 5.2, Strings: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0785C749
$]q, xrefs: 0785C75F
$]q, xrefs: 0785C845
$]q, xrefs: 0785C85B

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a4cec89b2842da7d19f75ede2b36946614f20059a5a4d2713e2d586792ab9ba3
Instruction ID: ab629cac43c62e8bebbff49266478a95228ac7170a989643c2300425e674484a
Opcode Fuzzy Hash: a4cec89b2842da7d19f75ede2b36946614f20059a5a4d2713e2d586792ab9ba3
Instruction Fuzzy Hash: 3EB182B4A00219DFDB68DF68C891BA9BBB1FB98300F1081D9DA0DA7355DB315E92DF50

Function 0785C239 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 0785C2FC
Te]q, xrefs: 0785C37C

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 6ce4a491a6f3494d448b09c6a9a974a2d2677837ac0cbd07f327f2c0b88144e7
Instruction ID: d0783d9b55b9eaf5d6408f03b542d89a57e6985a845ef3414ada9346068117ce
Opcode Fuzzy Hash: 6ce4a491a6f3494d448b09c6a9a974a2d2677837ac0cbd07f327f2c0b88144e7
Instruction Fuzzy Hash: DBB1B9B4E002199FDB54DFA9C890BADBBF2FB99304F1084A9D909E7355DB309A85CF50

Function 04DF6CC8 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 04DF6F6C
Haq, xrefs: 04DF6F39

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 84845a9f6d35012db946c9e64f6552b9684a6e3881adfe43d648a8448cde6961
Instruction ID: 8cc65b8fef2fa64485225ce3baa1df0ff970a9d7827edf8a13054952d197eb7d
Opcode Fuzzy Hash: 84845a9f6d35012db946c9e64f6552b9684a6e3881adfe43d648a8448cde6961
Instruction Fuzzy Hash: F1710B35B001188FCB14EFA8C994AAE77F2FF88314B2544A9D505AB7A1DB35ED42CF61

Function 04DF7078 Relevance: 2.7, Strings: 2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 04DF7153
Haq, xrefs: 04DF710A

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 6647a0359faedd00ecedcc5bd0e11a00f20b16ade8e3d0d073b0de9de65ec4bf
Instruction ID: a4b2f7606cfdb4a6eb524fbe6353fa726bbcda09fcb53d66996a01d11dfc0fb5
Opcode Fuzzy Hash: 6647a0359faedd00ecedcc5bd0e11a00f20b16ade8e3d0d073b0de9de65ec4bf
Instruction Fuzzy Hash: B9518E347006108FCB25AB7CD85896EB7F6BF897007168569EA06CB3A1DF75EC06CB90

Function 07853058 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 078530A6
, xrefs: 0785309F

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 14cd485d04569e4e61861722cdb1f2566ca68a092d4187e88f30062bd3cf65b5
Instruction ID: 9a20cb947d994ef8f96342bd2fc9612af0f108cf3262b5dd988547807173e0c9
Opcode Fuzzy Hash: 14cd485d04569e4e61861722cdb1f2566ca68a092d4187e88f30062bd3cf65b5
Instruction Fuzzy Hash: F4719271910701CFDB01EF2AD485A5477B5FF89314B41CAA8D949AB326EB71F894CF90

Function 04DFC500 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 04DFDE20
(aq, xrefs: 04DFDD02

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: d688785024256c66f6dc381e4bfd1dff8a1ffa6a2f716a841080e6590fde64b1
Instruction ID: 7d801fbfe3c8ec45acf1ce13576967bf132bb3e152d2a86bccd68bcaa008a9bf
Opcode Fuzzy Hash: d688785024256c66f6dc381e4bfd1dff8a1ffa6a2f716a841080e6590fde64b1
Instruction Fuzzy Hash: FE5115316002059FD725AF28C8146AE77A6FFC5300F1A84AAE64A9B791DF35FC42C7A1

Function 078528FC Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 078530A6
, xrefs: 0785309F

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e6ea1d6d9de4d494b7f004a287a57e10a3db95de69c1c2451d69a03132900639
Instruction ID: 9cc071f297b8e9483ba0e8a3d65f0b1f8eac8a9bb9c982301a4a35037aa198c4
Opcode Fuzzy Hash: e6ea1d6d9de4d494b7f004a287a57e10a3db95de69c1c2451d69a03132900639
Instruction Fuzzy Hash: E661B171910601CFDB01EF2AD484E54B7B5FF89304B41CAA8DA49AB326EB71F894CF90

Function 078564F0 Relevance: 2.6, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07856619
4']q, xrefs: 0785663C

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 23def33ce43692c22c31d41cc687f5c3e6358148f783351d08cf8b4aac98b21b
Instruction ID: 86acf15fb861de1e350eef0c3430cd91f7c5ffa9f6c26a4ff4eb5c3128db762d
Opcode Fuzzy Hash: 23def33ce43692c22c31d41cc687f5c3e6358148f783351d08cf8b4aac98b21b
Instruction Fuzzy Hash: 79415232E1070A9BDB14EFA9D840ADDB7B2FF99300F228A19E5047B241EB747595CB90

Function 07856500 Relevance: 2.6, Strings: 2, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07856619
4']q, xrefs: 0785663C

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: d7a3f8b8a5164b0367c680be9e167530b6b7f19f7d59d8ada99d1b5f9b80dbbf
Instruction ID: 95ada3d664b24fb1da5337b9352dd19245e1ccb7eece86f203dacd6047399ce2
Opcode Fuzzy Hash: d7a3f8b8a5164b0367c680be9e167530b6b7f19f7d59d8ada99d1b5f9b80dbbf
Instruction Fuzzy Hash: 6F415332E1070A9BDB14EFB9D840ADDB7B2FF95300F228A19E5147B241EB707595CB90

Function 06C4A20C Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06C4A44E

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c56100d31ae1c8aca69dacd606d668da1b60952ff112a2ad1671afecb0dd0c66
Instruction ID: a6be149009c8d977883c75d15ff9804c79d96495ce8574acac69d5320d277224
Opcode Fuzzy Hash: c56100d31ae1c8aca69dacd606d668da1b60952ff112a2ad1671afecb0dd0c66
Instruction Fuzzy Hash: BAA17D71D00619CFEB60DFA9C8847EEBBF2BF48314F148569D809A7244DB749A85CF91

Function 06C4A218 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06C4A44E

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 555e6d392c2bd24a1def1f3b67b9d486c527f14f8ddd19dd52af19997b8a9fc2
Instruction ID: a5f7cf0f2f5d1499ba4e6025b6d64003913c8f6ebabae560e007a11ab648b3df
Opcode Fuzzy Hash: 555e6d392c2bd24a1def1f3b67b9d486c527f14f8ddd19dd52af19997b8a9fc2
Instruction Fuzzy Hash: 08916E71D006198FDB60DFA9C8447EEBBF2BF44314F148569D809A7244DB749A85CF91

Function 0268AFE8 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0268B23E

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6b44d697b8710c3016959b4e3a4d9c615bf18e492e077d77c53aeb40bcd76ee4
Instruction ID: c42eb2beb698f14b7cd4fcb065c0d82c75e85bcd68efbd7ff0a2996d522efcdc
Opcode Fuzzy Hash: 6b44d697b8710c3016959b4e3a4d9c615bf18e492e077d77c53aeb40bcd76ee4
Instruction Fuzzy Hash: 63712270A00B458FD724EF69D45076ABBF2FF88308F008A2DD49ADBB50DB75E8458B90

Function 0785F3D3 Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

{z}, xrefs: 0785F749

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: {z}
API String ID: 0-1552007774
Opcode ID: af9d4acb6725ae816609091ce965ed60b2fa34e394287cabb1898c46ca201554
Instruction ID: 61f4975570c19b02f3f8a542c6710a59528822d6b5ad7dabc2484cce0b4ec164
Opcode Fuzzy Hash: af9d4acb6725ae816609091ce965ed60b2fa34e394287cabb1898c46ca201554
Instruction Fuzzy Hash: 162288B4A01229DFDB64DF68C994BDDBBB1BB49300F1081EAE949A7351DB309E85CF50

Function 04D91264 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D94381

Memory Dump Source

Source File: 00000000.00000002.2031746868.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 85650d3fd9a73e48549e9df7f335eee0eb9fd21803d10bcf1cb46f361220e79d
Instruction ID: fd00f049332873e3adc758e3dc853c18afc055d24d18d341e1d979ac6e5ce1b0
Opcode Fuzzy Hash: 85650d3fd9a73e48549e9df7f335eee0eb9fd21803d10bcf1cb46f361220e79d
Instruction Fuzzy Hash: 0E4127B4A043059FDB14DF99C488AAEFBF5FB88314F24C459D419AB321D374E842CBA0

Function 026844D4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 026859A9

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 697436fbc9809ae3a7ccc4fb4913471476bd03534b31afef0853bb2541ec9464
Instruction ID: 9d4b1c65f792fb74e404cf7f76b46cb6ff03ece8e4a1b58dec934584a0a9fa75
Opcode Fuzzy Hash: 697436fbc9809ae3a7ccc4fb4913471476bd03534b31afef0853bb2541ec9464
Instruction Fuzzy Hash: CD41E2B0D0071DCBDB24DFA9C884B9EBBB5BF48304F60816AD409AB251DB75A949CF91

Function 026858EC Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 026859A9

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f04000f202e1511f59ca912b84d887f7ef8b4ae443b3eb0f37842bb2aa106642
Instruction ID: 899d01c88ecc1f5313e1c4ef17fa6b0387c554bb4ce0d23da6208fb7df75a630
Opcode Fuzzy Hash: f04000f202e1511f59ca912b84d887f7ef8b4ae443b3eb0f37842bb2aa106642
Instruction Fuzzy Hash: 1F41E2B0D00719CFDB25DFA9C8847DDBBB2BF48304F60816AD409AB251DB75694ACF91

Function 0785E574 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

[, xrefs: 0785E711

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 08bd87926b9e7ef29ceace76a2af546887c7a1e118c9516a23666f1f97cd7b9f
Instruction ID: 501c6efe5da56412b18a627c03e18a640dd8496be435aa7157d9b9de2bbc9df0
Opcode Fuzzy Hash: 08bd87926b9e7ef29ceace76a2af546887c7a1e118c9516a23666f1f97cd7b9f
Instruction Fuzzy Hash: A0F1A3B4A01229CFDB64DF68C884B9DBBB2BF59304F1081E9D809AB354DB349E85CF51

Function 06C49F88 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C4A020

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fabc5c3288b72af3d0a8a6b0cf82d103ee0d58b804b909431e73be6b9eb5b302
Instruction ID: 718feca07fbad1e28c8d1badef1296e4689a4f79cbe3c3a8871f112851537259
Opcode Fuzzy Hash: fabc5c3288b72af3d0a8a6b0cf82d103ee0d58b804b909431e73be6b9eb5b302
Instruction Fuzzy Hash: 442148B2D003599FCB20DFA9C885BDEBBF5FF48310F108829E919A7240D774A945CBA1

Function 06C49F90 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C4A020

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f873a6e50e66779cd2bd970d5f244bcb80f53b04050b0d7bf5a44d76af968913
Instruction ID: 2f4b3727f790a29cb8e7bc37e2e12cedd5339bec8245d381e2ba99f5e557ca6b
Opcode Fuzzy Hash: f873a6e50e66779cd2bd970d5f244bcb80f53b04050b0d7bf5a44d76af968913
Instruction Fuzzy Hash: 2B2139B1D003499FCB10DFA9C885BDEBBF5FF48310F108429E919A7240C778A954CBA1

Function 06C4A078 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C4A100

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 54c8055396ebf57de2b40bdd7e5f61934549564bc5e3b63d745f604129a976d9
Instruction ID: 3e96e0056d023723a1a420f6a1188fa2c4d5454c33ea5f6704a0fba2ef8e8d35
Opcode Fuzzy Hash: 54c8055396ebf57de2b40bdd7e5f61934549564bc5e3b63d745f604129a976d9
Instruction Fuzzy Hash: 1B2136B1C002499FCB10DFAAC885BEEFBF5FF48310F10842AE559A7240D7399941DBA1

Function 06C49DF0 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C49E76

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 55b6be03aa44309d9d12f35fa169373e6315a682bdc22114c713d061115ab785
Instruction ID: e18335844f5c5b9ff1d5674b0911765692e1ec692faaa8cb7d718891ea9d6726
Opcode Fuzzy Hash: 55b6be03aa44309d9d12f35fa169373e6315a682bdc22114c713d061115ab785
Instruction Fuzzy Hash: AC2137B1D002198FDB10DFAAC4857EEBBF4FF89324F10842AD459A7240D7789945CFA1

Function 0268AED4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0268D48E,?,?,?,?,?), ref: 0268D54F

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1556643e2f60da34ac227f823fae442bb120745afcd0cca84925ddebe0620570
Instruction ID: 9ec20fc68550ea5469887b60a174172909a826037e686b24ad6275b61053f579
Opcode Fuzzy Hash: 1556643e2f60da34ac227f823fae442bb120745afcd0cca84925ddebe0620570
Instruction Fuzzy Hash: D821E4B5D00249AFDB10DFAAD584ADEBFF8EB48314F14841AE918A7350D374A954CFA1

Function 06C4A080 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C4A100

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a100da3dbbf08f1341e95712df47c1892f42d75f95b1ca71829a47b0d346e6aa
Instruction ID: 7b8fb593b437a136b4925968dc5c0d72fb1bad0a5e60c929dd76a7cde4cd1641
Opcode Fuzzy Hash: a100da3dbbf08f1341e95712df47c1892f42d75f95b1ca71829a47b0d346e6aa
Instruction Fuzzy Hash: 002139B1D003499FCB10DFAAC885ADEFBF5FF48310F108429E519A7240C734A941DBA1

Function 06C49DF8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C49E76

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 485a69bc3ab7bbd702f5a651dd2275f347057576f3fa9beb6a25b51f694e6227
Instruction ID: 7a69c529005edb400b41273d39efcc78186abe6b33d481d40cb458ebcf91b214
Opcode Fuzzy Hash: 485a69bc3ab7bbd702f5a651dd2275f347057576f3fa9beb6a25b51f694e6227
Instruction Fuzzy Hash: 042104B1D002098FDB10DFAAC4857EFBBF4AB89324F54842AD419A7240DB78A945CBA1

Function 0268D4C1 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0268D48E,?,?,?,?,?), ref: 0268D54F

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f61a8a40e31143393cd8cbe88fd505b39230856318b675e46baea7855bb431ea
Instruction ID: 5f310fa79f9bac1ec74987bb9e10098fe0aadc4f161bf041d3efdbde39670a02
Opcode Fuzzy Hash: f61a8a40e31143393cd8cbe88fd505b39230856318b675e46baea7855bb431ea
Instruction Fuzzy Hash: 6021EFB5D002099FDB10CFA9D584AEEBBF5FB48314F14841AE928A3350D378AA54CF61

Function 0785DCE7 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

@, xrefs: 0785DE0F

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7df840ad146f79c797d6d4abb97e8583b91cb89510a6abb0d6b0974221518d3d
Instruction ID: 92649ba16b5fe77c4beb41501ab94f85b2077e093a553f87b7e0dfa42b0bc991
Opcode Fuzzy Hash: 7df840ad146f79c797d6d4abb97e8583b91cb89510a6abb0d6b0974221518d3d
Instruction Fuzzy Hash: BBE193B4E002598FDB54DFA8C880A9DBBF2FF59314F1481AAD918EB345D731A985CF60

Function 06C49EC8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C49F3E

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b6f19bfc80d3371c7b03a00d61f1c9557b01f726c1c6afaac1b57d841dfab848
Instruction ID: 82226e4117bb74a9787a7ac80942c28085f5950eebfe4bfc392dd19e65f8b7c3
Opcode Fuzzy Hash: b6f19bfc80d3371c7b03a00d61f1c9557b01f726c1c6afaac1b57d841dfab848
Instruction Fuzzy Hash: E42156B2D002498FDB20DFA9C844ADFBFF5EF88324F248819E559A7250C775A945CFA1

Function 0268ACF8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0268B2B9,00000800,00000000,00000000), ref: 0268B4CA

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 801ffc29eec6d3ab1085bac5c84d5c0a1e9e15a4eda8c7802b2cb9964e3dcc34
Instruction ID: 726b62cb1a5897a84273fff9cc1cedd0b0256f6f1ff2c67d09d9f72eb32110b6
Opcode Fuzzy Hash: 801ffc29eec6d3ab1085bac5c84d5c0a1e9e15a4eda8c7802b2cb9964e3dcc34
Instruction Fuzzy Hash: 0D1142B6D003099FDB10DF9AD485A9EFBF8EB88324F10852AE819A7310C374A545CFA5

Function 0268B458 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0268B2B9,00000800,00000000,00000000), ref: 0268B4CA

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 839fdda82d2ae318fc3109af2d7fb306a13c795e88deb8bb8abaa71328578bb4
Instruction ID: dcb02825bccf3386ae4d8902c087eca3b3740280c122879beeab60a9b4a7d2ac
Opcode Fuzzy Hash: 839fdda82d2ae318fc3109af2d7fb306a13c795e88deb8bb8abaa71328578bb4
Instruction Fuzzy Hash: 231123B6D003099FDB10DFAAD445ADEFBF4EB98324F10852AD429A7300C375A545CFA5

Function 06C49ED0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C49F3E

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 586bf49ef464bddf77f1bb2ff0c444fe2ac4d599e326b64c3f2015960e8c7e4b
Instruction ID: 610b770e72c459ec504b9cf015a2da07af6c65baacf1aa0a1a7a254349f9ee7b
Opcode Fuzzy Hash: 586bf49ef464bddf77f1bb2ff0c444fe2ac4d599e326b64c3f2015960e8c7e4b
Instruction Fuzzy Hash: 5F1164B2D002498FDB10DFAAC844ADFBFF5EF88324F208819E519A7250C735A944CFA1

Function 06C49D40 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C49DAA

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: df83db9541a7062f392cc56a8a695f6ade7e2e4ac8724fa1217a34066d7a0c7d
Instruction ID: e8fe567e8896fa0b616cd0dd1ece0c481887ca9f7fc5939dcd39743a75a8e9f4
Opcode Fuzzy Hash: df83db9541a7062f392cc56a8a695f6ade7e2e4ac8724fa1217a34066d7a0c7d
Instruction Fuzzy Hash: 271146B1D002598FCB20DFAAC8457DFFFF4AB89324F208429D419A7240D775A545CBA5

Function 06C4CD88 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06C4D731,?,?), ref: 06C4DCE0

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6f07c26d1d023a5681892408ba683c03fbf499bc0dfc9080519fe4e7d4f3a4c3
Instruction ID: 9d5253ec32cf19746240c1c7189a56c3906377d346993e6334b55fc0ee8b8d7e
Opcode Fuzzy Hash: 6f07c26d1d023a5681892408ba683c03fbf499bc0dfc9080519fe4e7d4f3a4c3
Instruction Fuzzy Hash: 271113B1C003499FDB10EF9AD549BDEBBF4EF48320F20841AD959A7240D378A944CBA5

Function 06C4C638 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06C4C69D

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c30d771671639eccaabce2df120a863219a495ca7ef79498a554a8401b9579be
Instruction ID: 79301fcc69d608b6ac42181dacb03bbf8ce3212a8eed7e5e36230b8000f66a84
Opcode Fuzzy Hash: c30d771671639eccaabce2df120a863219a495ca7ef79498a554a8401b9579be
Instruction Fuzzy Hash: F41125B5C002499FCB10DF99C984BDEBFF8EB48320F108419E958A7310D375A594CFA1

Function 06C4DC80 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06C4D731,?,?), ref: 06C4DCE0

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a1083c44b9976b0ffa281839f47bba514d804026f8029a9e8651fafa78aab25a
Instruction ID: 1e1dfdcf228ae1bbcd301c9fedc9800287ee6fe1d155d6cfc81c753be8de8a5c
Opcode Fuzzy Hash: a1083c44b9976b0ffa281839f47bba514d804026f8029a9e8651fafa78aab25a
Instruction Fuzzy Hash: E21125B1C006498FCB20EF9AC545BDEBBF4EF48320F248419D559A7340D778A584CFA5

Function 06C49D48 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C49DAA

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 705919241fd7327e9228dedaf34a825b7c72969f75913a6a26e53de9080fb7e2
Instruction ID: 08162e5999c3a1c8ec370126899be97ca1ab318f4fa426d782d7d6602a67dcfd
Opcode Fuzzy Hash: 705919241fd7327e9228dedaf34a825b7c72969f75913a6a26e53de9080fb7e2
Instruction Fuzzy Hash: A61106B1D003498FDB20DFAAC4457DFFBF5EB88324F248419D519A7240CB75A945CBA5

Function 06C42FB4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06C4C69D

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8367319cdfbec8e622b356e3a7cf80fe025d0e4d8a19f54446753101596e08c8
Instruction ID: 3d1071e6e56086da36d004a592201f8ba3bfc4b31f111f4ec222ad42c0607d3c
Opcode Fuzzy Hash: 8367319cdfbec8e622b356e3a7cf80fe025d0e4d8a19f54446753101596e08c8
Instruction Fuzzy Hash: 9A1103B58003499FDB10DF9AD988BEEBBF8EB48310F10845AE919A7210D375A954CFA5

Function 0268B1D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0268B23E

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2a30eee472dccdd8f89bfd380a81ecb5402f74f7844dce6fb70b1bbda1d65eeb
Instruction ID: 3ec8efdc8258e1acb4e979f5db6384d59362cab09fbc43164aa5d5b517835939
Opcode Fuzzy Hash: 2a30eee472dccdd8f89bfd380a81ecb5402f74f7844dce6fb70b1bbda1d65eeb
Instruction Fuzzy Hash: 2F1110B6C002498FCB10DF9AD584ADFFBF4EF88324F10852AD429A7210C375A545CFA1

Function 0268B501 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0268B2B9,00000800,00000000,00000000), ref: 0268B4CA

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 44cbcb54b91d73ac32a7762dc77e8ac9bb58580d5f40f52c4e3778f384cf9bc1
Instruction ID: 66a2259f0d3a7d797b73f5abef605bd9037291eae52e6b21280077cc9c508226
Opcode Fuzzy Hash: 44cbcb54b91d73ac32a7762dc77e8ac9bb58580d5f40f52c4e3778f384cf9bc1
Instruction Fuzzy Hash: 7901D4B19043048FDB10DF9CE8057AEBBF4AF95328F04816AE108D7651C3759415CBA6

