Edit tour

Windows Analysis Report
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Overview

General Information

Sample name:	SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe
Analysis ID:	1446234
MD5:	a878dd0345c3721d93791ab68fcc1faf
SHA1:	4982b21603e872f148b8ff1f9336dbd448d6abb5
SHA256:	8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05
Tags:	exe
Infos:

Detection

MailPassView

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MailPassView

Machine Learning detection for sample

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe (PID: 5320 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe" MD5: A878DD0345C3721D93791AB68FCC1FAF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000000.1536326687.0000000000413000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000002.2791709876.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe PID: 5320	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.0.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
0.2.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

ReversingLabs: Detection: 76%

Machine Learning detection for sample

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:

Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen,

0_2_0040702D

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe, 00000000.00000002.2791480565.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	String found in binary or memory: http://www.nirsoft.net/

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_0040ADA4 GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,

0_2_0040ADA4

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00406073 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,		0_2_00406073
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00405FD0 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,		0_2_00405FD0

System Summary

Malicious sample detected (through community Yara rule)

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe, type: SAMPLE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00404DE5	0_2_00404DE5
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00404E56	0_2_00404E56
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00404EC7	0_2_00404EC7
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00404F58	0_2_00404F58
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_0040BF6B	0_2_0040BF6B

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: String function: 00412084 appears 39 times

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe, type: SAMPLE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.2.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/

Source: classification engine

Classification label: mal80.phis.spyw.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_0040F37C FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_0040F37C

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

File opened: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.cfg

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Jump to behavior

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_CURSOR
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_BITMAP
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_ICON
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_MENU
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_DIALOG
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_STRING
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_ACCELERATOR
Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Static PE information: section name: RT_GROUP_ICON

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_00403C17 LoadLibraryA,GetProcAddress,strcpy,

0_2_00403C17

Source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Static PE information: real checksum: 0x20c22 should be: 0x1c68c

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00412341 push ecx; ret	0_2_00412351
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00412360 push eax; ret	0_2_00412374
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: 0_2_00412360 push eax; ret	0_2_0041239C

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_0040FCBC memset,strcpy,memset,strcpy,strcat,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0040FCBC

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Window / User API: foregroundWindowGot 367

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen,

0_2_0040702D

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_00403C17 LoadLibraryA,GetProcAddress,strcpy,

0_2_00403C17

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_004073B6 memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

0_2_004073B6

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Code function: 0_2_00406282 GetVersionExA,

0_2_00406282

Stealing of Sensitive Information

Yara detected MailPassView

Source: Yara match	File source: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1536326687.0000000000413000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2791709876.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe PID: 5320, type: MEMORYSTR

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword	0_2_00402D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword	0_2_00402D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	Code function: ESMTPPassword	0_2_004033B1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 Credentials in Registry	1 Application Window Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	1 Credentials In Files	1 Account Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	76%	ReversingLabs	Win32.Hacktool.MailPassView
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.nirsoft.net/	0%	Avira URL Cloud	safe
http://www.nirsoft.net	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.nirsoft.net	SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe, 00000000.00000002.2791480565.000000000019B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nirsoft.net/	SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446234
Start date and time:	2024-05-23 01:30:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe
Detection:	MAL
Classification:	mal80.phis.spyw.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.292490303895851
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe
File size:	102'400 bytes
MD5:	a878dd0345c3721d93791ab68fcc1faf
SHA1:	4982b21603e872f148b8ff1f9336dbd448d6abb5
SHA256:	8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05
SHA512:	12900cd5dbf9e3627abc5496e288b8e3c6ef4859c716734382dcc29e819707a46f1b4bc7c569f5d8fff56c6655be0e6930d6926f97f9fa4ec7ccca864876321d
SSDEEP:	1536:dkSw2tYZT/E7mKr1awGUpi2joqDm1WHUZ1Kj4I9eF/6n9w2KQf:dk52tYtEyKB5GUDlDdccMU9w2KQf
TLSH:	2EA36C03B2905472E5EE063179662FB5DAF9BE311A349E0BD7A05D0B3DB06C4EE21397
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Qq..Qq..Qq...~..Cq...R..Rq...R..Zq..Qq..[p...R..Rq..v...vq..v...Pq..v...Pq..RichQq..................PE..L.....oW...........