Function 0785D6E0 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

4']q, xrefs: 0785D740

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 5465457cc265fa67e087f705c1745ed1b608bd38f1eef5f45c1a9d939768bd50
Instruction ID: f1cac5d0c7276e689c940a7fad735337ef401d224b25eec91d1a1f825c505a7e
Opcode Fuzzy Hash: 5465457cc265fa67e087f705c1745ed1b608bd38f1eef5f45c1a9d939768bd50
Instruction Fuzzy Hash: DD812EB4A00209DFDB08EFA8D881AADBBF2FB89314F20C559D915EB355DB359906CF50

Function 0785D6D1 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

4']q, xrefs: 0785D740

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a262cf99e45fa27436386d094ea5a2f9fd331f4c8180b12d2c590dff0571242b
Instruction ID: c7662025e755a421365c7a9405f38a945e158ada872d345eb6c5351e7a071406
Opcode Fuzzy Hash: a262cf99e45fa27436386d094ea5a2f9fd331f4c8180b12d2c590dff0571242b
Instruction Fuzzy Hash: DB8140B4A002099FDB08EFA8D891A9DBBF2FF89314F20C559D905EB355DB359906CF50

Function 07857910 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

(o]q, xrefs: 07857ADD

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 424cd517d9a189ce11358c77b8c112dfeb54c5f45478e86c49fccfb4b6f83feb
Instruction ID: 5fedda40626bf92efc16bb680d43a0975f377a5addacca80a945f243a304e6d4
Opcode Fuzzy Hash: 424cd517d9a189ce11358c77b8c112dfeb54c5f45478e86c49fccfb4b6f83feb
Instruction Fuzzy Hash: 31518EF5B00206CFCB15DFBAC894A6EBBB2AF94250F15C469D905D7354DB30E9418BA2

Function 078574E8 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

d8bq, xrefs: 078578E8

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: d8bq
API String ID: 0-3484500975
Opcode ID: 23fc2e37ffb13525b70692c62e2d10a2fb55b7780f5bb86504311e5e9552ec77
Instruction ID: e7540a44bd536a84ac6ba8efd571ecf73565275edda45379b4c482fbd07e0f98
Opcode Fuzzy Hash: 23fc2e37ffb13525b70692c62e2d10a2fb55b7780f5bb86504311e5e9552ec77
Instruction Fuzzy Hash: 03615CB5B001199FCB14DF68D858AAD7BF2EB88311F148469E902EB390DB71DC41CF94

Function 06BCDF54 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06BCEB01

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 818a250e7942f58ce22728b7956104132f47f0f2afd261f13ecd0de2c08e43d2
Instruction ID: 90aecd00a3f2b15276ae0eb3daa8560e9a5df34818d685430e9698bc47cb82e2
Opcode Fuzzy Hash: 818a250e7942f58ce22728b7956104132f47f0f2afd261f13ecd0de2c08e43d2
Instruction Fuzzy Hash: CD51C2B0B006068FCB45DFBD98549BEBBF6EFC52207158969E419DB391DB30DD0687A0

Function 06BC1AA0 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

, xrefs: 06BC1B1D

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e5753452e0b502413f2c01722f78b430a0a4cad597a0af8a3d373cab068fcd1d
Instruction ID: 6d9256bd4d7496138a3a7461b9f6b0b81b58728b228a6a3ca71d4cb575206154
Opcode Fuzzy Hash: e5753452e0b502413f2c01722f78b430a0a4cad597a0af8a3d373cab068fcd1d
Instruction Fuzzy Hash: 406161B4E002199FDB50DFA8D980A9DBBF1FB49310F249599E459F7302E730AA85CF51

Function 07850270 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

(aq, xrefs: 07850292

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 648fcc7a789cdcc696d759a18cb6e3a2ffb486d78234c4bed0b905d0657e2da8
Instruction ID: 07529a7820b652100107880c066c11838281ae260d3f91034dbea90391ad2c0c
Opcode Fuzzy Hash: 648fcc7a789cdcc696d759a18cb6e3a2ffb486d78234c4bed0b905d0657e2da8
Instruction Fuzzy Hash: 1C514932D00B168BCB11AF69D850185F3B1FF99320729CB6ADD5D7B205EB70B9918B90

Function 0785D570 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

8aq, xrefs: 0785D64C

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 4ed9385ab387a8753311825b3e159739effbfaea094b6ddd13c4cf79eded1d44
Instruction ID: c9de2d3c9b1d7d7af64062f9267c58b40a7e87ba42c8c35fe8fbb8ea05131b97
Opcode Fuzzy Hash: 4ed9385ab387a8753311825b3e159739effbfaea094b6ddd13c4cf79eded1d44
Instruction Fuzzy Hash: 914109B4E05209DFDB04DFA9D880AADBBF1EB59304F10806AD905E7351DB349A06CFA1

Function 06BCDBE8 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06BCDC53

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 051ddca09d67ae90cae5d76f561e5c6dba3cc19ccb5101d85af05d4682621258
Instruction ID: 20e41e0da363debc0a1d49482919e2f17ac309ccfe5aa604ecb5ba8fdbf2f407
Opcode Fuzzy Hash: 051ddca09d67ae90cae5d76f561e5c6dba3cc19ccb5101d85af05d4682621258
Instruction Fuzzy Hash: 8E4113B4E04119ABCB08DFA9D8456EEBBB2FF88310F10902AE914B7354DB745A45CFA1

Function 0785F738 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

{z}, xrefs: 0785F749

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: {z}
API String ID: 0-1552007774
Opcode ID: 9f79d67b7bbe41003cccb33122c5b98f2375536115b16ecad75c226a2c046189
Instruction ID: c01385cbeb99e39e9b012e45af37e772b3f33eb1d3b434958af0e19a6c3eaf2a
Opcode Fuzzy Hash: 9f79d67b7bbe41003cccb33122c5b98f2375536115b16ecad75c226a2c046189
Instruction Fuzzy Hash: F341ADB4E01229DFDB65DF68C985BDDBBB1BB48300F1081AAE549E7251EB309E85CF50

Function 04DF6BB8 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

(aq, xrefs: 04DF6C47

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: ce73581a2a4ec7fa38c6c3deb5ee171a966a5f3fd54a6c10743dc8efb7d9e1b1
Instruction ID: 2689c825e6f5d161a11d82a33c487e7ffa934f978f004e1c81274cc4d0a8c807
Opcode Fuzzy Hash: ce73581a2a4ec7fa38c6c3deb5ee171a966a5f3fd54a6c10743dc8efb7d9e1b1
Instruction Fuzzy Hash: F831E470A042499FC721DFA8C840A9DBFF5FF49304B1540AAD644EB752DB32EC42CBA0

Function 07851A88 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

4']q, xrefs: 07851ACE

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 014efec3c288b085e9d023c51fdf50d99a027849663a936a07807c8476ceaec7
Instruction ID: 96e48ce577d4be713f79b5e90fc25476858ea0ca874d53ce708c26f2603b79b8
Opcode Fuzzy Hash: 014efec3c288b085e9d023c51fdf50d99a027849663a936a07807c8476ceaec7
Instruction Fuzzy Hash: E721C971E0010A9FCB05EFB8D8519AE7BF6FF85300F11886AD5016F295DF346A05CBA2

Function 06BCE8C0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06BCE92B

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 36443a6ba36651a47d109ebc169100f47e7c5e61b322b898f5ccdea18b049c70
Instruction ID: 694683bd893f3771dd53f4defb70d3e5bfa9f18091435db4560b3b705dabd48b
Opcode Fuzzy Hash: 36443a6ba36651a47d109ebc169100f47e7c5e61b322b898f5ccdea18b049c70
Instruction Fuzzy Hash: D8114F71F0061A8BCB94EBB998105FEB6F6EBC5710B5041ADC505E7244EB358E06CB92

Function 07851A98 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

4']q, xrefs: 07851ACE

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: f760d8df98699c1a326f3ab3a12a0d5e15877e248b80eed2ba6e6aafb7981f2b
Instruction ID: b1d7c9f77c2b76413ba7c6580e886c153171babe3e74b732c74a5a51896ce6ed
Opcode Fuzzy Hash: f760d8df98699c1a326f3ab3a12a0d5e15877e248b80eed2ba6e6aafb7981f2b
Instruction Fuzzy Hash: 73118770E0010A9FCB05EFB9D8519EE7BB6FF85300F108969D5056B255EF346A05CFA2

Function 06BC45C2 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

`, xrefs: 06BC45E4

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: e3df7d25a435ba2a83383f5d4f0d9185d66ac1add9c14f1bf915f55cd6c5928a
Instruction ID: 41d9a1596bbe76fa22f806db18cd55b7bc60955f8e6affc7d6f1d029171a7bd8
Opcode Fuzzy Hash: e3df7d25a435ba2a83383f5d4f0d9185d66ac1add9c14f1bf915f55cd6c5928a
Instruction Fuzzy Hash: 07118CB0D052089FCB44DFB8C5546AEBBF1EB45324F1081EED944A7391DB358B05CB92

Function 06BC44FA Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

B, xrefs: 06BC451C

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: c270deee975bda77110c7f86c04b53c90c284a61655f144f06d39287ea2fdaf5
Instruction ID: 8d6df4362087077d46e4c86737292dc6eb1ae2d004c3517af5907cb1cfa820a2
Opcode Fuzzy Hash: c270deee975bda77110c7f86c04b53c90c284a61655f144f06d39287ea2fdaf5
Instruction Fuzzy Hash: 96017CB0E0520CAFCB81DFA8C550AAEBBF5EB45214F1081EAD945E7342D7319F15CB92

Function 04DFAFB1 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

4']q, xrefs: 04DFAFF1

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: d6a281d4bd5f2fd7644045a2c6481ecf8f98ce18d57c2e1b6cb6f9a564e71f84
Instruction ID: 95fd25c61ba6fa64b183612e23ecaa68ec59cb7de9ebb4a53a1ca6708a4f66d2
Opcode Fuzzy Hash: d6a281d4bd5f2fd7644045a2c6481ecf8f98ce18d57c2e1b6cb6f9a564e71f84
Instruction Fuzzy Hash: 8A018F70A0110ADFCF04FFB8E558AACBFB1EB49301F2185AAE8159B351DA380E44DB11

Function 04DFAFC0 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 04DFAFF1

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 1e8b291ae4c3295345efdc2247b8a26c2bdd96f512572a639c2000bb69cdf6d1
Instruction ID: f89be836efa4d1a75a7df4c70e8524b97a3215e97bd754e78d9890ada3b4663c
Opcode Fuzzy Hash: 1e8b291ae4c3295345efdc2247b8a26c2bdd96f512572a639c2000bb69cdf6d1
Instruction Fuzzy Hash: AFF03C70A0120AEFCB04FFB8E5599ACBBB1FB48302B2185A9E81597350DE385E45DB55

Function 0785CA68 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

?, xrefs: 0785CA7C

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 238dbd012f05685924c01f508e082a637fe6fe357399281fb133db3dac8962f3
Instruction ID: f4505900c429e77ec2e481db80734c49ae7a3f4474313e2898f64f95e7ee012d
Opcode Fuzzy Hash: 238dbd012f05685924c01f508e082a637fe6fe357399281fb133db3dac8962f3
Instruction Fuzzy Hash: 3EE0C2F080430AEBCB01EFB5D54A2ACBFBAE70A205F1045A9D806D3241D7340A44CF62

Function 04DF7FE8 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf0842ba604283c9ccf335a3452a4b3cca1bee55410721baa6d7aca65ddbbba
Instruction ID: 714d8ddb2d7a2b93ce5ca8fa95d821ab5d32544bdf3bb609a0e75888b106edf3
Opcode Fuzzy Hash: fcf0842ba604283c9ccf335a3452a4b3cca1bee55410721baa6d7aca65ddbbba
Instruction Fuzzy Hash: D862ECB1D00B42CAD774AF65C8983AEB6A1FF41304F124D5BE2BACE244EB74B451DB52

Function 04DF7F88 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6818d5aea02da5f54e68c605dc939820b910715594a999ef78aaecb5e93443
Instruction ID: 5ad7c5458b992141c07caeadf5ab43e05de43a29f3c95a9d76c0262490da911a
Opcode Fuzzy Hash: 1e6818d5aea02da5f54e68c605dc939820b910715594a999ef78aaecb5e93443
Instruction Fuzzy Hash: FE227EB0905B42CAD7706F65888439FB690FF06310F214D5BE2FACE259E774A096EB47

Function 07857B00 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e89e32aee673aebf9c7e684589b02a55e1cb7eab1959bc6da13835cb3645be
Instruction ID: 160b246ccf0ce5c99d67353d98e6ce7eff917e8c9322b1d211bc7bfec0103688
Opcode Fuzzy Hash: 40e89e32aee673aebf9c7e684589b02a55e1cb7eab1959bc6da13835cb3645be
Instruction Fuzzy Hash: E5B16CB160021AAFCB05DF68D854AAE7BA7FB88310F14C429ED06D7394DB34DD52CBA1

Function 07850900 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1619afcfbe16589e68c5eaddab969d6eff52ac6ea30616533b29864578fae0
Instruction ID: 3d779f79b2eb63615efa9b29dd3c6ea3f048e0add528f9ea0ffc383879b555f9
Opcode Fuzzy Hash: 1b1619afcfbe16589e68c5eaddab969d6eff52ac6ea30616533b29864578fae0
Instruction Fuzzy Hash: 5CC18D35B002058FDB04EF39C89479AB3A2FF89304F55857DD90AAB3A5EF75A845CB50

Function 04DF2C74 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697e01aa0f4811aec00cd0df3b9ae14cbf4beffd34d2d0e98c4141865ca750c3
Instruction ID: a5d8f84f71347ae8d60d626a71983dea3aacefd55da7557ee39df3e41ddc38fe
Opcode Fuzzy Hash: 697e01aa0f4811aec00cd0df3b9ae14cbf4beffd34d2d0e98c4141865ca750c3
Instruction Fuzzy Hash: 0FB11734B102148FDB24DF69C894AAEBBF6BF99714F1641A9E505EB3A1DB30EC41CB50

Function 078508F1 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb4ac865c959ff14ed10d251d9cb90000eab656d4cb6fb0e4ba1d3ca1cd6fc6
Instruction ID: df536984a96b751e43a77a25a9e62bb352c231dbb0c42d4a0910ff45974f0696
Opcode Fuzzy Hash: 3bb4ac865c959ff14ed10d251d9cb90000eab656d4cb6fb0e4ba1d3ca1cd6fc6
Instruction Fuzzy Hash: 4AA17D35B002058BDB04EF39C89479AB3A2FF89304F55857CD90AAB3A6EF75AD45CB50

Function 06BC14E7 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3021c66e88e40e51d26b3234a1d1ab3e8991ce56c3ce79e6246b4e3901cc09
Instruction ID: 0614d243dd34d6658a9b3bdd38d8064548606c3a8c5d143e2af0a9275db1155c
Opcode Fuzzy Hash: 8f3021c66e88e40e51d26b3234a1d1ab3e8991ce56c3ce79e6246b4e3901cc09
Instruction Fuzzy Hash: 88C160B4E002298FDB90DF68C980A9DBBF2BF49324F158199D41DAB356D730AE85CF50

Function 04DF71B0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1556bd9b27c7a875d0964e241e13487c2b38c1fd40f9b7a94172ce19792c8f
Instruction ID: 9765a8a13df240849fe38568a60315c42df43b4c2b4fb3d6a26409814289637d
Opcode Fuzzy Hash: 0a1556bd9b27c7a875d0964e241e13487c2b38c1fd40f9b7a94172ce19792c8f
Instruction Fuzzy Hash: DB81C5387106109FCB14EF68D89899D7BF6BF89704B1681A9EA02CB375DB71EC41CB90

Function 04DF2B2C Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dcb2a3b102313e0ff2a346b0b970377fa2ab7e4f847254699ce96afb080145
Instruction ID: d8a7f926b4d16a23007c3c287063b1a5bcaaf6f8fea9965557b2f1657f201f12
Opcode Fuzzy Hash: 92dcb2a3b102313e0ff2a346b0b970377fa2ab7e4f847254699ce96afb080145
Instruction Fuzzy Hash: 556162703006418BE729EB79C850B6AB6A3EFC8304F51886DD61A9B384DF75FC45CBA4

Function 04DF3E81 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeedbae85b1c823b84e39e6dbc7a0f690b6ec9b0e159d8167f28ca1dff6e6a76
Instruction ID: 32eda4184bb83c1bcab51e9c66934d39723acd58de4b7ed7b5cecb8401d5de08
Opcode Fuzzy Hash: aeedbae85b1c823b84e39e6dbc7a0f690b6ec9b0e159d8167f28ca1dff6e6a76
Instruction Fuzzy Hash: D36162703006418FE729EB78C85076A76A3EFC8304F51886DD61A9B394DF75AC46CBA4

Function 04DF5778 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fdb80802de8e0fc2f0cee928e9d20be78a7880954bb3700c0d3790085ea446
Instruction ID: 1bff8255e7890de20145e93341677d31afdfb4759aec0a0f6f29c88c5ee3e084
Opcode Fuzzy Hash: b4fdb80802de8e0fc2f0cee928e9d20be78a7880954bb3700c0d3790085ea446
Instruction Fuzzy Hash: C7717F74A01208EFCB15DFA9E894D9EBBB6FF49714B514498FA01AB362D731EC81CB50

Function 04DF1048 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d027239902bf23951f534327724f646818ea625ba64e1f7bbb35344e77aba1cb
Instruction ID: 2371efc6cae536fad5b7e5c41fe9e4aee7f6be364d6b4723631858e406523049
Opcode Fuzzy Hash: d027239902bf23951f534327724f646818ea625ba64e1f7bbb35344e77aba1cb
Instruction Fuzzy Hash: AF419930B02218DFCB14EFA4E8545AEBBF2FF88304F21846AE441E7295DB34AD55CB90

Function 04DF55B8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e7016cfc0979fdd9c7f60bc533e1382a5e488c9c6b93920e139b840956c4c9
Instruction ID: 236fcbade61362b68f9d809c1cd57ea87834f9056f8891d25d1550e6c6b4db82
Opcode Fuzzy Hash: 76e7016cfc0979fdd9c7f60bc533e1382a5e488c9c6b93920e139b840956c4c9
Instruction Fuzzy Hash: FF61ADB4E0020A9FDB64DFA9D884AAEBBF1BB48304F15856AE519E7354E730A941CF50

Function 04DF76F0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42adee8514049149dcf5b17b53c3263bce8c2e32a701ea7b1bda0ebddb5554b
Instruction ID: 9c2dfffdc2846762f837ce39875fd1735d23c0eabf4e8f45f2b490af8664a814
Opcode Fuzzy Hash: e42adee8514049149dcf5b17b53c3263bce8c2e32a701ea7b1bda0ebddb5554b
Instruction Fuzzy Hash: FF51A032B005199FCF21CFA4D8809EEB7B6FF45704F068066EA05AB261DB75F906CB90

Function 04DF9771 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc3a3feb1906be686b9c08fb2399a29a2a645e2cf721ad78b71fee161b8103e
Instruction ID: 23e88862ae00de818a000549b732ec0a8b011d25c191d81ed41a40a96c1d4833
Opcode Fuzzy Hash: 3cc3a3feb1906be686b9c08fb2399a29a2a645e2cf721ad78b71fee161b8103e
Instruction Fuzzy Hash: 9B61BDB4E0020A9FDB64DFA9D880B9EBBF1BB48304F15856AE519E7355E730A981CF50

Function 04DFFA98 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d247a3fa9868f286847e4ff0b765f9bb5e4fb74e358a2f0b2fb1330c501ee94f
Instruction ID: 4b16f209a3f4129a8477c91c524c2805b7842aa067280d0a265846b3b8ceee8f
Opcode Fuzzy Hash: d247a3fa9868f286847e4ff0b765f9bb5e4fb74e358a2f0b2fb1330c501ee94f
Instruction Fuzzy Hash: 8851A2317002048FD724EF68D894AAE7BE6EF89304F15446EE505EB3A1DB75EC45CB61

Function 04DF02D0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b10d732a10b5faa1b4b50461823ed56e409e2cb4248fc320dc0814f61f4277
Instruction ID: b4b97b8185cb5cff8d03c21749fbd723eacdd58397377bb891bfc20e5fa2105b
Opcode Fuzzy Hash: 14b10d732a10b5faa1b4b50461823ed56e409e2cb4248fc320dc0814f61f4277
Instruction Fuzzy Hash: 5F517FB1E002498FDF15DFA9D914AAFBBFAEF88304F10842AD515E7351DB74A901CBA0

Function 0785F0F0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b342e1917a2879c9cfaef6f2172d4fed05b7610ecae48c84b9df899294ca032b
Instruction ID: 8f5c55582a2865bc19921f42df59d8dd7ce0e4869c9181e4d80813bdb77e8f0e
Opcode Fuzzy Hash: b342e1917a2879c9cfaef6f2172d4fed05b7610ecae48c84b9df899294ca032b
Instruction Fuzzy Hash: 8E51CFB5E01219CFCB15DFA8E984A9DBBF5FB19314F24842AE909EB314E734A945CF40

Function 06BCD1C8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979b4dbd8d938648e9218704b09839245ea16f04981c6379f92abbb71f3be98a
Instruction ID: 4e957369875444da7d03a675b169af0a0f6a7526156d9c43d3de85d8d4a5e0af
Opcode Fuzzy Hash: 979b4dbd8d938648e9218704b09839245ea16f04981c6379f92abbb71f3be98a
Instruction Fuzzy Hash: C051D6B4E04218AFDB48DFA9D884AAEBBF6EF8D310F119069E505B7354CB349945CF60

Function 07852780 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044a10c024f30ea502bc00bae89cb2dd02dec7b21f0f7b079b31eedbe2887122
Instruction ID: 6a27923e842c179922465de10408df19e879d4ed25665b473595aa02e3b39723
Opcode Fuzzy Hash: 044a10c024f30ea502bc00bae89cb2dd02dec7b21f0f7b079b31eedbe2887122
Instruction Fuzzy Hash: 3041C0B1600215CFC719AB7884546BE77A6FF85300F05886ED809DB3A1CF34A846CB92

Function 04DF9268 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e510c8f63fbbb7f88a4aa0f052a943cf9d293cfb667a547190b1315fa34fda
Instruction ID: 79383cf160d3c30b7e80b6f09b1f2649e70810c574bb29086d3c1e28796746e5
Opcode Fuzzy Hash: 60e510c8f63fbbb7f88a4aa0f052a943cf9d293cfb667a547190b1315fa34fda
Instruction Fuzzy Hash: A6416A74B141589FDB24DFA9C8A4EADBBF6BF49304F1540A9E601EB3A1CA31EC00CB10

Function 04DF576B Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81e534f3839bc90904c807d78cfebf3db7285edee77986e7af6dc74cd33255e
Instruction ID: 431db1d4ac1bd000f814004a9000ba4b815190d25fe443982d72995818aa4efe
Opcode Fuzzy Hash: a81e534f3839bc90904c807d78cfebf3db7285edee77986e7af6dc74cd33255e
Instruction Fuzzy Hash: 07518238601604EFCB14DF69D894DAEBBB5FF49720B1144A8FA02AB362DB31EC41CB50

Function 07853B18 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c637c9770a6e24f86a5b6425f483d499536381f33c01f79675586ba1e7e3ce
Instruction ID: 626eaba1db5debf663f5adc317041165f6c6bf352d6f4784f4ea16e6c8158077
Opcode Fuzzy Hash: 87c637c9770a6e24f86a5b6425f483d499536381f33c01f79675586ba1e7e3ce
Instruction Fuzzy Hash: 73417CB6F0021ACBCF15DFA9D454AADBBF1EB89368F148165D801EB700DB349D05CBA1

Function 04DF9C8C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc9d1638c418d7e9f691a6653114bfb2bd5850ba4153783e3f74b35336182c
Instruction ID: b6a0b67cf3a12546b198e9dad64f31213b17748cea90531d049bc1e689e863ac
Opcode Fuzzy Hash: 6edc9d1638c418d7e9f691a6653114bfb2bd5850ba4153783e3f74b35336182c
Instruction Fuzzy Hash: 57415E70A10209CFDB14EFB8C854AAEB7F1FF85304F11856AEA45AB365EB70E944CB50

Function 04DF6208 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f5bd22ffb963b3e5873e6b87bfa199a264e001c9841794af7d2a338baf91c6
Instruction ID: ffdf7df86467b0099749ca2c69ae880b8c5044f06ce879025d282b46079f66bb
Opcode Fuzzy Hash: 97f5bd22ffb963b3e5873e6b87bfa199a264e001c9841794af7d2a338baf91c6
Instruction Fuzzy Hash: AD41D734A002188FDB54EFA8C854B9D77B2BF48704F154159EA05AB3A1DB75E845CFA4

Function 07857C4F Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25b94ef6d18b9b0363f35637d729fd815bff790d701cc1c59234cee65569281
Instruction ID: ceb0808096857bfb34cbf5d62bef48a3609477b2582be9c3284c819935d5d44e
Opcode Fuzzy Hash: d25b94ef6d18b9b0363f35637d729fd815bff790d701cc1c59234cee65569281
Instruction Fuzzy Hash: B54128B460021AEFCB059F64D858AAE7BA7FF84750F148429EC0297394DB349D62CB90

Function 06BCCFB0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c27b1dcde41a54d85b64ac9f6c25478e46b9342f7f9d04d2fc74837b7ced9c
Instruction ID: 3664b00f913299496177d465dbda9ea0a44a1bc6d8f4d39b6a005a29a1c2c8e6
Opcode Fuzzy Hash: c4c27b1dcde41a54d85b64ac9f6c25478e46b9342f7f9d04d2fc74837b7ced9c
Instruction Fuzzy Hash: 8441E278E112189FCB00DFA8C584AEEBBB1FB4C320F10A569E800B3354D7759A55CFA0

Function 06BC3A21 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bf43e4824f6902f775ea6975c49a2cee810c3e542fcc0442ffae2aca94faf3
Instruction ID: 50c4d1f66c0f90f699cd63614a93b7780894fa6526868fdfdefd4979a83f2843
Opcode Fuzzy Hash: e3bf43e4824f6902f775ea6975c49a2cee810c3e542fcc0442ffae2aca94faf3
Instruction Fuzzy Hash: D8418AB8E00619EFCB40CFA9D88499DBBF5FB48310B1495A9E919EB315D734EA51CF40

Function 06BC030C Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d956b1deb1b255c0ab4be425a32c600a17fc9f3e7bc4917117b58a42768fef7c
Instruction ID: 70951454831a90608d1ebfe2fd962f91a1e963d58fb5444a19272d478c44a5f4
Opcode Fuzzy Hash: d956b1deb1b255c0ab4be425a32c600a17fc9f3e7bc4917117b58a42768fef7c
Instruction Fuzzy Hash: C1417CB5E15219DFCB50DFA8E484ADDBBF1FB48221F10956AE924E7210E331AA41CF50

Function 04DF013C Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccc0d6a2b2090e88e07b79ac34749b222c4db7a5b719f06097ecda5c7ed7830
Instruction ID: 8a7e30f06f8a71c985e72f6c1cf1e4a606793f506670ee6d217e5dba814d8584
Opcode Fuzzy Hash: 9ccc0d6a2b2090e88e07b79ac34749b222c4db7a5b719f06097ecda5c7ed7830
Instruction Fuzzy Hash: 0641E2B1D00309CBDB25DFE9C9846CDBBB5BF48304F25812AD408BB211D775AA8ACF91

Function 04DF0148 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6b6728577d48c0dc64e9204b17538a9f8188e7398163b90b0df8b036ecf7b8
Instruction ID: d0ddc3eca34e3bcbcfa25b5905f6806a7be874e2c52f92f40cd80306ec9b1779
Opcode Fuzzy Hash: 6c6b6728577d48c0dc64e9204b17538a9f8188e7398163b90b0df8b036ecf7b8
Instruction Fuzzy Hash: 3E41C1B1D00309DBDB21DFA9C984ADDBBB5BF48304F25812AD408BB201D775AA4ACF91

Function 07852E57 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f7847968c45b54ceda6761be158514ad3432e61e265257418248727d40cb95
Instruction ID: 66746271ec064e8dee182570cd2b7d15ed7fd61b9cfd8634823df47133cbfec4
Opcode Fuzzy Hash: 05f7847968c45b54ceda6761be158514ad3432e61e265257418248727d40cb95
Instruction Fuzzy Hash: E531CEB2E003018BEB11EF69D880B55B7A2FF99314F09C579DD09AB306EF34A444CB61

Function 078528AC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93c44d953347eaf16721f1efd19182f32f5fa8b9c1ef82ecfc321524652cedd
Instruction ID: ad4ed8886f015aaf83962d11abe4266d22ab8610c1f6ce4e7ae4e91a25427f22
Opcode Fuzzy Hash: d93c44d953347eaf16721f1efd19182f32f5fa8b9c1ef82ecfc321524652cedd
Instruction Fuzzy Hash: 9E3192B1E103018BEB14EF69D890B55B7A2FF98314F05C979ED09AB305DF34A444CB61

Function 06BC08DE Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf3ecc224bb273ef720c3b2e7d81718057debc671f49cfd666f41ca14f42566
Instruction ID: 3126a09b05c79b77b2f2f3e42f8409ede937f091b58f60acbdb31a9e7feb6c2d
Opcode Fuzzy Hash: 4cf3ecc224bb273ef720c3b2e7d81718057debc671f49cfd666f41ca14f42566
Instruction Fuzzy Hash: 4B41D3B4E00309DFDB04DF98D584B9CBBB5FF49310F1180AAE819AB362D375A980CB40

Function 04DF92EE Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c317ae30c0856130051c82641476996bf7c739273e558e10e0d16c35ee9e7706
Instruction ID: 54b59c3e47b1c27a66e2eb07f2c940099a3baf3e020f2c65fa5bd563c72da3e7
Opcode Fuzzy Hash: c317ae30c0856130051c82641476996bf7c739273e558e10e0d16c35ee9e7706
Instruction Fuzzy Hash: 2F311274B142548FDB24DFA9C8A4BAD7BF6BF49704F5600A9E606DB3A1DA31EC00CB10

Function 04DFB8C0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce046bc85a6120d582ccae621e60f12588c1ed6dfa94fd0bb26c89b56457a58
Instruction ID: adac5e9511cbeffcfd314b4434c5d418c7eda05b36ac45212591d2430e340c60
Opcode Fuzzy Hash: 5ce046bc85a6120d582ccae621e60f12588c1ed6dfa94fd0bb26c89b56457a58
Instruction Fuzzy Hash: 65317A70A102158FDB14DFA8CC54BAABBF4FF45304F1284AAEA45DB361E7B0E900CB50

Function 06BC3A36 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52913aa88d6a46d9ed9e8b1bfaf53a063a5b93cf260bc423833cf31fe0afc8ab
Instruction ID: 594d2b641339ebc2fa3842ffa50dbe027db7bda9e20a9eefc789b3c656916db7
Opcode Fuzzy Hash: 52913aa88d6a46d9ed9e8b1bfaf53a063a5b93cf260bc423833cf31fe0afc8ab
Instruction Fuzzy Hash: DF3158B9E00619AFCB40CFE8D88599DBBF1FF48320B1485A9E919EB355E730E955CB40

Function 0785FCA8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfca42fe190d3d186e2eaea37bcffb97f02bcd4a0ab71e92c936de30a0da92e
Instruction ID: cb3c4ae0a5faf2e549b76fa1e5ca8b91721f0f8870d58ba781d828e634c7a37a
Opcode Fuzzy Hash: 7dfca42fe190d3d186e2eaea37bcffb97f02bcd4a0ab71e92c936de30a0da92e
Instruction Fuzzy Hash: BB31C6B4A1521A9FCF14CFA9D888AEDBBF5AF59310F149069E901F7250DB309941CF64

Function 04DF0040 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb4aad5aeef7a2c5dc5e86523415e3426c716ddeb6eb33376d86577d15a005b
Instruction ID: 190a26a96301a6d210411a4e4e8707bd0a509b5c2e262a0685f192a64af4d675
Opcode Fuzzy Hash: ffb4aad5aeef7a2c5dc5e86523415e3426c716ddeb6eb33376d86577d15a005b
Instruction Fuzzy Hash: 912173316042058FCB11DF78C45459ABBF6EF85318B15C8AED946DB351EF71EC058BA1

Function 04DF02C0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5385ca0805bcc8c486258e6751015114935c98c5c5312239af41b32325d90f4
Instruction ID: 88ff961c65df29ac65bab1969073745b984f46082cca48de96d8dc75ac91b0e7
Opcode Fuzzy Hash: a5385ca0805bcc8c486258e6751015114935c98c5c5312239af41b32325d90f4
Instruction Fuzzy Hash: B6215E71B001559FDF15EFA9CC109AFBBFAEFC8204B10856AE555D7251EB709E01CBA0

Function 06BCCCA0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ce51b5a3bd8d279b268c72f0cc4ff3a8454123f28df458286379be93c8ff6
Instruction ID: 1da6d348473bfe80d1be7a616b92f5162ad651d2918e5175315b9cdff40879ed
Opcode Fuzzy Hash: 7f3ce51b5a3bd8d279b268c72f0cc4ff3a8454123f28df458286379be93c8ff6
Instruction Fuzzy Hash: 47315CB4E00209AFCB05DF98D841AEEBBB6FF88310F109525E904AB354DB709A54CFE0

Function 07852BB0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa6e22f1332cf6da345f884df5b7e6b158aeb3c9f637eae777d37faa6b769da
Instruction ID: 0f3d5610c37a386d49ddb61e315a04822abbe52d9b683453878c15f1d642a6e4
Opcode Fuzzy Hash: bfa6e22f1332cf6da345f884df5b7e6b158aeb3c9f637eae777d37faa6b769da
Instruction Fuzzy Hash: 4B217F743102148FE708AB28C465B6E37A7BF89B14F05815DE906CF3E6CEA5EC428B95

Function 0785DBD1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c06f73d3f8f81eea1cd5034f13a0fbc4b1bdad3a834d9c88070f6bf4bffbc4
Instruction ID: 606142bbbca08c80642703b089a89124088dc99bdd922798771c3ed0a385f8c0
Opcode Fuzzy Hash: 19c06f73d3f8f81eea1cd5034f13a0fbc4b1bdad3a834d9c88070f6bf4bffbc4
Instruction Fuzzy Hash: 17319CB4E0521ADFCF40DFA9C9846EEBBF1AB58210F1484AAD814F3340E7749A40DFA1

Function 0785D432 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b1aada319e5cdbdc88de3c510d25b3ff226929b4dec0fcc357f9eb506db7df
Instruction ID: 2960071caf9cecf8b6ab3edb0014636a388179411af6906e180893caa50cbc18
Opcode Fuzzy Hash: b0b1aada319e5cdbdc88de3c510d25b3ff226929b4dec0fcc357f9eb506db7df
Instruction Fuzzy Hash: 2D2148B4A0524ADFDB05CFA9C8945AEBBF2EF89204F1484A6DD05E7250EB34D906CB60

Function 04DF2458 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2588307106359cbca468d6b4b32ef0e0be6d856835d7853a053cd38f33f94402
Instruction ID: 6561f15e657d424eb6397f1b2a7f6cd84dc666e88b5e0f88f8752c444aafcc32
Opcode Fuzzy Hash: 2588307106359cbca468d6b4b32ef0e0be6d856835d7853a053cd38f33f94402
Instruction Fuzzy Hash: 1D21B031710B018BD734CE38D896A6AB7F5FB45310F050E6AE2AACB740D776F8488B90

Function 00DFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f441a1259b281f5c30c3c732046e2eac44dd53b33b17627b3737fb785242a1f
Instruction ID: 6380d2ced86de6cb3bd3e131468b9304df29c020e42ffb27dd6e25310fc9b424
Opcode Fuzzy Hash: 0f441a1259b281f5c30c3c732046e2eac44dd53b33b17627b3737fb785242a1f
Instruction Fuzzy Hash: D82128B1504248DFDB05DF14D9C0B26BF67FB94314F34C569DA090B256C336E856C6B2

Function 00DFD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd343b0b50199798d56cb4518b689f768d3a48f6b4f7773e14ea4e6914532ca
Instruction ID: 2dd8bfaa72effc786f3a804ea185590ce778acdfb9feae6648b9d1ad45c21b35
Opcode Fuzzy Hash: 0fd343b0b50199798d56cb4518b689f768d3a48f6b4f7773e14ea4e6914532ca
Instruction Fuzzy Hash: 4A21F1B1504248EFDB05DF14D9C0B26BF67FB98318F24C569EA490B356C336D816DAB2

Function 07852BC0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39866c9b321837b50afb04a0acc5b83d6824cc58a5f55b9ea0a903e82f578ff6
Instruction ID: 763b8fb301fa73518c6424b34d7aa31697ef8c1977ee8a25e1f804b82864a467
Opcode Fuzzy Hash: 39866c9b321837b50afb04a0acc5b83d6824cc58a5f55b9ea0a903e82f578ff6
Instruction Fuzzy Hash: 65216F743102158FE708BB28C468B6E3397BF89B14F51816DE906CF3E2CEA5EC418B95

Function 04DF244B Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09f8f6e26891014e84f269c7bbe3058d8acd1b624945e43c847e375acb06d18
Instruction ID: 51541459e493baf5fe2485d3148a779cad5a5bfdbccdddf15b393e66dbd24994
Opcode Fuzzy Hash: a09f8f6e26891014e84f269c7bbe3058d8acd1b624945e43c847e375acb06d18
Instruction Fuzzy Hash: FE21D271700B018FD735CE38D89666AB7F2FB45310F090EAAD2AACB741D765F9498B50

Function 00E0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029128854.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7852ae2f939cd7242d12779647944c72e34e8636dbf11f1b3962a01c878c2a9
Instruction ID: a1d23cc846b0356535782ba251c5794d042a88380882050bbdb5caaf67ab0a2b
Opcode Fuzzy Hash: d7852ae2f939cd7242d12779647944c72e34e8636dbf11f1b3962a01c878c2a9
Instruction Fuzzy Hash: FE2104B1508304EFDB05DF94D9C0B26BBA5FB84318F34C56DE8095B2A6C336D896CB61

Function 00E0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029128854.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d57e64d6ae5b85c55bbe8cd7059a761583941875a5b0fcefa1bb9838cf1059
Instruction ID: f7871a8c824726bb345ba0ade03f02938ee48bff691504aad133e08dd71e67fd
Opcode Fuzzy Hash: d4d57e64d6ae5b85c55bbe8cd7059a761583941875a5b0fcefa1bb9838cf1059
Instruction Fuzzy Hash: 5E21F2B1608240EFDB14DF54D9C4B26BBA6EB84318F34C56DD84E5B286C33AD887CB61

Function 04DF2E78 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342d7b101bb7f903d84b403538ea424e2548b0a81cee5159a12a4d119bb54167
Instruction ID: e5d17936b8fe3f5d421a054f7701bf1ceac53412d08800148f4592f09e2b032f
Opcode Fuzzy Hash: 342d7b101bb7f903d84b403538ea424e2548b0a81cee5159a12a4d119bb54167
Instruction Fuzzy Hash: 4C21A135700600AFCB24DE19E8A4E6B77BAFF89710F12842EEA4687751C772F841CB90

Function 078574B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcd03e221ba9829fe5f427f794df9446a47ae52ed3250023f10d7c307d29545
Instruction ID: a66b96d1b0a31b39ccc74368cac4ead52777fcd800a1727728ded43d1b9eef60
Opcode Fuzzy Hash: 2dcd03e221ba9829fe5f427f794df9446a47ae52ed3250023f10d7c307d29545
Instruction Fuzzy Hash: 51217EB1A002199FCF05DF68D854ADD7FF1EF48320F1484AAE901AB2A0CB319D54CBA5

Function 0785D450 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ae713c97c99f8a7e19a53f51ab22d8ac10aed8413a1cae48d1cb85119e2472
Instruction ID: 3e913d478ef5fecfa4508bf095bf6fe76ecee5ef5d1cfed0651a7b6380620596
Opcode Fuzzy Hash: 07ae713c97c99f8a7e19a53f51ab22d8ac10aed8413a1cae48d1cb85119e2472
Instruction Fuzzy Hash: 3A2114B4E0020ADBCB04DFA9C8945AEBBF5EB89304F1094A9DD05E7350EB34E942CF60

Function 06BCC9B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ca5098eb37047a32c2a32328effa81d235098213b580de678501d912f45add
Instruction ID: 804d99b515b3722f5c1e1e2f028be2a1d85d5f91fd34a4551fbe85e0a32b74d5
Opcode Fuzzy Hash: 66ca5098eb37047a32c2a32328effa81d235098213b580de678501d912f45add
Instruction Fuzzy Hash: 8E31E370A10508EFC748DFAAE68599DBBF1FF8C314B6290D5D848AB369DB349E10DB40

Function 04DFC510 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a69df98db89a856f5dfc4b7beb9002760c5650e11842857aebd9df0608bb30
Instruction ID: 03b1726b547f997b9697225690dde0a443c78a89adb632d10cfb55094520c21e
Opcode Fuzzy Hash: e5a69df98db89a856f5dfc4b7beb9002760c5650e11842857aebd9df0608bb30
Instruction Fuzzy Hash: 1F21A5303042208FD724AF28C4487D937D6EF45704F56856EE6868F3A1CBB6B8468795

Function 04DF48F3 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407646086f1fd4d089694ba73f50dd674a5a1b4e1996cba82e8af19e408c9793
Instruction ID: e209aea3f9d8e55cbef87f31d451870810297597e32e8f94d447f1e906b4a509
Opcode Fuzzy Hash: 407646086f1fd4d089694ba73f50dd674a5a1b4e1996cba82e8af19e408c9793
Instruction Fuzzy Hash: 92214639710210CFCB14DF28C858A6A77F2FB89701F1685AAE546DB761CB75AC41CB60

Function 04DF5060 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84015b720ec89a74af52da6861f1299398f194989df4481c5688950c085cef
Instruction ID: 031592d43c4b7d54b6f7d53730fe6771bbe57be4c9a6e42a95bccaecbf919573
Opcode Fuzzy Hash: be84015b720ec89a74af52da6861f1299398f194989df4481c5688950c085cef
Instruction Fuzzy Hash: 51214D35700600AFCB249F19E894E6A77B6FF89714F06846DEA468B762DB71F841CB90

Function 04DF5FC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f65889adaf7ff882bc365afc2ffa51c83f0c1767a1c23ab8b9047fc68959ee
Instruction ID: 97519a8001e3a2dc8290a820fce1b2a75716e0b9059b7eb07af03e8993df9a14
Opcode Fuzzy Hash: b1f65889adaf7ff882bc365afc2ffa51c83f0c1767a1c23ab8b9047fc68959ee
Instruction Fuzzy Hash: BB21FF71E0020A9FCB05DFADC8448EEFBF9FF99300B11865AE514E7211E770A952CB90

Function 06BCE0F4 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f040681e7e02998cd612431dfcab9f7e846b74658005ddfa1c7657f3e67feb1
Instruction ID: 901f3e8d1b2b440f7215b096d3c91d4ce449a3247ff74e04c1e722a41045a708
Opcode Fuzzy Hash: 0f040681e7e02998cd612431dfcab9f7e846b74658005ddfa1c7657f3e67feb1
Instruction Fuzzy Hash: 9931E0B0C01318DFDB60DF99C988B9EBFF4AB08314F208469E405BB240C7B5A946CBA5

Function 07850647 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0563892eefa1a50ad2869279429db66a1ebb31b9809a84b980d6066dc7b6856c
Instruction ID: 185769090d85f87b340c75561bf10abec79737d182b3e268c8db828dbe2bf9fe
Opcode Fuzzy Hash: 0563892eefa1a50ad2869279429db66a1ebb31b9809a84b980d6066dc7b6856c
Instruction Fuzzy Hash: 7521E131A047418BDB01EF38C894295B7B2AF8A308F09C6BDDD896F266DB75A444CB51

Function 07850658 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dd9e2eced289151a6c19b976c8a464f3ca555f74d6b6d0cc914c6e6da82fa2
Instruction ID: 11071ede5ce143e9aeeef7df1a348caf7815676baedb4de91a6699ea31213d30
Opcode Fuzzy Hash: e2dd9e2eced289151a6c19b976c8a464f3ca555f74d6b6d0cc914c6e6da82fa2
Instruction Fuzzy Hash: BD219071A006008BDB01EF39C894695B762EF8A304F0986BDDD496F356DB75A444CB61

Function 04DF526C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4ebff0cebc91c6cf2ed432d1eb97d50fd82e81eaf43816f4efe7f0ff0bb899
Instruction ID: 071e69385503ebb381e22b2b98e915a679df9427ab6e60223e633eaeec4eeff4
Opcode Fuzzy Hash: ec4ebff0cebc91c6cf2ed432d1eb97d50fd82e81eaf43816f4efe7f0ff0bb899
Instruction Fuzzy Hash: DB21ED71E1020A9F8B45DFADC8848AFFBF9FF99300B11865AE514E7211E770A952CB90