File Icon


Icon Hash:	231323c2b0bac892

Static PE Info

General

Entrypoint:	0x41211a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x576FA4D7 [Sun Jun 26 09:48:07 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f62295e96de1ceba9dea2c107634303d

Entrypoint Preview

Instruction
push 00000070h
push 004133E0h
call 00007F8FA15A4607h
xor ebx, ebx
push ebx
mov edi, dword ptr [00413068h]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F8FA15A4441h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F8FA15A4434h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F8FA15A4441h
cmp eax, 0000020Bh
je 00007F8FA15A4427h
mov dword ptr [ebp-1Ch], ebx
jmp 00007F8FA15A4449h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F8FA15A4414h
xor eax, eax
cmp dword ptr [ecx+000000F8h], ebx
jmp 00007F8FA15A4430h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F8FA15A4404h
xor eax, eax
cmp dword ptr [ecx+000000E8h], ebx
setne al
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413374h]
pop ecx
or dword ptr [00418B6Ch], FFFFFFFFh
or dword ptr [00418B70h], FFFFFFFFh
call dword ptr [00413370h]
mov ecx, dword ptr [00417B8Ch]
mov dword ptr [eax], ecx
call dword ptr [0041336Ch]
mov ecx, dword ptr [00417B88h]
mov dword ptr [eax], ecx
mov eax, dword ptr [0041333Ch]
mov eax, dword ptr [eax]
mov dword ptr [00418B68h], eax
call 00007F8FA15A455Fh
cmp dword ptr [00417000h], ebx
jne 00007F8FA15A442Eh
push 00412304h
call dword ptr [00413380h]
pop ecx
call 00007F8FA15A4534h

Rich Headers

Programming Language:

[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1562c	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x2ec4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x133c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x398	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11444	0x11600	075a4752015d3334d0e8004026c943e9	False	0.5987100944244604	data	6.423545208891307	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x3896	0x3a00	c7abfcb7a14066602a9e29aaaceb2ab9	False	0.4829606681034483	data	5.677342764808712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x1b74	0xc00	32fceda92d9d037d5e69161d18111910	False	0.3046875	data	2.6959048209292744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19000	0x2ec4	0x3000	bc52b2709d30b43e91549b48a175bc0e	False	0.337158203125	data	4.213718411764263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x196b8	0x134	data	English	United States	0.40584415584415584
RT_BITMAP	0x197ec	0x3e8	Device independent bitmap graphic, 112 x 16 x 4, image size 896	Hebrew	Israel	0.466
RT_BITMAP	0x19bd4	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.4305555555555556
RT_BITMAP	0x19cac	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.42592592592592593
RT_ICON	0x19d84	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Hebrew	Israel	0.38306451612903225
RT_ICON	0x1a06c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Hebrew	Israel	0.5641891891891891
RT_ICON	0x1a194	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Hebrew	Israel	0.3885135135135135
RT_MENU	0x1a2bc	0x38c	data	English	United States	0.42731277533039647
RT_MENU	0x1a648	0x1f2	data	English	United States	0.44377510040160645
RT_DIALOG	0x1a83c	0xa2	data	Hebrew	Israel	0.7592592592592593
RT_DIALOG	0x1a8e0	0x296	data	Hebrew	Israel	0.48942598187311176
RT_DIALOG	0x1ab78	0x364	data	Hebrew	Israel	0.3847926267281106
RT_DIALOG	0x1aedc	0xfa	data	Hebrew	Israel	0.616
RT_DIALOG	0x1afd8	0x336	data	English	United States	0.49635036496350365
RT_STRING	0x1b310	0x1f2	data	English	United States	0.4718875502008032
RT_STRING	0x1b504	0x24	data	English	United States	0.4166666666666667
RT_STRING	0x1b528	0x13a	data	English	United States	0.4745222929936306
RT_STRING	0x1b664	0x3e	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	English	United States	0.6774193548387096
RT_STRING	0x1b6a4	0x48	data	English	United States	0.625
RT_STRING	0x1b6ec	0x134	data	English	United States	0.5584415584415584
RT_STRING	0x1b820	0xa6	data	English	United States	0.5602409638554217
RT_STRING	0x1b8c8	0x74	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	English	United States	0.75
RT_STRING	0x1b93c	0xaa	data	English	United States	0.5470588235294118
RT_STRING	0x1b9e8	0x68	data	English	United States	0.6153846153846154
RT_ACCELERATOR	0x1ba50	0x50	data	Hebrew	Israel	0.825
RT_GROUP_CURSOR	0x1baa0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_ICON	0x1bab4	0x22	data	Hebrew	Israel	1.0294117647058822
RT_GROUP_ICON	0x1bad8	0x14	data	Hebrew	Israel	