Function 00E0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029128854.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbbcc123ad7fb0c4cbfc00850e0bef4f2394391115db02304872a3e770ccc70
Instruction ID: f9d9417eafd2713a109e0c95c3e2f013f289c3f077e16d8f30d0f820951da325
Opcode Fuzzy Hash: 8fbbcc123ad7fb0c4cbfc00850e0bef4f2394391115db02304872a3e770ccc70
Instruction Fuzzy Hash: A121837550D3808FC702CF24D994715BF71EB46314F28C5DAD8498B6A7C33A984ACB62

Function 04DF60F9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a8a04f81cdba9931de1216f01d9fbfbfa48e4912ff0ce13aac10f84e06d07c
Instruction ID: 628fe46fa876bf52abfa3b55ae130b57a48bebaa25d91e298c9664d2cb48fe72
Opcode Fuzzy Hash: 38a8a04f81cdba9931de1216f01d9fbfbfa48e4912ff0ce13aac10f84e06d07c
Instruction Fuzzy Hash: E711C1303046004FDB29AB29DC9092EB7E7FF81314B55C96EE5068B696CB74E843C7A4

Function 04DFDED8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5591f095f665e36c11a2485a59790f0869dc5b785348e338f1111bb16698250
Instruction ID: 537a8cb3679f257b90c97008002142e1df8a3b1bd07007b9a6c285ed63be2dcd
Opcode Fuzzy Hash: b5591f095f665e36c11a2485a59790f0869dc5b785348e338f1111bb16698250
Instruction Fuzzy Hash: 7B11A3353043049BDB29DA65DC91F6A73A7FF85354F65C42AE60A8B384CB74F802CBA1

Function 07851140 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61774ec0f7d869933344ac31248254b3db85c367687b610c085347227c66e0
Instruction ID: e85c84222e382aa7b46b022fa892c17d025105c7ded24ecc31932d20c96ccb1a
Opcode Fuzzy Hash: 6c61774ec0f7d869933344ac31248254b3db85c367687b610c085347227c66e0
Instruction Fuzzy Hash: 131179B1B10B068BE734DE2AD841723B3F2FB95304F040A6DE892CBA00D734E908CB90

Function 07852D80 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2591f777e9674805602138a970b426c2591e0ff5da63bd02d96d71029bcaf88d
Instruction ID: 0a8576f15bb92c1bacaa6d24288641ea92779f13e6627a10587e3f4491b80092
Opcode Fuzzy Hash: 2591f777e9674805602138a970b426c2591e0ff5da63bd02d96d71029bcaf88d
Instruction Fuzzy Hash: 5A2193B2900705CFC755EB78C440AAA73B6FF95314F14886DD4499B261DF31A48ACB82

Function 04DFDEE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f0618bf9db2187ef5e69cdf283c88cde76307f28bce62d91d1f4e4eb2ba2bb
Instruction ID: a5d42c65a5b6f0aa32909452d7dac1e15db287a200ff3f01d3309606482cc0e0
Opcode Fuzzy Hash: 40f0618bf9db2187ef5e69cdf283c88cde76307f28bce62d91d1f4e4eb2ba2bb
Instruction Fuzzy Hash: 1F11C2303043049BDB349A29CC50F6A7397FFC5310F66C93AEA0A8B284CB74F80287A0

Function 0785288C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9f18e9664fb03c9d7f194a65bfc41ed1567cd0fa31dc20f56b47c885b49755
Instruction ID: da5ab927cf100e1c6f6f635404774d44a8b20c8b5455d217d402dbbce64c6e9e
Opcode Fuzzy Hash: 0b9f18e9664fb03c9d7f194a65bfc41ed1567cd0fa31dc20f56b47c885b49755
Instruction Fuzzy Hash: 9E2193B1A00705CFC755EB78C444AAAB3B7FF85315F10886DD8599B260DF71A88ACB82

Function 04DF003C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3c7b03a35751d80d961f1736cda5311f940e2eebe7eaca05bf763ed5ebf22d
Instruction ID: 41ebd61f011925baf76982d67e65a1424ecfb8b0239329291c1a3996f92ddf65
Opcode Fuzzy Hash: 1a3c7b03a35751d80d961f1736cda5311f940e2eebe7eaca05bf763ed5ebf22d
Instruction Fuzzy Hash: 9D1190716002054FCB11EF68C4549ABB7F6EF84358B11896AEA46DB351EF70ED048BA1

Function 04DF6108 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c6ebaea789f0570a82085ce091639c37dcd40a14026155ee21c5fa77fd52c6
Instruction ID: 6640c7f28ff16dfe785253509fd02f0176cf74e7c3756cf400a330b9d7e97cdc
Opcode Fuzzy Hash: e4c6ebaea789f0570a82085ce091639c37dcd40a14026155ee21c5fa77fd52c6
Instruction Fuzzy Hash: 511170313046008FDB28AB29D854A2EB3E7FF84714B65C96DE5068B795CF75EC42C7A4

Function 00DFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 492e5dff981f9a2f1760f263db45ee6dc7e3fc9fabaeffa086244498bb050cd3
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 56112672404244CFCB02CF00D5C4B26BF73FB94324F28C2A9D9090B656C33AE85ACBA2

Function 00DFD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 50332994ba3857af692006f9c3d12b42237dc47144d936ad41b1f7837cb9b1bc
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: B511D376504284CFCB16CF14D5C4B26BF72FB94318F28C6A9D9490B756C336D85ACBA2

Function 04DF3CE0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcd0c1c8c103e35413fd99d43eafaa2f58bebdb286273ba96c495b4cf7569ac
Instruction ID: 26e4fdc6679ff805dda45fb0be35c1bd4ae90d03f0a0f0b83bb372239f786565
Opcode Fuzzy Hash: cfcd0c1c8c103e35413fd99d43eafaa2f58bebdb286273ba96c495b4cf7569ac
Instruction Fuzzy Hash: 26213B31910B0687CB10AF6AC850581B371FF99320B15C779DDAD3B395EB71B990CB90

Function 07851130 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b8108eedc7e94d8ac4eca3030e350af323a26ae0fa6505cc408a08eafad7cc
Instruction ID: 8a3aaa6e660e8bef116c90e962d49601fbd2491efb3df858c2363d01b6b72f6d
Opcode Fuzzy Hash: 79b8108eedc7e94d8ac4eca3030e350af323a26ae0fa6505cc408a08eafad7cc
Instruction Fuzzy Hash: A4118872B00B059BD734DE2AE841726B3F2FB95714F040A6DE896CBA00D768F8088B91

Function 04DF3CDC Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46102b05e99f60e133d18bda8dfa762c3ad00808ca42a6ad26c3b32bbdc836ed
Instruction ID: ee5fca0d31877e89d0ca480732b37dd0046b2783dc333b63a45aa0f39aa8fdbc
Opcode Fuzzy Hash: 46102b05e99f60e133d18bda8dfa762c3ad00808ca42a6ad26c3b32bbdc836ed
Instruction Fuzzy Hash: B6213835A10B0687CB10AF6AD450181B371FF99320B26C7B9DDAD7F295EB71B990CB90

Function 00E0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029128854.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: abf337ebe43646ffdee0b9fe42eb3d5943f52b3d5a476d615274d78f0a91e163
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: B211DD75908280DFCB02CF94D9C4B15FBB1FB84318F24C6ADD8494B6A6C33AD85ACB61

Function 04DF16B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6b34a82248a95165037b036307541d7f50592a9634ffd3f106d4e0b09e2613
Instruction ID: bc23eab0b6b0970018e93f52db942559dbd03d06088752580c6426d34a1f96d6
Opcode Fuzzy Hash: 1b6b34a82248a95165037b036307541d7f50592a9634ffd3f106d4e0b09e2613
Instruction Fuzzy Hash: BE11C4303003119BE714B728941579A76C6EB84708F60C91DE58A8F3C2DEFABC464BE5

Function 07853CD0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ce5ac60cadad152554f89f52be3177cd7b244de87af0be0851812405e573e4
Instruction ID: 69a49b6d3481db708abb2ba597075f54431f697b461a711111bc8fb8be258f24
Opcode Fuzzy Hash: d2ce5ac60cadad152554f89f52be3177cd7b244de87af0be0851812405e573e4
Instruction Fuzzy Hash: 42118270A00209DFDB14EFA5D418BAEBBF2EF88358F108469D505E7380CB75AD05CBA2

Function 06BCCB50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd5aca30cda900f2c07cd370a4069791a6c6193a38256ef4073c98845b5b09f
Instruction ID: f94ead5264d5204fd1347a8b81449656f60263edd483836c3cd21f684efa54b5
Opcode Fuzzy Hash: bbd5aca30cda900f2c07cd370a4069791a6c6193a38256ef4073c98845b5b09f
Instruction Fuzzy Hash: F2110674A10508EFC740DF99E189999BFF0FB48314F52A0D5E884A7369CB34EAA0CB95

Function 07852CB0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef46a77f012498d982e22efc360816875798028ed1c0994c1a8193ec25c433c
Instruction ID: ffbc5042dc487ee97b430700905b710f53ed40e09facc5930c96c5f875d4414b
Opcode Fuzzy Hash: 1ef46a77f012498d982e22efc360816875798028ed1c0994c1a8193ec25c433c
Instruction Fuzzy Hash: 7D0147F3A06124ABC61D6B2598156BCB656FFD5311F09412FE805D7381CE289C029BE2

Function 04DF05E8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a42aa9dcaf1fcede0a4f632e7341dbf36d98eebd575eb593188090835b3a6b
Instruction ID: 17245d02019e59c0a605ad6f20bd287f32b767a79c0273b6a45b428af2e1a768
Opcode Fuzzy Hash: 32a42aa9dcaf1fcede0a4f632e7341dbf36d98eebd575eb593188090835b3a6b
Instruction Fuzzy Hash: C61113B5D006498FCB10DF9AD844A9EFBF8EB88320F10841AD419B7310D374A545CFA1

Function 04DF6070 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02f12bf80b97b34704cdc8b9964a2ba8114a5a2cdc03c6008e7997c9c7c2b6e
Instruction ID: d49be75eb0d9464608ea8199e0632ec2865284fe482c7e7e9aec6f3442c024a0
Opcode Fuzzy Hash: c02f12bf80b97b34704cdc8b9964a2ba8114a5a2cdc03c6008e7997c9c7c2b6e
Instruction Fuzzy Hash: 42015E30304210DFC724DB29D850D6AB7B6EF85314B66C5AEEA458B662DF75EC038B91

Function 04DF4E68 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94d63d8645ae4126746367c0ddb52efe14a23ebaf01497b58499711d850a2e5
Instruction ID: 7b5b1841cd44bc46b7f33eccac964d3aec49e3f93c0ae2522fbe2b013b1bd0bb
Opcode Fuzzy Hash: a94d63d8645ae4126746367c0ddb52efe14a23ebaf01497b58499711d850a2e5
Instruction Fuzzy Hash: AD01B1363102018FD7289B28D8556BA3BA6FFC9314F1A80BAD545CB261DE38D8018700

Function 04DF2953 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c996e8f1aad1295ea96bdd9c06ae051241030a7e61d1cc110474820c0aaf9c5
Instruction ID: 39eefa9069cfced4611b5382c2c343c8e9fa84a29e8cfe359a35be99a0b42336
Opcode Fuzzy Hash: 6c996e8f1aad1295ea96bdd9c06ae051241030a7e61d1cc110474820c0aaf9c5
Instruction Fuzzy Hash: 6B0192303002118BE724B768D41579A76C6EB84708F60C61DE98A8F3C6CEFAAC464BE5

Function 04DF05E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d82a7caaf93fbd8da497da083cdc248d41f1414e34714feea4161784b6ef14
Instruction ID: a40552459b720725f6577c4863afcf858378bbae0c2553e2e414ac6f7336deb8
Opcode Fuzzy Hash: b1d82a7caaf93fbd8da497da083cdc248d41f1414e34714feea4161784b6ef14
Instruction Fuzzy Hash: 2A110FB5D006098FCB10DF9AD544A9EFBF5EB88320F11C42AD419B7310D778A545CFA5

Function 04DF4E78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43a77cd272087eb71135dee7cce37c107c1cecadb18623c978ca182f7eddbd8
Instruction ID: cb9faf8e36fc7e0cf3e12d6147b650c58dd799fc0b3de59577f484fea6d5a9d3
Opcode Fuzzy Hash: a43a77cd272087eb71135dee7cce37c107c1cecadb18623c978ca182f7eddbd8
Instruction Fuzzy Hash: 720162363505014BC7389A2DDC44A6A37DAEBD9725F2A41BAE105CB6A5DE35EC018750

Function 00DFD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6fb3f1132e497a5af40c99aaf651d0d25c3575d4be3d0cbd159f25ddc6b3d0
Instruction ID: 4c553bf4f632b1ee26edc8d03e501ed8ce319f0139aa94276ba97682baa1de8b
Opcode Fuzzy Hash: fe6fb3f1132e497a5af40c99aaf651d0d25c3575d4be3d0cbd159f25ddc6b3d0
Instruction Fuzzy Hash: 9201F7710043489AE7106A15DCC4737FFAADF41320F2CC91AEE0A4E286C3799C40C671

Function 06BC4540 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704f3fbed51c67e43fd9537925c7e89d892d6ae43ca2a86a102825bbe5c652c6
Instruction ID: 6f3d8e892699c957e8ddadea3bfde67bc0bb994bf63c66e5bce39ef56e5e37f0
Opcode Fuzzy Hash: 704f3fbed51c67e43fd9537925c7e89d892d6ae43ca2a86a102825bbe5c652c6
Instruction Fuzzy Hash: 74010CB0E052099FCB84DFA8C5506AEBBF6EB49214F1481EAD808E7341DB358B05CB61

Function 04DFA6B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eba1e9f3e720c0357659e8158e8f70a838095ff76d26ea2e7fa2572265f24e4
Instruction ID: 7fd1b7c4ad820c287dba3ea39aab0af68a5920aab1707f294bce92007d334c5e
Opcode Fuzzy Hash: 9eba1e9f3e720c0357659e8158e8f70a838095ff76d26ea2e7fa2572265f24e4
Instruction Fuzzy Hash: 89F028317046215BEB21263AAC14F6A75EAE7C036AF55422AA50DC23C0DF78D845C661

Function 04DF6BB3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce90c1296fe184650519e63d493119857149d5109923ba52aac7dc756b2e66a
Instruction ID: 764bfc2dbbf938a1b6cfc4b6725eb6e9e94164e891efd75cb3fedcfde62ac282
Opcode Fuzzy Hash: 3ce90c1296fe184650519e63d493119857149d5109923ba52aac7dc756b2e66a
Instruction Fuzzy Hash: 92112774A00206CFC724DFA8C580A9DBBF1FB48300F250069D544E7750EB32E982CFA0

Function 04DF1BD8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d503236eb578cdfdd004f93cf994100f1e478512b89ee2ab4028b3bdd39c5f40
Instruction ID: 3c082393db8fa176bf31e14cb3b62ac43e1244465279931c0733057058c841c6
Opcode Fuzzy Hash: d503236eb578cdfdd004f93cf994100f1e478512b89ee2ab4028b3bdd39c5f40
Instruction Fuzzy Hash: F011D0B5D003498FDB20DF9AD589B9EFBF8EB48320F20841AD559A7340D375A944CFA5

Function 04DF9A00 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c902bfc2c4e1754335fbc1c9d65f70ac3289e208ca2ffb8aa126c4234d42b72
Instruction ID: 855265fcb446934b166c0049e584ada20c6dcdd5c6c6f1f9e3d5c339fcc9df9a
Opcode Fuzzy Hash: 0c902bfc2c4e1754335fbc1c9d65f70ac3289e208ca2ffb8aa126c4234d42b72
Instruction Fuzzy Hash: 5301F473B00504ABEB31CE19ECD0BAA7BDAFB88224F19845AE659C3210CA36FC01C710

Function 04DF1BD3 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5393282703f27e370e5459d2120c36e6aa6269a6eb9b781942d9bedd31ef1217
Instruction ID: 6ed9b6b60d05a2d28822c77201b13aba232efe60716afb06b8d859577e54ffa1
Opcode Fuzzy Hash: 5393282703f27e370e5459d2120c36e6aa6269a6eb9b781942d9bedd31ef1217
Instruction Fuzzy Hash: BE110DB5D00249CFDB20DF99D584BDEFBF5EB48320F20841AD559A7240D338AA84CFA5

Function 0785FDA0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9acd71b725353420d8383aa065bd84c934587e8e2bf039a63f83dcfbef333
Instruction ID: 20051808a0a1e1455f4f4f07260944ce2e1ce58d6b25a648df855a8cc1995f5c
Opcode Fuzzy Hash: 12b9acd71b725353420d8383aa065bd84c934587e8e2bf039a63f83dcfbef333
Instruction Fuzzy Hash: 8B0193B8A1020ADFCB54CFA4D988AADBBF1AF19754F245565E901E7360D734D882CE50

Function 07853CBF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d5e0c08673bcdd141424b8ce209704758d9c1630e28db75df50aa9869c8203
Instruction ID: a45e3e33155dcbebdf50246afe38bcb075cc1d9a55ba112949878cad71d12a04
Opcode Fuzzy Hash: 53d5e0c08673bcdd141424b8ce209704758d9c1630e28db75df50aa9869c8203
Instruction Fuzzy Hash: 210180B0A00206CFE714DFA4D52876EBBB2EF88354F00882DD505E7790CF799904CB92

Function 04DF6080 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6ecbf041a887567622ad82bd3bc3ee088d39fd3d97006327db0b3fc6ce249f
Instruction ID: 6893a57b174dc058b4dbf682c6b6f9545755fa50b6f0ab6b01bf0588bafdaf11
Opcode Fuzzy Hash: 2d6ecbf041a887567622ad82bd3bc3ee088d39fd3d97006327db0b3fc6ce249f
Instruction Fuzzy Hash: D001FB34310210DFC724DB69D840D2AB3AAEF85725B65C56AEA098B765DF76EC028B90

Function 06BC4550 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61772e8f7af39669d4cc74baba7d2bcf4ecc81f95d127acd2f60177a8533f3
Instruction ID: b685774ac0e9ce7d943f5fc756e27e050d316ae078c96024dd934298cb3d87e2
Opcode Fuzzy Hash: 6c61772e8f7af39669d4cc74baba7d2bcf4ecc81f95d127acd2f60177a8533f3
Instruction Fuzzy Hash: FE01D6B4E042099FCB84DFA9C5506AEBBF5FB48310F1091AAD919E3341EB319B05CF91

Function 04DF0B11 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13601462cf99f0eefdac6a18acdcba2a4d1712a0f84af7f2b3a1454f20bdc4f
Instruction ID: ed677e6b051de0607049d079973e3cd1e0c8aec1b2ea09eabe443029db4c7859
Opcode Fuzzy Hash: e13601462cf99f0eefdac6a18acdcba2a4d1712a0f84af7f2b3a1454f20bdc4f
Instruction Fuzzy Hash: 5CF0AF76B002158FEF06BBA894904BD7BB6EB88215F00406DDE05E7380DE301E1187EA

Function 04DF0B20 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d2ae7736cb9674717af24e34ee43f6e820e6de0489c5e9ade277e6b728e736
Instruction ID: d2a8a439e3eeced510d86cd3dc0bc081160554f2acd9e09e1fed1b02dea1529b
Opcode Fuzzy Hash: f4d2ae7736cb9674717af24e34ee43f6e820e6de0489c5e9ade277e6b728e736
Instruction Fuzzy Hash: 2BF09071B001155B9F05FBA898908BEBBFAEB88615B00402DEA05E7340CE316E1287FA

Function 04DF41F1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94ef3671fc13f8c4ea09384cf56eda0390e701c3efc34005f129075d874be6
Instruction ID: 440744bd691c8d1b6f2a50ccd4a69540cafb9d538f4eea42a158572a028a7f09
Opcode Fuzzy Hash: 8a94ef3671fc13f8c4ea09384cf56eda0390e701c3efc34005f129075d874be6
Instruction Fuzzy Hash: 71F08B327087000BE7319FE4E845667B7F0FB82360B050A3EE166C7201EB24E84587D1

Function 04DF4954 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbffc9c86e8dfea1471798dbff874efe9bf8df859a2723b3b9d57d2f15822f09
Instruction ID: 2ff2e5121e87bfa786b32d8d93e0f8d7b25d96929b8ace4b46a3d59e93620bce
Opcode Fuzzy Hash: bbffc9c86e8dfea1471798dbff874efe9bf8df859a2723b3b9d57d2f15822f09
Instruction Fuzzy Hash: EA011338650210CFCB04DF28C899BAA7BF1FF4A715F2641A9E5069B372CB74AC40CB50

Function 04DF9A10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b25f33b522ffd854c17115d227a1dc68cfccdcb9d1b64453418dc7278a5d9c
Instruction ID: d3438230ac353dd59482933e4c88389e7e1ff47eb2e12ce8454137463a1cd0da
Opcode Fuzzy Hash: 87b25f33b522ffd854c17115d227a1dc68cfccdcb9d1b64453418dc7278a5d9c
Instruction Fuzzy Hash: A6F09672B406046BEB35CE55DC90BAA7BDAFB89224F15845DE65AC7210CA36FC408760

Function 07852B28 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b4cc06e42d399b983410eb7681698e5244fb361b2896e7785ecf29836f2f83
Instruction ID: 6a6e8d6967549d1a0fb28f0a73555c0c6e85672eba6f763193bca2e918d0c68f
Opcode Fuzzy Hash: 80b4cc06e42d399b983410eb7681698e5244fb361b2896e7785ecf29836f2f83
Instruction Fuzzy Hash: A2018F71A00609CFCB05EFA8C8199AD7BB1FF84300F058199E5099B365EB34DD54CBD2

Function 04DF28D8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56dd78b17cd288fef6c4d865ac260939af6e5dc5a9b813359ed0d76cdff2f39f
Instruction ID: eed35bab8fd2f3db5a61e63316a006b400baed255f858f124c138f2722e28c20
Opcode Fuzzy Hash: 56dd78b17cd288fef6c4d865ac260939af6e5dc5a9b813359ed0d76cdff2f39f
Instruction Fuzzy Hash: 5901D16520E3C08FE313572948313D57FA29F5B210F4A41EBC9C9CF1E3DA14091A8756

Function 06BC0B35 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be4288165d5107d643d47dbbc7734d53b71905f946f5558a8f6e308e1e99558
Instruction ID: 5b84a323a09c87d3f81d1a095682f0d1525b6dd4f10a82a76eb89550575b542c
Opcode Fuzzy Hash: 2be4288165d5107d643d47dbbc7734d53b71905f946f5558a8f6e308e1e99558
Instruction Fuzzy Hash: B8019578E04209CFCB54DFA8D4849DCFBB5FB49225F20925AE829AB252D635A941CF90

Function 04DF4200 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a2b0ec7751d103ac082e87c5cd19033ebe22bfff0990da0b21e320e0d6d81e
Instruction ID: 3fe1bdedfb62d163ba02b3506e708a45c755b39852b6901f7e46ddd30a741615
Opcode Fuzzy Hash: 48a2b0ec7751d103ac082e87c5cd19033ebe22bfff0990da0b21e320e0d6d81e
Instruction Fuzzy Hash: 05F04931200B054BD7309FA8E855627B2F4FB85720B050E3AE266C7A40DB24F8449B91

Function 00DFD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029093250.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e9596600385da955ef391ecdba7abe80587aaabe2cfc3312c04155999b017c
Instruction ID: 8e2e4e6dde0ccf06cf3f8cbca9e92264e10f288d97a54c35b384425d821c8edf
Opcode Fuzzy Hash: f7e9596600385da955ef391ecdba7abe80587aaabe2cfc3312c04155999b017c
Instruction Fuzzy Hash: 6CF0C271404344AEE7108A06DDC4B63FFA9EF50724F18C55AED094E29AC379AC44CAB0

Function 07852B38 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95769c0656c5445856ca74c1f2d1345c7eb02585db78534933a293d2737165a
Instruction ID: 66b5bacb77ef2eacbda10d4f636d51399d0207355f3c3eb8305b925b7479933a
Opcode Fuzzy Hash: f95769c0656c5445856ca74c1f2d1345c7eb02585db78534933a293d2737165a
Instruction Fuzzy Hash: DFF08C30A0061A8FCB05ABA8C8198ADBBB1EF84300B018199E6099B365EF709D54CBD2

Function 06BCEF10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8212f7d971181e5118e0f10bedaca0114c5862e3422d4e2707009e6af0eb4fac
Instruction ID: 610eb258b03c2885010514728d5f8b90187445f4de3ec97cf349ade154c4016b
Opcode Fuzzy Hash: 8212f7d971181e5118e0f10bedaca0114c5862e3422d4e2707009e6af0eb4fac
Instruction Fuzzy Hash: 4D01FBB0C00219DFEB54CF6AD4043EEBAF1FF48360F108669E424AA2A0D7748A46CFD1

Function 0785BE28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddf78b1f5e030c92a5337275fcf386c9ad2588f73440af61482d8b6c50dcf31
Instruction ID: 9bd92c3041b9a70dc7ff2073b97eeaceab5d2ec88a05148b9f92fb5ae08b9989
Opcode Fuzzy Hash: 9ddf78b1f5e030c92a5337275fcf386c9ad2588f73440af61482d8b6c50dcf31
Instruction Fuzzy Hash: EFF0BEF0909144EFCB14DFA4D9598ADBFB1EFAA301F0480DAEC499B220D7348A10EB41

Function 06BCEFB0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79390faa5e976e8cbc51aac5bd4ea0ce34fb2d1a2f18f3e833aa30e07671dbf
Instruction ID: 8542b5cbad3f8a58f0978f76ed4d497347a5688e639748e002014a1ae57f96aa
Opcode Fuzzy Hash: f79390faa5e976e8cbc51aac5bd4ea0ce34fb2d1a2f18f3e833aa30e07671dbf
Instruction Fuzzy Hash: CDE039727001286F93049AAEE894D6BBBEDEBCC660316807AF508C7310DA319C0186A0

Function 04DF2A50 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e72b9eb65c4f91c350381a62e9b463f613e5ef7613f6c6568328e71e82fddad
Instruction ID: 13d31b27f814616a7ecffd871eae74b7c2465a8e69deb998bdd8175d875c31f2
Opcode Fuzzy Hash: 0e72b9eb65c4f91c350381a62e9b463f613e5ef7613f6c6568328e71e82fddad
Instruction Fuzzy Hash: 86F0F8716147059FDB29CF18D88299577E6FB45358730499EE91ACF302D7B6EC038B84

Function 0785BDC8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd58697dbdff6226243525391994937386effc5f93fc36a8f37b8e9cd8bca903
Instruction ID: 3f227a872bd2a196637cc4a537a31c832ca5294e0437aa8f9be12e559d4fb185
Opcode Fuzzy Hash: bd58697dbdff6226243525391994937386effc5f93fc36a8f37b8e9cd8bca903
Instruction Fuzzy Hash: 2BF03AB1900108EFC704EFA5E94AB9DBFB6FB59302F1090A9E80967360D7396E04EF55

Function 04DFB1A1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f433a3cca45c90752edf483b2d8bf49a9641b71416839eaaa26ff53290ae960
Instruction ID: ae8fc2d7d4237ed593d014b8938f20cad9ba49d383829aed14706d3a6fa0a3fd
Opcode Fuzzy Hash: 0f433a3cca45c90752edf483b2d8bf49a9641b71416839eaaa26ff53290ae960
Instruction Fuzzy Hash: 29F05E353002068BDB15BF78D8909A93BAAFB89355B108929E608CB238CE35A915CB80

Function 06BC1C09 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87790a284cbf7d19c39f9a049ac0fdd468cbc53aaec950f047022c2625a88955
Instruction ID: 9fd04ff249d1df84e668abf830d9b7c4496343fe1b41bce35179efe46c5a59c5
Opcode Fuzzy Hash: 87790a284cbf7d19c39f9a049ac0fdd468cbc53aaec950f047022c2625a88955
Instruction Fuzzy Hash: 3CF0A7B0908308AFCB09DB68D50569DBF31EF42251F0041EAD48567691CA340E45D772

Function 04DF96F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0f5e0796fcc5abbcd1378cb4cb8fad16af48412d6440ed23449b3d66183530
Instruction ID: 943d1da26c89873bf94836b69b4792afcacb33075b20bf9da31fcd665ba35ac3
Opcode Fuzzy Hash: 9c0f5e0796fcc5abbcd1378cb4cb8fad16af48412d6440ed23449b3d66183530
Instruction Fuzzy Hash: ECE092B1B00A145B9718FB7EA81086AF7DBEFC8650309C27ED50DC7765FD30AC018AA8

Function 04DFB1B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f59ad745fa7d1bc30a7a0c09ac095ebef86cc2ce93dc30128dee86d4a97784f
Instruction ID: dd4e6a6067c65275312fbd28ada8e2a96ce1fb589243c7000e6e2e8c48971cd5
Opcode Fuzzy Hash: 8f59ad745fa7d1bc30a7a0c09ac095ebef86cc2ce93dc30128dee86d4a97784f
Instruction Fuzzy Hash: BDF0303530020A9BDB25BF69D884CAA3BAEEF893557108469E5048F228DA75AC01DBD0

Function 04DF61AF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd4da743b33cfeaf731848f5e0f5efe251c16a213125e78f915d5ded61306ed
Instruction ID: e486933834e7658cdb0a23de41993d9f4d0ea8010cc20a2e5265467b45b42764
Opcode Fuzzy Hash: 4fd4da743b33cfeaf731848f5e0f5efe251c16a213125e78f915d5ded61306ed
Instruction Fuzzy Hash: EEE0D8722046510BD312E91DEC908CBF7D3DFC13543158E1AF1598B212EA10AD078BE0

Function 0785F04F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f190cc9287be77d18fdef6e42af0ac7c5b3d70fd057b754c9d5000f57d5729
Instruction ID: 378620ae6662ebf6c1be05db36daa84ba010b067529750dddcdeef1d9d5597f4
Opcode Fuzzy Hash: e9f190cc9287be77d18fdef6e42af0ac7c5b3d70fd057b754c9d5000f57d5729
Instruction Fuzzy Hash: 5CF049B050024ACFCB14EF78D994AAC7BB1FF09304F20852EE8019F256CB386944CF40

Function 04DF11D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ab87c9ddb49040440e5cf2194d747435e302e686b5e100123cea981758a7a5
Instruction ID: f9004bfa2a2bde0c917d8c6d4974572ca4a3698cfaa883a463a21c161d4481a7
Opcode Fuzzy Hash: a4ab87c9ddb49040440e5cf2194d747435e302e686b5e100123cea981758a7a5
Instruction Fuzzy Hash: C6E04F72B001186BAB14DEF99C409AFBAEEDF84154B148079D508E7214EE30AD0147A0

Function 04DF7F40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42dedcb59e62cfc64ec07fb3ee0cc39d9a601450d66e0345374a1ac6bc9e944d
Instruction ID: 87308f6d2aa8d90870c369f6cafce86887e35e8700dcb704b916e815d16f2b34
Opcode Fuzzy Hash: 42dedcb59e62cfc64ec07fb3ee0cc39d9a601450d66e0345374a1ac6bc9e944d
Instruction Fuzzy Hash: A4E0ED33640535CBC611DF58F8819F5B3E9EB45665358C466F50CCA711E276EC62C790

Function 0785BDD8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ccd273ad4fcc8036e737cde348e7c4f826a390e5db99393ccafd51b9bbb841
Instruction ID: 9cadbcf638474368a408e03195103cb738d36f940831cc3e866a936b781a22e9
Opcode Fuzzy Hash: 72ccd273ad4fcc8036e737cde348e7c4f826a390e5db99393ccafd51b9bbb841
Instruction Fuzzy Hash: B0F03070900208EFCB08EFA5D549AADFFB6FF49311F1091A9E80967260DB345E50EF55

Function 0785F0FD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a47c6ec057ce12d2e4df0faa12bf045a9ad62bcf009b8e0f560d0a5325d1f9
Instruction ID: 0c8daa14984fb8381cd0e23ab994715a5cc6462333e5e42880b685202ccba1ac
Opcode Fuzzy Hash: b8a47c6ec057ce12d2e4df0faa12bf045a9ad62bcf009b8e0f560d0a5325d1f9
Instruction Fuzzy Hash: F9F0F2B5E4110A9BDF22DFA8E48429EBBB5AF44365F154026E904E7300E730A885CB81

Function 04DFC51C Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f4f2c7616f297fa729c1491a7aee243883069d3c9ea920d13cf8e332465179
Instruction ID: 01468b4e68bbef6cb81921aca24eca9c5b22366f2dcd58805f0b65864781a499
Opcode Fuzzy Hash: f4f4f2c7616f297fa729c1491a7aee243883069d3c9ea920d13cf8e332465179
Instruction Fuzzy Hash: 31E048352501008BC711DA1CC8857D933A5EB5A354F1545B2F5869B314C675BC418741

Function 04DF96E2 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7d851dd627a91d009db5ec3acde915742bf308ff24ce519da9e22bc1b50edc
Instruction ID: 88d84f79fbff770ae9e8c226792224e26fa4ddf93792d9c9897c328a19e3a124
Opcode Fuzzy Hash: 8e7d851dd627a91d009db5ec3acde915742bf308ff24ce519da9e22bc1b50edc
Instruction Fuzzy Hash: 1FE0CD71700A145FC724EB1ADC50B7673DBBBC8704B04C26DD50D87A15E970BC014AD8

Function 04DFA658 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033e23998aa1fefee58d035655a3066b21d8c4a9d18c6efcfa1ffff43c9f1244
Instruction ID: 2871d4faa0f9a71a6ce818ece73a4b034c18680b45f1a86d2ba390d1c8552522
Opcode Fuzzy Hash: 033e23998aa1fefee58d035655a3066b21d8c4a9d18c6efcfa1ffff43c9f1244
Instruction Fuzzy Hash: 35E01A36244A419FD324CB68D889FD67BE4EF4A715F0504EAE25A87371DBB5BC40CB50

Function 04DF2A40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92128f75dc1c6a860fa5b365818c1a6c0e792aaf8fa11741c0f6fb23e545e85
Instruction ID: 2b92b2b5f969dfd348414b718b78363a64bf022f2bde113ac75e36e4075bdb70
Opcode Fuzzy Hash: a92128f75dc1c6a860fa5b365818c1a6c0e792aaf8fa11741c0f6fb23e545e85
Instruction Fuzzy Hash: A4E092352092818FDB26DF18D8524957FB2EB42308324489ED492CF256D776E9168B88

Function 04DF9738 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389e0b6b36ab11ac2b52abf8d2a32a0dfeb53e7b7c62eec59471884048800347
Instruction ID: 80baa8ac0e1205a6fd8a97ec2a9110bf8c2f7786b5a454d76f8d2ffbe1b511a1
Opcode Fuzzy Hash: 389e0b6b36ab11ac2b52abf8d2a32a0dfeb53e7b7c62eec59471884048800347
Instruction Fuzzy Hash: 8AD0C22370402023D71A2A29F8246ED6BBAC7CA561B490026D108CB346DD984C1343D5

Function 07857901 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c501410658858ae0aa710e6e85984c7a870b4d20b8271dc3f37a4b94570877a5
Instruction ID: 118092d6748ab9408e470dc0aedda2967db8901f9b7ce04abb3912d4c9338104
Opcode Fuzzy Hash: c501410658858ae0aa710e6e85984c7a870b4d20b8271dc3f37a4b94570877a5
Instruction Fuzzy Hash: 9CE026B6B11307DBDF111EB4EC68699BFA9EBA4352F00C072DE01C2185DF748428C6A1

Function 06BCB788 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc187427170b1a0ec3ad401508666d190a678aa4cd2951c84953af58c8a6228
Instruction ID: c79d33c73a5dda5da5589f992d97e13a2cbfcd16c5c8e9c99954b436f183cb7f
Opcode Fuzzy Hash: 3cc187427170b1a0ec3ad401508666d190a678aa4cd2951c84953af58c8a6228
Instruction Fuzzy Hash: 20E08CB1805108EFCB80EFB4990A69D7BECEB0A214F0055EA991993110EB301B00E792

Function 07850261 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c38aa3bb7c23a17eee8ac2787f64920fcf7d05c8b09b0ddb4e1814d21d1a5f
Instruction ID: 278e508324127405b2506d2f315b87e1887618eb7cb7c6646d6ea35e8353a9ba
Opcode Fuzzy Hash: 67c38aa3bb7c23a17eee8ac2787f64920fcf7d05c8b09b0ddb4e1814d21d1a5f
Instruction Fuzzy Hash: 7BD05E7770051457C315569EEC04B9AB79EEBC8A21F0A802AEE19C3320DEA8AD0646A4

Function 06BC1C18 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439a618dbd58a7ff37a3f50f8e530c83ae407c5d57591763df64ba61d6427c67
Instruction ID: 852fce618a50f2670af8c4fc3b589020eff3d0c29363f1d117243e6d7b879c11
Opcode Fuzzy Hash: 439a618dbd58a7ff37a3f50f8e530c83ae407c5d57591763df64ba61d6427c67
Instruction Fuzzy Hash: 85E08670D0420CEBCB08EFA8D54A6ADFF71EB85301F1080E9D54527390DB341E05EBA2

Function 04DFB159 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41590d762f9f9e8b07476e4eca0673ab517415917d4cb2f904ace82fa11918b
Instruction ID: e5fb850606bf08dea1d487a51a9d13c39877dabf5891dbf855d2a8c7f2096a78
Opcode Fuzzy Hash: b41590d762f9f9e8b07476e4eca0673ab517415917d4cb2f904ace82fa11918b
Instruction Fuzzy Hash: 65E06D31E1014EEFCF05DFA4C8148DDBB75EB16345B1057DAE92596291DB342A06DB80

Function 06BC4650 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4245589ff7ccb3a470d6d488373ff269022633f8b2937cb207c8699bcb2ef6f6
Instruction ID: c7fd09e438a1d13397e24309c5db9cd0946f5f0450672acb6ece333b57ee6537
Opcode Fuzzy Hash: 4245589ff7ccb3a470d6d488373ff269022633f8b2937cb207c8699bcb2ef6f6
Instruction Fuzzy Hash: 88D05EE104EF944ED7965660A92D3A43FA52B03229F0510EBE9C88145AD3A94514C7A2

Function 06BCCB10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d186c0b6c4f85a41dafbf14b72f4b27eac646a80aad2c95679d8b00fb35b3ef
Instruction ID: daef14aa00da07eb6bb859f6c694b36f4af51fbd63666ddf4f572beb13ef4349
Opcode Fuzzy Hash: 4d186c0b6c4f85a41dafbf14b72f4b27eac646a80aad2c95679d8b00fb35b3ef
Instruction Fuzzy Hash: FCE0EC7490910CEBCB44DFA4E5455ACBFB4EB45315F1091DDD80917351D7315E42DB85

Function 04DFA668 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cde4871a1bf205a7b18a13b7ebb65fb3c6343973a43af311da26fbb7a935da
Instruction ID: bcc8310c7d4ddec84553dd075360a30f8c93ac648b436205ea56c3457898cf6c
Opcode Fuzzy Hash: 97cde4871a1bf205a7b18a13b7ebb65fb3c6343973a43af311da26fbb7a935da
Instruction Fuzzy Hash: 88E0EC34244A518FD325DB6CD448FE6BBE8EF0A715F0504EAE65A9B371CA71BC40CB90

Function 04DF5738 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bb92329c98925b88b4b43b736ce18d68416eac7f1288fdb0e97861423168ec
Instruction ID: 144b23c871caacca212842777c4215b7cdd49168f437279fab99852eac5397e7
Opcode Fuzzy Hash: d0bb92329c98925b88b4b43b736ce18d68416eac7f1288fdb0e97861423168ec
Instruction Fuzzy Hash: 9FD02BB2104344FFD701DBB89C10D523F18EF35224B118185F7448B1A3D13295139351

Function 04DF2918 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b8d4ccaf20dce9e0823ee954b7f2fc2c790d33e3400ac2b1ae22eba31d5f58
Instruction ID: 3866fc0b851784712bced910cce98c1b9ff9db4f2f009b90ca2f4e3a06592641
Opcode Fuzzy Hash: 15b8d4ccaf20dce9e0823ee954b7f2fc2c790d33e3400ac2b1ae22eba31d5f58
Instruction Fuzzy Hash: B7D05E313442144BD7196749941079A76CE8FC9751F05806EEA0E8F380D9A19C0006E9

Function 04DF9748 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0d44d7f80bde56c1c2de97754c92a87739a65dc6c7128ff921849701db0c16
Instruction ID: b1f89f3f225bdaf5c800b6003209babba7dd0b18ef3fc76e4efb845800c3bbb5
Opcode Fuzzy Hash: 5c0d44d7f80bde56c1c2de97754c92a87739a65dc6c7128ff921849701db0c16
Instruction Fuzzy Hash: 5CC01222700424231919355E78288AE769FCACA93578A402AE20DD7341CE94AC0243E9

Function 04DFB890 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e319225b4320902cb7fda9f748df064fae40cbaa6efe1be96bfa090eb2c48f4
Instruction ID: 06c5e5dc7f7e2c915f87e708d50c31d2533615bb43cc33d56b5b45a6724596c5
Opcode Fuzzy Hash: 4e319225b4320902cb7fda9f748df064fae40cbaa6efe1be96bfa090eb2c48f4
Instruction Fuzzy Hash: 65D05E726002109BCB149B48E895B9833D8EB68715F0500A6E209C7321DA64ED014795

Function 04DF99CF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e99481fbf29e282a729b58ce65e3b0707256a81dbac5b1de8d57958d8dc9f49
Instruction ID: 12d48ec8a819ff0f0e9459148eafa3cd30f1e0fd6fe2efc76e0756032127d28f
Opcode Fuzzy Hash: 7e99481fbf29e282a729b58ce65e3b0707256a81dbac5b1de8d57958d8dc9f49
Instruction Fuzzy Hash: E3D05E3214410D6FCF01AF94EC81BBA3F25AB25300F458060F644995A2D632E873B761

Function 04DF6E96 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4349fd410d5ab81516a5abfaef8b3417ee3d3add1ca00246df8ce837c03ae39b
Instruction ID: 0b6e21921ca9f40d1052ad3b5eb58b39d075590662689ba6d94b4a3be03fc5d1
Opcode Fuzzy Hash: 4349fd410d5ab81516a5abfaef8b3417ee3d3add1ca00246df8ce837c03ae39b
Instruction Fuzzy Hash: 57E0E274640209CFD718EF60C895AADB7F2BF48304F224499D501AB3A1CB35ED82CF60

Function 04DF55D8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6cf73cf29634e3fa4dd90750a8dd5fa75240b902f020beb40f62362bb553e8
Instruction ID: d3310fda381513d076a5d88d674045e3189ebec2f491884431a3a8a6aa982a80
Opcode Fuzzy Hash: dd6cf73cf29634e3fa4dd90750a8dd5fa75240b902f020beb40f62362bb553e8
Instruction Fuzzy Hash: 8AD0C93224410EB7CF11AE85DC42EAB3B1AEB46350F118811FB5409461C672E960BBA5

Function 04DFB8A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a211bc2a51c4f5c47447b6c4f05e0301688355d9f1b1c215eb223c2c9b47f09e
Instruction ID: 4a0b3b6e558f85062c01f6b2396d1df9848f164fdaea4ee7c2d3edbeeccfd42d
Opcode Fuzzy Hash: a211bc2a51c4f5c47447b6c4f05e0301688355d9f1b1c215eb223c2c9b47f09e
Instruction Fuzzy Hash: 9DC012313400248BCA08AA5CE8189A937DCDB89A24B0200EAE20ACB321CAA1AC0047E9

Function 06BC4660 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75d1d5d35fd498c4fdc71af8f296a9f69657991cc53047526b3656c942da24a
Instruction ID: 951d1e5d4e06fe7bbcf1940a0266c48d65e2923ca6537a12e3ecc34acb813527
Opcode Fuzzy Hash: b75d1d5d35fd498c4fdc71af8f296a9f69657991cc53047526b3656c942da24a
Instruction Fuzzy Hash: DAC02B70089E088EC2402294710E3B47ADC6701229F4031E9E54C0041D47B40210C9D6

Function 04DF5748 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e5fa695d6e238713c3728fb53a539ab3aee4bb1fd7469b48e4800b3c2a77d9
Instruction ID: 5e84a3eae2e7f986a07ae657c36e688bcbdb6de4a92dd72215c376f785b7c20a
Opcode Fuzzy Hash: 27e5fa695d6e238713c3728fb53a539ab3aee4bb1fd7469b48e4800b3c2a77d9
Instruction Fuzzy Hash: B6C01236240208AFEA80AA94D800D667B6DAB18714FA09040BA080A211C272E862ABA0

Function 04DF6EBE Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dd4a9a716658c56d923db3395d77cb75667a4e7e5b6165836cab78b87b77c2
Instruction ID: 7e3488214719fc78e82e63ee1866f0175dfcbdb7bdc3f8da7ecdce790e8ea3c5
Opcode Fuzzy Hash: 69dd4a9a716658c56d923db3395d77cb75667a4e7e5b6165836cab78b87b77c2
Instruction Fuzzy Hash: 74B09234A40214CFC709EB30C86085873A3BF8D3923698D68C001DB3A5CA359881CF20

Function 04DFA640 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9b750c9f90dea2eef7a7d222437f2a71a4121e877c215d44fffc0074dc089f
Instruction ID: b9b0f38ccc1753c34fc4b6e7ae209255aa20a42c52c86ded734dc3974853b8b8
Opcode Fuzzy Hash: 9a9b750c9f90dea2eef7a7d222437f2a71a4121e877c215d44fffc0074dc089f
Instruction Fuzzy Hash: 1EB092B34011008BDB14CF15FEAE7403BB1FB10302F644100D080812A0D7786D11CA00

Non-executed Functions

Function 07857EF8 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

(o]q, xrefs: 078583A3
(o]q, xrefs: 07858399
,aq, xrefs: 07858137
Haq, xrefs: 07858410
,aq, xrefs: 07858127

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq
API String ID: 0-2157538030
Opcode ID: c0a061d235857edd7b2a8ee378d3fbb74e38a975918ce98795422610604924ad
Instruction ID: ce23ff3416e0b59c51d5539b5ff956d28ae97d2dd6d79ea01fd55d75ba508e92
Opcode Fuzzy Hash: c0a061d235857edd7b2a8ee378d3fbb74e38a975918ce98795422610604924ad
Instruction Fuzzy Hash: EE025FB4A00515CFDB18CF69C488AADBBB2BF99750B15816AEC15DB370DB31EC01CB90

Function 06BCB7D8 Relevance: 6.0, Strings: 4, Instructions: 1015COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06BCB97D
paq, xrefs: 06BCC4B1
xb`q, xrefs: 06BCB908
Te]q, xrefs: 06BCC032

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$paq$xb`q
API String ID: 0-4160082283
Opcode ID: e08451f7615b98eacfd0333a9f63040f657dc9142de1056702a42779fcd29005
Instruction ID: bdce20cc3f038bcde164a9a9fb4c3ea3e5027ad805ae5831b9114ed36f97603b
Opcode Fuzzy Hash: e08451f7615b98eacfd0333a9f63040f657dc9142de1056702a42779fcd29005
Instruction Fuzzy Hash: ACB2A075E00628CFDB64CF69C984AD9BBB2FF89314F1581E9D509AB225DB319E81CF40

Function 06C4F6C0 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06C4F983
PH]q, xrefs: 06C4F8AB

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 37581bdb3a1804c9fcfc5bcacf10e7a9f629438c196477e0770baced1bd18d25
Instruction ID: 55d76cb966e5037441f6ed95ec126c5bcef70a85e7abc9e59e05eb47ab14c1c1
Opcode Fuzzy Hash: 37581bdb3a1804c9fcfc5bcacf10e7a9f629438c196477e0770baced1bd18d25
Instruction Fuzzy Hash: 23D1C174A00509CFDB48DF6AC598AA9B7F1BF8D311F2580A9E415EB361DB31AD40CF60

Function 06BC4681 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

4']q, xrefs: 06BC4762

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 61fdb7aa225dabb3e48f5acb8fa5467691848101a695037ac738b1f06388cdb3
Instruction ID: 23fb098d4c2ea64a7209d146a68cdae6fba82d1b7ec356e1d7f6e33c2ed4e469
Opcode Fuzzy Hash: 61fdb7aa225dabb3e48f5acb8fa5467691848101a695037ac738b1f06388cdb3
Instruction Fuzzy Hash: 2D611DB0E002499FD708EFBAE85169A7FF3FB88704F14D529E4049B259DB785946CF90

Function 06BC4690 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4']q, xrefs: 06BC4762

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: ec3a9e53a3653cb2d1ae510614b11be48386751d53c28116af43defda52cd91d
Instruction ID: f29b1bd26855fc3623a60838b6d9c6ed16f2a2331f8ba82714287597bf28b37c
Opcode Fuzzy Hash: ec3a9e53a3653cb2d1ae510614b11be48386751d53c28116af43defda52cd91d
Instruction Fuzzy Hash: 4A611DB0E002499FD708EFBAE85169A7FF3FB88304F14D529E4049B259EB785946CF90

Function 06C40F38 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

Z, xrefs: 06C40F14

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1505515367
Opcode ID: 1b30cfe95444a3e0f63c42ea9f0bffed7b0ef9629b659e3784299eaf58902030
Instruction ID: 56cce37d874898df2788f47db11054d49062878ba784bf0c153d24e5f9754bd1
Opcode Fuzzy Hash: 1b30cfe95444a3e0f63c42ea9f0bffed7b0ef9629b659e3784299eaf58902030
Instruction Fuzzy Hash: 87515D70E052589FDB04DFAAD9846AEFFF2EF88300F14C16AD448EB255DB349946CB91

Function 04D90040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031746868.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2574fc1a02fdb4fd1562ad58d4bbbe758cb4d748f8d84379c4400063afc3f5
Instruction ID: 703203315ac25180073330e48e0c47b899bfc3208bb3c524efd1528aa23f0ca5
Opcode Fuzzy Hash: bb2574fc1a02fdb4fd1562ad58d4bbbe758cb4d748f8d84379c4400063afc3f5
Instruction Fuzzy Hash: C612B6B0D817468AD752DF26E88CB893BB2B745319FD0CB09D2615F2E1DBB4116ACF44

Function 06C47578 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6a7a452c1efc033a2778ac07bd728ab62ee631fcc42058c2244102caaac753
Instruction ID: d69165ead7593fae7f5c1d35b9d1ee79d45ca66e0abb29904c06845a94afe323
Opcode Fuzzy Hash: 9e6a7a452c1efc033a2778ac07bd728ab62ee631fcc42058c2244102caaac753
Instruction Fuzzy Hash: 89E1F774E102598FDB14DFA9C5809AEFBB2FF89304F24C169D414AB355D731A942CFA1

Function 06C49520 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdb329414a830c8fbf9d3f340c43715b8028c9b2db5fa0b3978dcbe43f13859
Instruction ID: 9e94a88a9ce215ba7392716c6ae6263ee3f3d27184aad3edd08de0753309cc6d
Opcode Fuzzy Hash: 1cdb329414a830c8fbf9d3f340c43715b8028c9b2db5fa0b3978dcbe43f13859
Instruction Fuzzy Hash: B5E10874E102698FCB54DFA9C5809AEFBB2BF89304F24C169D414AB355D731A942CFA1

Function 06C490E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252f3a435b8769137aef4baee999f8a6b5427ace9ee5e0fcc9450d2be7b0e480
Instruction ID: 83974482a7e147c24da4b78419bc458abfa1cf7d5bbe1c199a8e2c53ad8bc17a
Opcode Fuzzy Hash: 252f3a435b8769137aef4baee999f8a6b5427ace9ee5e0fcc9450d2be7b0e480
Instruction Fuzzy Hash: D8E1E874E002698FCB54EFA9C5809AEFBF2BF89304F24C169D455AB355D730A942CFA1

Function 06C47DE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e67b57ed91871ebd56e68c2c5f2a24c375bb74273ae327e3efeb0c931acc481
Instruction ID: c8e9e0197f0ba04406d63270d7126b7c97c1c1023e7c44fbdd51f7ec4c385ee1
Opcode Fuzzy Hash: 2e67b57ed91871ebd56e68c2c5f2a24c375bb74273ae327e3efeb0c931acc481
Instruction Fuzzy Hash: 8DE10774E112598FDB14EFA9C5809AEFBB2FF89304F24C16AD414AB355D730A942CFA1

Function 06C479B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b170fc4e60bd25440979361362efe4af39faf41a910c8bf8ef3f6236aee29e54
Instruction ID: 6c192ec179cf3e3b37d09d04094648d342f58a9cc33ebfc3ccaf6284f8ffbe49
Opcode Fuzzy Hash: b170fc4e60bd25440979361362efe4af39faf41a910c8bf8ef3f6236aee29e54
Instruction Fuzzy Hash: 06E1E674E102598FDB14EFA9C5809AEFBB2FF89304F24C169D414AB355D731AA42CFA1

Function 0268DDD4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029337887.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2680000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f3a86ba4e62ae47eb7f35e3677cfce9f2624a9376f9fac7ebedd7b9e176372
Instruction ID: d05f143bb67236f730f73fd8ca38dae1f52faf42aba6946eb051c046fdcef55e
Opcode Fuzzy Hash: 51f3a86ba4e62ae47eb7f35e3677cfce9f2624a9376f9fac7ebedd7b9e176372
Instruction Fuzzy Hash: 56A16032E002158FCF19EFB4C84499EB7B3FF84304B2586AAE905AB265DB71D955CF90

Function 06BCF528 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0881e684f9a4f09a40b337534d1f80c078c7c72dc98e671b752092a493678950
Instruction ID: cd385ca3c5d560c430eac4bb21a41634ae57cead999ac2a1e4e13676e26d9b2a
Opcode Fuzzy Hash: 0881e684f9a4f09a40b337534d1f80c078c7c72dc98e671b752092a493678950
Instruction Fuzzy Hash: 6FD14875D2065A9ACB10EF64C894A9DB771FF95300F20C79AE5097B214EFB06AC8CF91

Function 04D90007 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031746868.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c477f8e5124a5253241e3e354df700c61f008c5086cf5c376598e1df30c432d9
Instruction ID: 7cca3f429a9bbc5d6334ce490428d18aa9be91ac92f8b39c5b77205ceae98749
Opcode Fuzzy Hash: c477f8e5124a5253241e3e354df700c61f008c5086cf5c376598e1df30c432d9
Instruction Fuzzy Hash: 94C14CB0D817468FD713DF26E888A893BB2BB85315FD08B09D1616F2E1DBB4146ACF45

Function 06C40F48 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fafc716c48f7f95ab3cc8b26c884780a20db79874fc7533a99c1d61c7aafce
Instruction ID: 7e605cebfc94037fb9f7984a9e06b9c7c11767f42ac16b167f16af9420f2d445
Opcode Fuzzy Hash: 41fafc716c48f7f95ab3cc8b26c884780a20db79874fc7533a99c1d61c7aafce
Instruction Fuzzy Hash: 8851C474E051599FCB44DFAAD5805AEFBF2BF88300F18D126D448A7355D734A942CFA0

Function 06C47DD8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc8d346027e408c059ba60f9a8e8e83b1c57349615318e1aa46e8742afa9350
Instruction ID: cc1932aededfd239b2230abc56897d61a8578742ed5e42b66f5f7358080efbff
Opcode Fuzzy Hash: 1dc8d346027e408c059ba60f9a8e8e83b1c57349615318e1aa46e8742afa9350
Instruction Fuzzy Hash: A1510974E012198FDB14DFA9C5805AEFBF2BF89304F24C1AAD418AB355D7349A42CFA1

Function 06C479A1 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036839628.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c742f85242f1fb4ba5aeb24cfd0023a800d5e995776144099e3112cc603dfd
Instruction ID: c704a5834495395e37d978c0a3b4d7e43700ee15270fa143d032fdec387d8052
Opcode Fuzzy Hash: 35c742f85242f1fb4ba5aeb24cfd0023a800d5e995776144099e3112cc603dfd
Instruction Fuzzy Hash: 6E511B70E002198FDB14DFA9C9815AEFBF2AF89304F24C16AD458BB315D7359A42CFA1

Function 06BC4E18 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036480501.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e3f6d49bfd339f5ed1e741d90499e8290b757bbce08b91f59799de047d7427
Instruction ID: ba192541e5da09dc2cbf6ccaafb909192cec8fd7f9b0187cf54810e8738de04a
Opcode Fuzzy Hash: 67e3f6d49bfd339f5ed1e741d90499e8290b757bbce08b91f59799de047d7427
Instruction Fuzzy Hash: 4F5160B4D016288FEB68CF6AD954799BAF3BFC8200F14C1EAD40DA7264DB751A95CF40

Function 078532C8 Relevance: 41.7, Strings: 33, Instructions: 437COMMON

Download Yara Rule

Strings

4']q, xrefs: 07853459
4']q, xrefs: 078534C2
4']q, xrefs: 07853827
4']q, xrefs: 0785352B
4']q, xrefs: 078535B7
4']q, xrefs: 0785387F
4']q, xrefs: 078536F3
4']q, xrefs: 078533F0
4']q, xrefs: 078537FB
4']q, xrefs: 078534E5
4']q, xrefs: 07853643
4']q, xrefs: 078536C7
4']q, xrefs: 07853620
4']q, xrefs: 07853594
4']q, xrefs: 0785354E
4']q, xrefs: 078537A3
4']q, xrefs: 078533AA
4']q, xrefs: 07853508
4']q, xrefs: 0785366F
4']q, xrefs: 078537CF
4']q, xrefs: 07853413
4']q, xrefs: 0785347C
4']q, xrefs: 078535DA
4']q, xrefs: 078533CD
4']q, xrefs: 07853571
4']q, xrefs: 07853777
4']q, xrefs: 0785371F
4']q, xrefs: 07853436
4']q, xrefs: 07853853
4']q, xrefs: 0785349F
4']q, xrefs: 0785369B
4']q, xrefs: 0785374B
4']q, xrefs: 078535FD

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: fa359a4faf7b2fc51473e99571c09bbf24fcf481421327aae966bdff950ab070
Instruction ID: 10ab2cbfdd51ec6432903222deba1c48d5998e1cf9b8162fb42b25e7ec87af9d
Opcode Fuzzy Hash: fa359a4faf7b2fc51473e99571c09bbf24fcf481421327aae966bdff950ab070
Instruction Fuzzy Hash: 81126B70E0020A8FCB19EF79E890F9D77B2FB44700F2189A9E149AB255DF346955CFA1

Function 078532D8 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4']q, xrefs: 07853459
4']q, xrefs: 078534C2
4']q, xrefs: 07853827
4']q, xrefs: 0785352B
4']q, xrefs: 078535B7
4']q, xrefs: 0785387F
4']q, xrefs: 078536F3
4']q, xrefs: 078533F0
4']q, xrefs: 078537FB
4']q, xrefs: 078534E5
4']q, xrefs: 07853643
4']q, xrefs: 078536C7
4']q, xrefs: 07853620
4']q, xrefs: 07853594
4']q, xrefs: 0785354E
4']q, xrefs: 078537A3
4']q, xrefs: 078533AA
4']q, xrefs: 07853508
4']q, xrefs: 0785366F
4']q, xrefs: 078537CF
4']q, xrefs: 07853413
4']q, xrefs: 0785347C
4']q, xrefs: 078535DA
4']q, xrefs: 078533CD
4']q, xrefs: 07853571
4']q, xrefs: 07853777
4']q, xrefs: 0785371F
4']q, xrefs: 07853436
4']q, xrefs: 07853853
4']q, xrefs: 0785349F
4']q, xrefs: 0785369B
4']q, xrefs: 0785374B
4']q, xrefs: 078535FD

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: 26733db7c8276086bfac8edf95856c27960875610efb10df22816e7c42bd0b53
Instruction ID: 487c40493e463e01f326b380bd6b848b0ad901e8761216942f50dcedae6a3322
Opcode Fuzzy Hash: 26733db7c8276086bfac8edf95856c27960875610efb10df22816e7c42bd0b53
Instruction Fuzzy Hash: C1124A70E0020A8FCB18EF79E890F9D77B6FB44700F2189A9E149AB255DF346955CFA1

Function 07850D77 Relevance: 12.7, Strings: 10, Instructions: 175COMMON

Download Yara Rule

Strings

4']q, xrefs: 07850EA9
4']q, xrefs: 07850F7B
4']q, xrefs: 07850F35
4']q, xrefs: 07850F12
4']q, xrefs: 07850EEF
4']q, xrefs: 07850FC1
4']q, xrefs: 07850FE4
4']q, xrefs: 07850F9E
4']q, xrefs: 07850F58
4']q, xrefs: 07850ECC

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: 78d2963b54f67a021e325ddc9ba816e4c4bbb2210f2aba504c2923773d7dd4ad
Instruction ID: 51b057441531a0cab098d58258b3d466ed939cef9b63ea17b4d7eda2e14e4135
Opcode Fuzzy Hash: 78d2963b54f67a021e325ddc9ba816e4c4bbb2210f2aba504c2923773d7dd4ad
Instruction Fuzzy Hash: 2E715B31E0030A8BCB08EFB9D8546DDB7B2FF85300F628A19E1557B254EF746995CB91

Function 07850D88 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

4']q, xrefs: 07850EA9
4']q, xrefs: 07850F7B
4']q, xrefs: 07850F35
4']q, xrefs: 07850F12
4']q, xrefs: 07850EEF
4']q, xrefs: 07850FC1
4']q, xrefs: 07850FE4
4']q, xrefs: 07850F9E
4']q, xrefs: 07850F58
4']q, xrefs: 07850ECC

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: fc2acd8d65196677657c7f1f783966dd0ce93399e8fdb5c8be75209f5a6641bb
Instruction ID: fcb78b5748f37964a3c3e6e3fb5685ba0a44c91763af2e2f35932d65eb842297
Opcode Fuzzy Hash: fc2acd8d65196677657c7f1f783966dd0ce93399e8fdb5c8be75209f5a6641bb
Instruction Fuzzy Hash: 30715B31E0020A8BCB08EFB9D8546DDB7B2FF85300F628A19E0557B254EF746995CB91

Function 04DF26E0 Relevance: 7.6, Strings: 6, Instructions: 100COMMON

Download Yara Rule

Strings

4']q, xrefs: 04DF27BD
4']q, xrefs: 04DF2849
4']q, xrefs: 04DF286C
4']q, xrefs: 04DF2803
4']q, xrefs: 04DF2826
4']q, xrefs: 04DF27E0

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-471056614
Opcode ID: 8d3cd42d05f21bc1e7860f5ad3fcc27f1a0bcbd6f61340da9c893b30ec0352cd
Instruction ID: 68893a9e868824fbd81f58499a8ca0dfa599f6609e6cc1703129ff0d47053d26
Opcode Fuzzy Hash: 8d3cd42d05f21bc1e7860f5ad3fcc27f1a0bcbd6f61340da9c893b30ec0352cd
Instruction Fuzzy Hash: C5417470E01206CFC74AEF78E455EADBBF2FB45300791C969D045AB2A4DF346911CBA2

Function 04DF26F0 Relevance: 7.6, Strings: 6, Instructions: 95COMMON

Download Yara Rule

Strings

4']q, xrefs: 04DF27BD
4']q, xrefs: 04DF2849
4']q, xrefs: 04DF286C
4']q, xrefs: 04DF2803
4']q, xrefs: 04DF2826
4']q, xrefs: 04DF27E0

Memory Dump Source

Source File: 00000000.00000002.2033424406.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-471056614
Opcode ID: 9e08789edd5886aedf4b81c23b9b942476b4f8da63842675e8b0bee07c6531b9
Instruction ID: a25c5e2526f7b099f83efe2bbd453db6cd5e1ead6b28e2291349353bce119aba
Opcode Fuzzy Hash: 9e08789edd5886aedf4b81c23b9b942476b4f8da63842675e8b0bee07c6531b9
Instruction Fuzzy Hash: 9C411370E4110A8FCB49EF79E495A6EB7F2FB45300BD0C869D005AB2A4EF346911CBA1

Function 0785074F Relevance: 6.4, Strings: 5, Instructions: 102COMMON

Download Yara Rule

Strings

4']q, xrefs: 0785081E
4']q, xrefs: 078507FB
4']q, xrefs: 078507B5
4']q, xrefs: 078507D8
4']q, xrefs: 07850792

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: b8dd6c1b2154f55f8daf564b53556655a2b56f747008bfd3cd40b0af47f1a8dc
Instruction ID: eb61ca83fc558d62598131d757f05a6adca9e00759a3f4f55eeaebbfb5ed84c6
Opcode Fuzzy Hash: b8dd6c1b2154f55f8daf564b53556655a2b56f747008bfd3cd40b0af47f1a8dc
Instruction Fuzzy Hash: E8414131E012068FCB09EF79E895ADDB7B2FF49300B91C929E105BB295DF746851CBA1

Function 07850760 Relevance: 6.4, Strings: 5, Instructions: 100COMMON

Download Yara Rule

Strings

4']q, xrefs: 0785081E
4']q, xrefs: 078507FB
4']q, xrefs: 078507B5
4']q, xrefs: 078507D8
4']q, xrefs: 07850792

Memory Dump Source

Source File: 00000000.00000002.2037217668.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 4295fa63c6870759ac28971da3bcefd6db3804b718664d7310edb3e7d4627cee
Instruction ID: 7e4cb35bb02a7d0ffe0665da13ada2df8cfb812adead5e24da89d3de74ddf8d7
Opcode Fuzzy Hash: 4295fa63c6870759ac28971da3bcefd6db3804b718664d7310edb3e7d4627cee
Instruction Fuzzy Hash: A6415031E0120A9FCB05EF79E854EDDB7B2FB89700B91CA29E0057B294DF746851CBA1

Analysis Process: Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exePID: 2576, Parent PID: 368COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	12

Executed Functions

Function 06F33130 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F3383B
$]q, xrefs: 06F33858
$]q, xrefs: 06F33864
$]q, xrefs: 06F3387C
$]q, xrefs: 06F3382F
$]q, xrefs: 06F33888

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 53dbe99e8a6de6107e6dfb3e232ba86fd9e382d9216f8791847c2cb771b4b015
Instruction ID: 2bf3ac31d1514edfe3f0fd057b132ae36947538f615d2730bee94bb2811402f0
Opcode Fuzzy Hash: 53dbe99e8a6de6107e6dfb3e232ba86fd9e382d9216f8791847c2cb771b4b015
Instruction Fuzzy Hash: 43323D31E1075ACBCB54EF78D89459DB7B2FF89300F2486A9D449AB214EF30AD85CB91

Function 06F37E40 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F3817D
$]q, xrefs: 06F38189

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: f1e9567a4af1e10ca050fbed9e7de823d8bfbb133cdcd7d730237598c7ef4d0c
Instruction ID: 32ba172a899d8db22917f2a0198e73c205d3909a733537872904e72d4cd33345
Opcode Fuzzy Hash: f1e9567a4af1e10ca050fbed9e7de823d8bfbb133cdcd7d730237598c7ef4d0c
Instruction Fuzzy Hash: 0B028F30F002159FDB54DB68D8846AEB7E2FF84344F248569E819DB380DB39EC86CB91

Function 06F35678 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06F35CFD

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 845e85dcb7fe37f9ebcbe4b564c9dbc9084c558a4a21ad4a0822ab58b6ae6b7b
Instruction ID: 227f02c3ff16f63fd95cfca3fecdfb3fe799fcf704b82d2a7f078d5a5229c866
Opcode Fuzzy Hash: 845e85dcb7fe37f9ebcbe4b564c9dbc9084c558a4a21ad4a0822ab58b6ae6b7b
Instruction Fuzzy Hash: 8B22CF75F002298FDF60DFA4C4846AEB7B2EF85324F248469D94AEB344DA35DC46CB91

Function 06F366B8 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fa07a69fa570fa4170717d5965324568eb629ce2eadde6b2187663d4772660
Instruction ID: cef67ebd2b3bd2e2a3a5df01b098b03d6838e71661114c95c67258bc5c51ec86
Opcode Fuzzy Hash: 46fa07a69fa570fa4170717d5965324568eb629ce2eadde6b2187663d4772660
Instruction Fuzzy Hash: D762BF34F002159FDB54EB68D944AADB7F2EF89304F248469E806EB390DB35EC42CB91

Function 06F3B2E8 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d310b583f15d156f3df38ac286b859e530a552fd0c47a30eef1089c4e38c8b1
Instruction ID: e2181fdc2bfcebde3a5fb7e43d124dfd3f9bbc065242405863e1e566e9cbf554
Opcode Fuzzy Hash: 4d310b583f15d156f3df38ac286b859e530a552fd0c47a30eef1089c4e38c8b1
Instruction Fuzzy Hash: 71126174F1011A8BDFA4CF6CD4A47ADB7B2EB59310F248965E409DB391DB34DC828B92

Function 06F3AD90 Relevance: 10.4, Strings: 8, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F3AEB1
$]q, xrefs: 06F3AF04
$]q, xrefs: 06F3AF33
$]q, xrefs: 06F3AEBD
$]q, xrefs: 06F3AF3F
$]q, xrefs: 06F3AF10
$]q, xrefs: 06F3AF68
$]q, xrefs: 06F3AF5C

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: d9a9f834230e3c50624d7d6ba715041643a3d86fac14a8f71e40a3ef5a368aaa
Instruction ID: cbe770c2247400045e2956480f990156291e35e36e25eb781f5d8e0e7d33e206
Opcode Fuzzy Hash: d9a9f834230e3c50624d7d6ba715041643a3d86fac14a8f71e40a3ef5a368aaa
Instruction Fuzzy Hash: 97E17F70F1021A8FCF65DB69D5946AEB7B2EF85304F208A29D846EB344DB34DC46CB91

Function 06F3B710 Relevance: 8.0, Strings: 6, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F3BC7B
$]q, xrefs: 06F3BC47
$]q, xrefs: 06F3BC6F
$]q, xrefs: 06F3BCAF
$]q, xrefs: 06F3BCA3
$]q, xrefs: 06F3BC3B

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: dbaca17187acf3c949e1424bc49885c9717208221d2d67f9a5fc1d28f26fdfda
Instruction ID: eab87e74f061daf24e068da233fe6a3ab5e6d131fdb1beb690f2e90402df54f3
Opcode Fuzzy Hash: dbaca17187acf3c949e1424bc49885c9717208221d2d67f9a5fc1d28f26fdfda
Instruction Fuzzy Hash: CC026F30E1021A9FDFA4CF68D4A46ADB7B2FB55310F20896AD815EB351DB34EC46CB91

Function 06F22870 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06F228EE
GetCurrentThread.KERNEL32 ref: 06F2292B
GetCurrentProcess.KERNEL32 ref: 06F22968
GetCurrentThreadId.KERNEL32 ref: 06F229C1

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 728078327e5b8e342c79b978077562945b06724f6640adfd90f0eab3a2b01b79
Instruction ID: 89779a57a58977e22868b242f52b98f14f81cd57e5d58792d4f3af2d71a888f0
Opcode Fuzzy Hash: 728078327e5b8e342c79b978077562945b06724f6640adfd90f0eab3a2b01b79
Instruction Fuzzy Hash: AC5167B0D0024A8FDB54DFA9D948BDEBBF5EF48304F208459E419A7360D7749944CF66

Function 06F39218 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F39294
$]q, xrefs: 06F392C3
$]q, xrefs: 06F39288
$]q, xrefs: 06F392CF

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 0a01110259c887d45902ce429386ce8a76f835f9e716bd15aab8ae95b8151827
Instruction ID: cae7d96dc0291fabd8d364bcd26c3e0a5620dc0a9f045ec9ebee730f4017e1a9
Opcode Fuzzy Hash: 0a01110259c887d45902ce429386ce8a76f835f9e716bd15aab8ae95b8151827
Instruction Fuzzy Hash: BA914030F1021A9BDB54DB69D8507AEB3F2FF89204F148569D809EB344EEB4DD468B92

Function 06F34C40 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06F3534D
\Obq, xrefs: 06F34DF7
XPbq, xrefs: 06F34D6D

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: fe81906fe28c7d62613890885571f2c3c4ff0ec7930db2e6427a2f9df098c13a
Instruction ID: b791a28da09400a2845975cad4fd4b62f05c5640e596f888356f28ca9c995ec6
Opcode Fuzzy Hash: fe81906fe28c7d62613890885571f2c3c4ff0ec7930db2e6427a2f9df098c13a
Instruction Fuzzy Hash: 2C616B70F002199FEB549FA9C8547AEBAF7FF88700F208429D50AAB395DA759C418F91

Function 06F39214 Relevance: 2.7, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F392C3
$]q, xrefs: 06F39288

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 7cdeed675cfc78d4a578ed4e525fbcb616307d3bf94b23a3fcac6d33efc7395f
Instruction ID: 9c30964cb972871adb05cf49cc9549226f5a63d75cd69e8a9524b716598d6110
Opcode Fuzzy Hash: 7cdeed675cfc78d4a578ed4e525fbcb616307d3bf94b23a3fcac6d33efc7395f
Instruction Fuzzy Hash: 2D519330F001169FDB54DB78E854B6E73F6FB89204F148869D809DB384EE74DC468B92

Function 06F39210 Relevance: 2.7, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06F392C3
$]q, xrefs: 06F39288

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: bc568b5ddcfa967837a7a677091ef57950e537214f6ea239a939b08f7bebcc6a
Instruction ID: 2485e0a7ecad7768371f5a5c27937b77203bc0e5e9810515b583ea4b21784325
Opcode Fuzzy Hash: bc568b5ddcfa967837a7a677091ef57950e537214f6ea239a939b08f7bebcc6a
Instruction Fuzzy Hash: 61518130F101169FDB94DB78E954B6E73F2FB89204F148969D809DB384EEB4DC468B92

Function 06F2AF05 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06F2B156

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1827e6de30f22a494bc0f2687a809d0cb3525f2bb6d1ae7d0971bf052128e6a9
Instruction ID: caf645edd7f12d8dac2b476cd7b4df8eeba931c1dd192e141f29044144e39393
Opcode Fuzzy Hash: 1827e6de30f22a494bc0f2687a809d0cb3525f2bb6d1ae7d0971bf052128e6a9
Instruction Fuzzy Hash: 2A7145B0A00B168FD764DF29D44475ABBF2FF88304F008929D496C7A50D779E845CF91

Function 06F2D0C4 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F2D1E2

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7e391fb9980ae9ac1214f1608ed752bcc8ac43a6bd36b3bb3c25c1f4b8e2eaa4
Instruction ID: c121ddf52943da57d13bb2bed93c2ab855b149e618bd2fdbcb22c686ee11d4d5
Opcode Fuzzy Hash: 7e391fb9980ae9ac1214f1608ed752bcc8ac43a6bd36b3bb3c25c1f4b8e2eaa4
Instruction Fuzzy Hash: 2051DFB1D103599FDB14CF99C984ADEBFB5FF48310F24812AE819AB250D7749985CF90

Function 06F2D0D0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F2D1E2

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4d5837bc53c7081e5b6b6e8f050d10906be0723c6fb4f45e2e8e1f07ed4e73fa
Instruction ID: 565caa514a36a8e7d90ffd7151a3372b867e75b49c61d90fc118b200ab2ad1c8
Opcode Fuzzy Hash: 4d5837bc53c7081e5b6b6e8f050d10906be0723c6fb4f45e2e8e1f07ed4e73fa
Instruction Fuzzy Hash: 7D41B0B1D103599FDB14CF99C984ADEBBB5FF48310F24812AE819AB250D775A885CF90

Function 06F2A5BC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06F2F8E1

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 406e8d4e40c50c9b52d383c8c33c9a7400ac52f84a789d140d9162b139d93275
Instruction ID: 176774729b44c6c8d112996bf73087d83312669143e0ea759d84b9c45b94b2b7
Opcode Fuzzy Hash: 406e8d4e40c50c9b52d383c8c33c9a7400ac52f84a789d140d9162b139d93275
Instruction Fuzzy Hash: 164149B5D1031ACFDB44CF99C888AAAFBF5FB88314F248458D419AB321D374A841CFA0

Function 06F22AB0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06F22B3F

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 39797ac286003f27ee92318bfc2f600382dcad7377cc49167e95f32246bd13db
Instruction ID: d098e47e790d13d61202f2f8a36a6673e097061447b69360d3a778bf3309e36d
Opcode Fuzzy Hash: 39797ac286003f27ee92318bfc2f600382dcad7377cc49167e95f32246bd13db
Instruction Fuzzy Hash: 8A21E2B5D002499FDB10CFA9D985AEEBBF4FB48310F14801AE919A7310D374AA55CFA1

Function 06F22AB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06F22B3F

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 124169b1a2d6ba3d84dc74ca569d2ba70d28906e731e95e2b00efd87d83949c7
Instruction ID: bb7945cbc07f05071953ffe76898f8dbf403e263e805601ddcfd9b6334735451
Opcode Fuzzy Hash: 124169b1a2d6ba3d84dc74ca569d2ba70d28906e731e95e2b00efd87d83949c7
Instruction Fuzzy Hash: 1221E2B5D002099FDB10CFAAD984ADEFBF8EB48310F14801AE918A7310D374A954CFA1

Function 06F2B352 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06F2B1D1,00000800,00000000,00000000), ref: 06F2B3C2

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 346685e1c3642a673a8e01a4ebf0db25a9a500344c3778b2ab15f502ccd6d8d4
Instruction ID: 058999734359847a5100106148565bf1de9d7d728709116cedcf97932b69793e
Opcode Fuzzy Hash: 346685e1c3642a673a8e01a4ebf0db25a9a500344c3778b2ab15f502ccd6d8d4
Instruction Fuzzy Hash: 6811E4B6D003499FDB10CF9AD845ADEFBF4EB89324F14841ED819A7600C375A945CFA5

Function 06F2A2F8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06F2B1D1,00000800,00000000,00000000), ref: 06F2B3C2

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3f3af3586f7935f1847749b6dc6195c6a90feb6bd111863653f1d04a5f850c5e
Instruction ID: 7f779e79a312f56ea6931637db9d44105d21c1ea38f1653b6ff12587fe798110
Opcode Fuzzy Hash: 3f3af3586f7935f1847749b6dc6195c6a90feb6bd111863653f1d04a5f850c5e
Instruction Fuzzy Hash: 0D1114B6D0034A8FDB10CF9AD949A9EFBF4FB88314F14842ED919A7200C375A945CFA1

Function 0308EBA8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0308EC0F

Memory Dump Source

Source File: 00000003.00000002.3273062027.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3080000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 410caf181ff0af222ad01dc9f9a9a753dde9bac4e1b9ab5e6b51377855008ced
Instruction ID: 42b9baa63ad7ee98766179bc558df66c670b4470dff8820afe214787a9b1ef3e
Opcode Fuzzy Hash: 410caf181ff0af222ad01dc9f9a9a753dde9bac4e1b9ab5e6b51377855008ced
Instruction Fuzzy Hash: 1C11F0B1C0065A9BCB10DF9AC945BDEFBF4EF48320F15816AD818A7240D378A945CFA6

Function 06F2B0F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06F2B156

Memory Dump Source

Source File: 00000003.00000002.3280171517.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f20000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fd36183b9e488f7e21d32dbefaa2b8b4abad716b5055ca41e5715a0fbd8d4e03
Instruction ID: 2f53281fbd2eab4afae4f3f4bd6036f06290b8dc77024fcf3ffd597c3e6a902e
Opcode Fuzzy Hash: fd36183b9e488f7e21d32dbefaa2b8b4abad716b5055ca41e5715a0fbd8d4e03
Instruction Fuzzy Hash: A511E0B5C0065A8FCB10DF9AD844ADEFBF4EB89314F10841AD829B7210D379A545CFA1

Function 06F34C38 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06F34D6D

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: 289505a11b25fe8679ed6d7d160f863b392268afe5e787e49fccc790e248d7c3
Instruction ID: da654eea500a5b393aab3784fc83f2114faa48db87be8f31b6f890813c02045e
Opcode Fuzzy Hash: 289505a11b25fe8679ed6d7d160f863b392268afe5e787e49fccc790e248d7c3
Instruction Fuzzy Hash: 5D417D70F002199FDB55DFA9C854BAEBAF7FF88700F208529D106AB395DA749C018F91

Function 06F3DB6D Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06F3DCC9

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 91a58f65f1ca9c4684cb6d8bf9c5936d3ff66c478a127bf399c9b00241ef564f
Instruction ID: f7fe6daa06d8ffc5c3b9ec5efcb34058593566024185b9f4b0cbb66cd8231a69
Opcode Fuzzy Hash: 91a58f65f1ca9c4684cb6d8bf9c5936d3ff66c478a127bf399c9b00241ef564f
Instruction Fuzzy Hash: C041B370E103199FDF55DF65D88469EBBB2FF85384F204529E806D7240EBB4E846CB91

Function 06F3DB80 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06F3DCC9

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: c5a4279615c8a826d208b358df9426005b8771e9a3a7e9d1aae3f4c883d5fae6
Instruction ID: 9579523153045868c62f4dc4f1fae73bb5346834ca995c353b05ade882270112
Opcode Fuzzy Hash: c5a4279615c8a826d208b358df9426005b8771e9a3a7e9d1aae3f4c883d5fae6
Instruction Fuzzy Hash: 3D419170E1021ADFDF55DF65C4846AEBBB2FF85344F204529E406DB244EBB4E946CB81

Function 06F32290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06F323CB

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ef12511952082b72d50a36f724a422d33cd0b0252b185fce83af58ed279139ee
Instruction ID: 220291a6f9c6ef538ea9060e78f642e7c1fef41bc9b73647d6906aa2e8bcda86
Opcode Fuzzy Hash: ef12511952082b72d50a36f724a422d33cd0b0252b185fce83af58ed279139ee
Instruction Fuzzy Hash: 0B31DC30F102158FDB49AB78D95566E3AE3AF89604F248438D506DB384DE39DE46CBE2

Function 06F38135 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F3817D

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: bbb82b87adc77bcd622cb4be0365cc488b6c9b249d5b21fccaa5d45708f56c7d
Instruction ID: bd7acb4212255c9bf8db4c5061e49c66e080dcee0f988a5b3ef14c16cc56c4eb
Opcode Fuzzy Hash: bbb82b87adc77bcd622cb4be0365cc488b6c9b249d5b21fccaa5d45708f56c7d
Instruction Fuzzy Hash: B901F437F14224DBEF6868A5EC846AA7769EB843D0F050436FA31D3240DA69DD05C2E1

Function 06F38138 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F3817D

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 2f0965f58061bd0fe5abb226f7d0fd7f550985bc22b8ae9951dc3e6c63ac3e9b
Instruction ID: cdb28b5cdf22640683d5dfc8f73dd0dc25d86a77be6d2c71482f25fd0f30ec42
Opcode Fuzzy Hash: 2f0965f58061bd0fe5abb226f7d0fd7f550985bc22b8ae9951dc3e6c63ac3e9b
Instruction Fuzzy Hash: C2F0F433F14224DBEF6468A5EC846AA7769EB842D0F050436EA31D3240DA69DD05C2D0

Function 06F32BBD Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688d1ed8c701a92a9564bf3358af784cfe57b0c5741630889a2da7f4fc353181
Instruction ID: c9a8153a3293fdad5723495a5e33e72fc44c75141558ecaefd4434001ed89ae4
Opcode Fuzzy Hash: 688d1ed8c701a92a9564bf3358af784cfe57b0c5741630889a2da7f4fc353181
Instruction Fuzzy Hash: F3023435E002648FCB64DB68C584AADB7F2FF44358F58C4A9D50AAB351DB35ED82CB90

Function 06F3C5F0 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b59ff3140532fe26bad5ad18b8f290562eb9474ec5ddd6042da574f013de9c
Instruction ID: 19016400511d308373ce15c508b54d31374a7668716bc172307cc0a5d798d7f3
Opcode Fuzzy Hash: e0b59ff3140532fe26bad5ad18b8f290562eb9474ec5ddd6042da574f013de9c
Instruction Fuzzy Hash: DAD18035B002159FCF54DF68E984AADBBF2EB89314F208565E905EB340DB35EC46CB91

Function 06F3B2F4 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91c1fee79496a452c6c43b6f51a48a2c7f211f781fdd7790176b8d9cead6508
Instruction ID: b02093e0bfca336503d225a799f1cc55557803e8b6dd55a3254d37e6308e3a79
Opcode Fuzzy Hash: b91c1fee79496a452c6c43b6f51a48a2c7f211f781fdd7790176b8d9cead6508
Instruction Fuzzy Hash: 44A1A574F101198BEF64DF6CD4A47BE77B6EB99310F244469E509E7381CA34DC818B92

Function 06F3B2F0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff4201f53b8ff97bd113d26d547894b28798836d1702436cdcac94f3e33e105
Instruction ID: 85abf477efc4527688c1b765acd65db93a8fd42c400e811d6183c8198f25b5fc
Opcode Fuzzy Hash: 9ff4201f53b8ff97bd113d26d547894b28798836d1702436cdcac94f3e33e105
Instruction Fuzzy Hash: 9BA1A574F101198BEF64DE6CD4A47BE77B6EB99310F244469E509E7381CA34DC818B92

Function 06F362B8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070d09a3238e79ad96ab2582e9766732daafa612f304d338e00dbca7bdf7e564
Instruction ID: 9230f59161a6c18377d693afa0516d52c7bee3c2675f7594ee88943a186d62aa
Opcode Fuzzy Hash: 070d09a3238e79ad96ab2582e9766732daafa612f304d338e00dbca7bdf7e564
Instruction Fuzzy Hash: FF61B171F001214FDF64AA6EC88066FBAD7AFD4624B254479E80EDB360DE79DD0287D2

Function 06F34371 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1015abdf26d813183014840d3c802e5a6b7b96823f8ecef5e73561c78a48884c
Instruction ID: 63b08a86b0dc13376f3cf793f646b4620cda0ae0a9136424398929b7ebf5e09d
Opcode Fuzzy Hash: 1015abdf26d813183014840d3c802e5a6b7b96823f8ecef5e73561c78a48884c
Instruction Fuzzy Hash: 50814C30F002198BDB54DFA9D4546AEB7F7AF89304F148469D90ADB394EB34EC468B92

Function 06F346A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ce527c7c1ddf27edacbad993c668346b2a3fa933ed0df4f024ce1b99945062
Instruction ID: d1e7a60bcdd6fcfe523ba25daf0673e8836ad0ec10c45f18cd13ccd91840ec70
Opcode Fuzzy Hash: 83ce527c7c1ddf27edacbad993c668346b2a3fa933ed0df4f024ce1b99945062
Instruction Fuzzy Hash: 0D912D34E1061A8BDF60DF68C890B9DB7B1FF89300F208599D54DAB345DB70AA86CF91

Function 06F3EBD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70360e39644acf757bdab5f785e0d26a65834fb71c74244329ec3c6dc721cd6
Instruction ID: fba657a9187369410d9cf7c1e71474d942fddccaf540278c1f3d3a9b51f7f797
Opcode Fuzzy Hash: b70360e39644acf757bdab5f785e0d26a65834fb71c74244329ec3c6dc721cd6
Instruction Fuzzy Hash: AC711A30E002199FDB55DFA8D994AADBBF6EF88304F24846AE455EB354DB30EC46CB50

Function 06F35980 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7baac4ab64ddffadef62464d8152ff16f59e348fb9ee9cc056557c4fba38019
Instruction ID: ff6713b70bba1db5585f8cab308e645678af24c7e2913b7b80a45d93dd621ce9
Opcode Fuzzy Hash: c7baac4ab64ddffadef62464d8152ff16f59e348fb9ee9cc056557c4fba38019
Instruction Fuzzy Hash: 9B713671E002199FDB14DFA4C994ADEBBF2AF88324F208568D405BB354DA71AD42CB91

Function 06F3EBD7 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766b0c4eb3004c568091145462a2a2d570a4f48c8c417543e6b3103e1bfd76cd
Instruction ID: ff10d7d97a9d6dadd26dcd798d5050f8d336240592083786871a56ad4cdc1f77
Opcode Fuzzy Hash: 766b0c4eb3004c568091145462a2a2d570a4f48c8c417543e6b3103e1bfd76cd
Instruction Fuzzy Hash: 86711930E002199FDB55DBA8D994AADBBF6EF84300F24846AD455AB254DB30EC46CB50

Function 06F3FA11 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58e643a459de629866565755b882bb1e11a5847282ada84fc5cf284de36b238
Instruction ID: 56afb6eac90d349a5fa7978b306260c8bdd9ece0a2c62b36b3890521ad174ab5
Opcode Fuzzy Hash: d58e643a459de629866565755b882bb1e11a5847282ada84fc5cf284de36b238
Instruction Fuzzy Hash: F4512BB4F212269FEF645A6CD85873F266BD78E340F20442AE50AC73D1CA7CCC9147A2

Function 06F3FC75 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09c6651098d7ef56a20035165b57acef2831627b3529b3749cac095d02f80ac
Instruction ID: d4e34870c25ab23d20216bacfacea6c36edc12338da3bfdf77181e18e3785448
Opcode Fuzzy Hash: c09c6651098d7ef56a20035165b57acef2831627b3529b3749cac095d02f80ac
Instruction Fuzzy Hash: AD51DF31F02225CFDF54EBB8E4486ADB7B2EF88315F20887AD50AD7250DB358985CB81

Function 06F3FA20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957d02ec54d53f885e676acb0e70e4ed89daf6eb1588fe58bfe7f0d02c2548f3
Instruction ID: 21304e29ca085d3eb2fe6ce92d814abca3b6851b5760ad77887e650f06cdb637
Opcode Fuzzy Hash: 957d02ec54d53f885e676acb0e70e4ed89daf6eb1588fe58bfe7f0d02c2548f3
Instruction Fuzzy Hash: C751EAB4F212269BEF645A6CD85873F366BD78D351F10442AE60AC73D0CA7DCC9147A2

Function 06F354E9 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939de2473db3df6cddebda4835b427782bd6ecce91cff55022b018a530afbd40
Instruction ID: 8ccc899593d64f15c1420c88d08e02d7f12de0a9fb81d20a7d3146bed7ecba10
Opcode Fuzzy Hash: 939de2473db3df6cddebda4835b427782bd6ecce91cff55022b018a530afbd40
Instruction Fuzzy Hash: BC416B71E006198FDFB0CEA9D880AAFFBF2EB95314F10492AE116D7650D331E9558B90

Function 06F32150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1f0729642a03d767e309fcaae4098b3a3c7c8faaf2113ffd53a9242363c300
Instruction ID: 788dc5027f2db4dcf8b5017dcd3feeb8d9d90bd10924a1994ed654dcf37922dc
Opcode Fuzzy Hash: 6c1f0729642a03d767e309fcaae4098b3a3c7c8faaf2113ffd53a9242363c300
Instruction Fuzzy Hash: 7E319C31E102199FCB05CF69D95469EB7B2FF89300F208519E916F7340DB71AE42CB50

Function 06F3DA35 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740072bed93283670f1bcb2f249ef6e1c480fbb8506606f8e3999eb7284a0276
Instruction ID: 5152809ba827766c68bea99ab4a5eb00410bd03ab814e560b07eda2f628cca6f
Opcode Fuzzy Hash: 740072bed93283670f1bcb2f249ef6e1c480fbb8506606f8e3999eb7284a0276
Instruction Fuzzy Hash: 8B318870E1071A8BCF55DF68D58069EB7B2FF85304F248929E805EB341EB74E986CB41

Function 06F35668 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdc73edbf315a83ba933e18819ec866121d39fd528dd26cc3d7175a2cc31032
Instruction ID: 12b4b32d6273cd12b23f4b86303ab58423d6f4d1c78aac4c4685c6427120f1c6
Opcode Fuzzy Hash: ffdc73edbf315a83ba933e18819ec866121d39fd528dd26cc3d7175a2cc31032
Instruction Fuzzy Hash: 0B219575E102158FDF708EA9C98077EB7B2FBC6320F20893AD55AD7280D635D942CB91

Function 06F33B71 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4a66d9219a0590d9c22c7cab64fdb873e0d8ee7459b75466329377ddc5e79a
Instruction ID: e38392017d7813e86f4cbc8f3408a2c57d6bc3dbafe548f6e700858eb0a35f07
Opcode Fuzzy Hash: 6c4a66d9219a0590d9c22c7cab64fdb873e0d8ee7459b75466329377ddc5e79a
Instruction Fuzzy Hash: 12217E75F11215AFDB50DF68E880AAEBBF5EF48350F144025E905EB250DB35DD418BA1

Function 06F35675 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4921ca0999d75df17083d52c27b7cd1ddede91a08d7a18b55f84fdf3a0c28e3a
Instruction ID: a65e6b7459b1bb6ed202b6d06716005f4a9af0f26d5b6baa666ef2acd30127ee
Opcode Fuzzy Hash: 4921ca0999d75df17083d52c27b7cd1ddede91a08d7a18b55f84fdf3a0c28e3a
Instruction Fuzzy Hash: 87219275E102158FDF708EA9C48077EB7B2FBC5320F20893AD55AD7290D635D942CB51

Function 06F33B80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7a1c4d26967cf2d5b55d6380fb683a25c3197c04091634ba86a1ff217c3e23
Instruction ID: e93afffd1b0ff69bd8a77d54c64ca8766be98a12896ecba01de961a3e98f51aa
Opcode Fuzzy Hash: ed7a1c4d26967cf2d5b55d6380fb683a25c3197c04091634ba86a1ff217c3e23
Instruction Fuzzy Hash: 17219C76F102259FDB50DF69E880AAEB7F5EF48310F148025E905EB340EB35DD018B91

Function 02FFD005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3272827675.0000000002FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2ffd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530b68f3aef747a1c640c9fa0312fa1acd05d61f5ce326a773e577836b423710
Instruction ID: 98e432d03ade3255e3fb1e86563ceace61f85160da790fd20781be192fa3089f
Opcode Fuzzy Hash: 530b68f3aef747a1c640c9fa0312fa1acd05d61f5ce326a773e577836b423710
Instruction Fuzzy Hash: 452148715093C09FDB038B24D994711BF71AF46214F29C5EBD9898F6A7C33A981ACB62

Function 02FFD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3272827675.0000000002FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2ffd000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027d38f9436be1e8a1bddf57411aaff439425ba17ba541fa4be46a7439fdac56
Instruction ID: fcdaf8163de24660fcae21420244e12eaeac7548f2f8042498925681fbcaa634
Opcode Fuzzy Hash: 027d38f9436be1e8a1bddf57411aaff439425ba17ba541fa4be46a7439fdac56
Instruction Fuzzy Hash: 2F2137B1A04204DFDB54DF14D9C0B26BBA5FF84714F24C56DDB0A4B66AC336D407CA61

Function 06F36DD4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb35b7defde7ee8c3422e8f9a54738057dbdd05527c68c33801606f910f6f56
Instruction ID: 916b7e1bb75a1f6af3723bb67041c1c44e70db81e858c78671cb97afb3418679
Opcode Fuzzy Hash: 7cb35b7defde7ee8c3422e8f9a54738057dbdd05527c68c33801606f910f6f56
Instruction Fuzzy Hash: A621D231F10129ABDF94EB69E95469EB7F7EF88310F148425E809EB340DB34DC558B85

Function 06F36DD1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7289e5d42f28a1aca854282417c2272586c578b15e962ed1d8369ee94907412
Instruction ID: 7f789556134ae94f0ce704ba6132fb509ba915a71319a3e9baa022c5c7dc13e7
Opcode Fuzzy Hash: c7289e5d42f28a1aca854282417c2272586c578b15e962ed1d8369ee94907412
Instruction Fuzzy Hash: 5721B131F10128AFDF94EB69E9546AEB7B3EF88310F248425E409EB380DB34DD558B85

Function 06F36DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a585bde65d0f2499424213430bfd5c26ca96dccf7b8f28120d2628644516d171
Instruction ID: 6a93507a1ef266cc8eb58849086307e81a2133f0eceb3f80fe06dc6ebdaf11f7
Opcode Fuzzy Hash: a585bde65d0f2499424213430bfd5c26ca96dccf7b8f28120d2628644516d171
Instruction Fuzzy Hash: 9121B431F10128ABDF54EB69E95469EB7F7EB88310F148425E409EB340DB34DC558B85

Function 06F33128 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4562093d47767e359969b4f10bb91795cce453e993055e1513f77ebfe5d1da60
Instruction ID: 8a57e675e31282069e56ea29aac6def50e59d89633713519a328ee016640f51e
Opcode Fuzzy Hash: 4562093d47767e359969b4f10bb91795cce453e993055e1513f77ebfe5d1da60
Instruction Fuzzy Hash: A0119372E002289BCB68DB78DC415DEB7B6EB89310F1485A9E40AEB344DA31D941CFD1

Function 06F3AFD6 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb1e0526b600df10d6b1f6168bcb70452e02e653d369dd4c3f6bb73dea85d58
Instruction ID: 7abc03b00b1715d786c565964e4deaafbbbd10617db54128a1c9fbbc5f14d07d
Opcode Fuzzy Hash: 6fb1e0526b600df10d6b1f6168bcb70452e02e653d369dd4c3f6bb73dea85d58
Instruction Fuzzy Hash: 6011C172D1072E8BCF25CFA6C85069EFBB5BF86300F10462AD805FB200EBB09945CB81

Function 06F3AFDD Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879e0dbd232c42817acc88cdac070bdc3b7c708eb36953878717a3ff87b6c1c8
Instruction ID: 971b05a37f06e5a03e5bee59ea05374fd7b1ec79138c1cdeb7ce404805094464
Opcode Fuzzy Hash: 879e0dbd232c42817acc88cdac070bdc3b7c708eb36953878717a3ff87b6c1c8
Instruction Fuzzy Hash: BD119171D1076E9BCF25CFA6C95169EFBB5BF86300F10462AE805FB200DBB09946CB81

Function 06F33C90 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75043611b237d701309af2dfe5ed096db30d39fde9c05a0284babe89685a3782
Instruction ID: 73e01d4b1d138cbf2a7d99f47f2b570ff56289fbc9ccd5bfe0170921e4e0ac22
Opcode Fuzzy Hash: 75043611b237d701309af2dfe5ed096db30d39fde9c05a0284babe89685a3782
Instruction Fuzzy Hash: 64118B36B101284BDB54DA68D8146AE72EBEBC9650F018139C80AEB340EE29DC068BD2

Function 06F3AFD8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e952f7ec13c57096615d6a41c53c1c30ab65051275dbb49c55cbf4b5f7973f1
Instruction ID: ace062d79ae940a4c50e7e5a8a3498e0dfe6d5070499983cfc127323bbed4e7c
Opcode Fuzzy Hash: 9e952f7ec13c57096615d6a41c53c1c30ab65051275dbb49c55cbf4b5f7973f1
Instruction Fuzzy Hash: 49119171D1472A8FCF25CFA5C5516DEBBB5BF95300F20462AE805FB200E7B09946CB81

Function 06F342D0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21df93d35a21c66cc2a864a27521f08366803250aaec06e8d49c117ee80f7923
Instruction ID: 8b102ccc455321fed9cb5e2ef3253658aefbc5bdef092c91a508bbd92fc487f3
Opcode Fuzzy Hash: 21df93d35a21c66cc2a864a27521f08366803250aaec06e8d49c117ee80f7923
Instruction Fuzzy Hash: 61012431B040200FDB61D57C981576F67DADBCA710F24843AE00ED7391D9A5CC4343A2

Function 06F3AFE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5a4a841121d7476d821189f7fae38f11243d7b87b66c8441b2b123a1f3574a
Instruction ID: 0c3c18dda89107ea2157ddf11fdb5f63b1d0b72bcd7055421af850118e6f5ecd
Opcode Fuzzy Hash: 5c5a4a841121d7476d821189f7fae38f11243d7b87b66c8441b2b123a1f3574a
Instruction Fuzzy Hash: 2B115171D1072E9BCF25CFA6C95169EFBB5BF95300F10462AD805FB200DBB09945CB91

Function 06F342DC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ae1fb352b229898628d4f18c51d06f1ac4675a390c9c1d5335478e27622938
Instruction ID: e7cb9e389df420281e66d4b0af14f2c65b32004c9108bff90fed1d2b292d8356
Opcode Fuzzy Hash: 10ae1fb352b229898628d4f18c51d06f1ac4675a390c9c1d5335478e27622938
Instruction Fuzzy Hash: 75018B31B001204BDB65E57DA84572FA7DADBC9B14F20843AE50ED7385EAA5DC434392

Function 06F33950 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb7bbda699171f6c440403640583efa3c07c883e03b57bdfd51ca6956bd98c9
Instruction ID: 6c2503804c7e64c4cd581d71be5b287c4dbf167958f82c0b9184bfe46aac93fd
Opcode Fuzzy Hash: aeb7bbda699171f6c440403640583efa3c07c883e03b57bdfd51ca6956bd98c9
Instruction Fuzzy Hash: 1511BDB5D01259AFCB00DF9AD985ADEFFB8FB49310F50812AE918A7340C374A954CFA5

Function 06F342E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a01e6b5cf20a01fea54665616b5c37041bcab8d2c6db8cbe9f123ecb6811e5
Instruction ID: 413bcd027d3c011dae5f913b3a0eadb998f112d2b91d70cc5dd0964f3c51d157
Opcode Fuzzy Hash: 41a01e6b5cf20a01fea54665616b5c37041bcab8d2c6db8cbe9f123ecb6811e5
Instruction Fuzzy Hash: 0101A931F000200BDB64E96DA84572FA2DAEBC9B14F20883AE50EC7380EEA5DC434392

Function 06F3EE58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87fc53645e9d25d804a66d45ab44794533ff29b14e05ccafd6079243f318f0f
Instruction ID: 138446936f0bdf1e1415df4edd563891f837b6476a62842cc155a86d9b4554b5
Opcode Fuzzy Hash: b87fc53645e9d25d804a66d45ab44794533ff29b14e05ccafd6079243f318f0f
Instruction Fuzzy Hash: 53018131F102204BDB65D57DA45472FB3D6DBC9A25F11883AE90EC7340DE65EC424392

Function 06F3A3D4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1668e9eedaa14c2bed777f721252ea01e52454675f85e47006647ff5507c8ea6
Instruction ID: 349e6a8832a8f90b68c437782dffaac0d0ee4c95191cae69adfd00fb1e918d7e
Opcode Fuzzy Hash: 1668e9eedaa14c2bed777f721252ea01e52454675f85e47006647ff5507c8ea6
Instruction Fuzzy Hash: 03018631F002245BCB61DA7EE858B6B77D6EB8A755F108839E50EC7350DE26DC428792

Function 06F3A3C8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9990205b7e50d5aed787d3c7d3b01dcb7849c7751596634e8531388f6be141f0
Instruction ID: 17756a37b6803272f71fae3851d94a44863cf625626a5f3ecca4fa1076a47396
Opcode Fuzzy Hash: 9990205b7e50d5aed787d3c7d3b01dcb7849c7751596634e8531388f6be141f0
Instruction Fuzzy Hash: FE018131F002204FDB65DA7EE459B7B73D2EB8A714F208829E55ECB350DE26DC428782

Function 06F3A3D1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0997bfebbf862cbed9ad4d29405f8291324d96bfaba233525c6979cbbb7625
Instruction ID: 21b63870ebbede6a2beb6f9019b7106c7a51d002294e57887f44defbdbac96fd
Opcode Fuzzy Hash: 4c0997bfebbf862cbed9ad4d29405f8291324d96bfaba233525c6979cbbb7625
Instruction Fuzzy Hash: 98018131F002204FDB61DA7DE458B6A67D2EB8A710F208828E50EC7350DE26DC428781

Function 06F3A3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032ba459b323883fa42ee01048195b1d2c41a430c466a8deb878ddbbbbf153a4
Instruction ID: 0cdce9c8376efd59451447a77a233fdb7bebdb0dc7bd8cf1144b553999078bbc
Opcode Fuzzy Hash: 032ba459b323883fa42ee01048195b1d2c41a430c466a8deb878ddbbbbf153a4
Instruction Fuzzy Hash: 44014431F102244BDB61DA7EE458B6B73D6EB8A755F108839E50EC7350EE26EC428782

Function 06F3C88C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715a403e057e69cdfe799ec5beb4e6b83783ee9f8c244f0a1f310db52d70600f
Instruction ID: d88f450946503c081d0ef421388c3eed6909b6b3491e6d88ba53ed012afc68fa
Opcode Fuzzy Hash: 715a403e057e69cdfe799ec5beb4e6b83783ee9f8c244f0a1f310db52d70600f
Instruction Fuzzy Hash: 6001D631F11228A7CF14DA69FC456EE7776EB85354F104439E905F7340DB719C458791

Function 06F3C888 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ace10798d4a07e0cdfe824154bce40526e7b0260e8c4914f8dd8ed38acd6f0
Instruction ID: 00a792312ef36dfa94c2d6f4bf0bc4c0400dfd0b442eed8882b542b29ba89773
Opcode Fuzzy Hash: 15ace10798d4a07e0cdfe824154bce40526e7b0260e8c4914f8dd8ed38acd6f0
Instruction Fuzzy Hash: 2001F432F15138ABCF54DA68F8546AD7776EB84311F104439E905FB340DB319C45CB80

Function 06F3C890 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1315e4aa63495106b737c303fa9816f3fd9e8bc38352bc8d7098e0fb04cb476f
Instruction ID: 2504e9543df6b9c1189dafd4be65b7c7e4a938ac25531525591dae91be871327
Opcode Fuzzy Hash: 1315e4aa63495106b737c303fa9816f3fd9e8bc38352bc8d7098e0fb04cb476f
Instruction Fuzzy Hash: 7B01F431F11238ABCF14DA68F8446ADB776EB84310F104439E905FB340DB71AC458B80

Function 06F3654E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab5e1713da9774f516956b7e1dfc72e559f7372e177ceb420dea2d26b4fd7a9
Instruction ID: f0281fc8774d8afc5773f25ec99bb3d65a1de3eac9bd46aa2ce7beaa219100ea
Opcode Fuzzy Hash: 1ab5e1713da9774f516956b7e1dfc72e559f7372e177ceb420dea2d26b4fd7a9
Instruction Fuzzy Hash: 25D05E71E10228ABDFA0CEA8CA4935E7369EB01208F20C9B5D409DB246E277CE41C780

Non-executed Functions

Function 06F37760 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F37CE1
$]q, xrefs: 06F37CD5
$]q, xrefs: 06F378B6
$]q, xrefs: 06F37CF7
$]q, xrefs: 06F37885
$]q, xrefs: 06F37CEB
$]q, xrefs: 06F378AA
$]q, xrefs: 06F37879
$]q, xrefs: 06F37C36
$]q, xrefs: 06F37C42

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: b841541f69df863822a83e5ae53650044ccf42bf28985397865d0a53cb6058e0
Instruction ID: a9783d423645151b5c345afeafec0bf4cdd424e26996d44bedad1cef3e6e562a
Opcode Fuzzy Hash: b841541f69df863822a83e5ae53650044ccf42bf28985397865d0a53cb6058e0
Instruction Fuzzy Hash: CE122E70F01229CFDB64EF69D894A9EB7B2BF88304F208569D449AB354DB309D85CF81

Function 06F3A9F8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F3AB80
$]q, xrefs: 06F3AAFA
$]q, xrefs: 06F3AB49
$]q, xrefs: 06F3ABAA
$]q, xrefs: 06F3AB55
$]q, xrefs: 06F3AB74
$]q, xrefs: 06F3ABB6
$]q, xrefs: 06F3AAEE

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: a87ecfc5ad233620167816c693e6359f5d020c65dee837d13a2927926d717840
Instruction ID: 175a967f0ba39636b850402b8034d103bbebca6d506d8ef65852e2317b2787de
Opcode Fuzzy Hash: a87ecfc5ad233620167816c693e6359f5d020c65dee837d13a2927926d717840
Instruction Fuzzy Hash: 0B916130E10219DFDB68DF6AD994BAE77F2FF84341F108529E8859B290DB749C41CB91

Function 06F37160 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F37668
$]q, xrefs: 06F37674
$]q, xrefs: 06F375FC
$]q, xrefs: 06F374A8
.5uq, xrefs: 06F371BB
$]q, xrefs: 06F3749C
$]q, xrefs: 06F37442

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 1f736e25252fce52b02241330d77e3a226071b5f6c1072a1ba1770e5ebf6af56
Instruction ID: 9ff162124ef0c49cacc812199ca796f447f2bebf8bcadb7702e62ed7d272cd23
Opcode Fuzzy Hash: 1f736e25252fce52b02241330d77e3a226071b5f6c1072a1ba1770e5ebf6af56
Instruction Fuzzy Hash: 24F17C74B11219CFDB98EFA8D494AAEB7B2FF84340F248469D4459B354DB34EC46CB81

Function 06F38498 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F38763
$]q, xrefs: 06F386F2
$]q, xrefs: 06F38757
$]q, xrefs: 06F386FE

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a3c0dc5ebba92113f358d229e55fc191ac241dac33cb34a63f51886c36e52bb7
Instruction ID: 60f335f3448bedb006671e18cdf9d98647432a6e50b0ad90a041b505930532b3
Opcode Fuzzy Hash: a3c0dc5ebba92113f358d229e55fc191ac241dac33cb34a63f51886c36e52bb7
Instruction Fuzzy Hash: C0B13B30F11219CFDB54EF68D4846AEB7B2EF84344F248869E4169B394DB79DC86CB81

Function 06F388B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06F389F2
$]q, xrefs: 06F3893B
$]q, xrefs: 06F3892F
LR]q, xrefs: 06F389A3

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 54e005986ea5aacfaa462ad1eb288b872a55cc09ede97921427a977923b0a244
Instruction ID: cc44b49353d178ccda04ebfcc94adcc787f9b1c03eac1dcdd578d730157a350f
Opcode Fuzzy Hash: 54e005986ea5aacfaa462ad1eb288b872a55cc09ede97921427a977923b0a244
Instruction Fuzzy Hash: 5051B130B002159FDB58DF28D884A6AB7F2FF89744F148969E8169B394DB38EC45CB91

Function 06F3AD84 Relevance: 5.2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F3AEB1
$]q, xrefs: 06F3AF04
$]q, xrefs: 06F3AF33
$]q, xrefs: 06F3AF5C

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: c7c85c5b3d23503c8f3168172af4b5bc6dc52220ff5695cd2831273db512b19e
Instruction ID: 39695378c6b6998d17595104b671dab6a2ce75b81975869c4443bdc1f632e2e5
Opcode Fuzzy Hash: c7c85c5b3d23503c8f3168172af4b5bc6dc52220ff5695cd2831273db512b19e
Instruction Fuzzy Hash: 2A51CF30F112159FCF65DB7AE8806AE77B2EF85210F24896AD886DB340DB35DC42CB91

Function 06F3AD82 Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F3AEB1
$]q, xrefs: 06F3AF04
$]q, xrefs: 06F3AF33
$]q, xrefs: 06F3AF5C

Memory Dump Source

Source File: 00000003.00000002.3280223228.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f30000_Payment Advice Copy-EUR 5500,00 20240419165413-docx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: d8057eb5a30d26062ea2c17fb7fa4baf3983e09862faddb87aa95cc288b29ca7
Instruction ID: 1014b82fc3063740067445c061562800f2710aa2ad306bea12b2bcdde05b24e1
Opcode Fuzzy Hash: d8057eb5a30d26062ea2c17fb7fa4baf3983e09862faddb87aa95cc288b29ca7
Instruction Fuzzy Hash: EE518F70F102159FDF65DB6AE4806AEB3B2EF85311F248929E886DB340DB35DC42CB91

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe

Function 04D99318 Relevance: 51.1, Strings: 39, Instructions: 2326
COMMON

Function 04D99308 Relevance: 51.0, Strings: 39, Instructions: 2241
COMMON

Function 0785C63E Relevance: 5.2, Strings: 4, Instructions: 208
COMMON

Function 0785C239 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Function 04DF6CC8 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Function 04DF7078 Relevance: 2.7, Strings: 2, Instructions: 176
COMMON

Function 07853058 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Function 04DFC500 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Function 078528FC Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Function 078564F0 Relevance: 2.6, Strings: 2, Instructions: 107
COMMON

Function 07856500 Relevance: 2.6, Strings: 2, Instructions: 102
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre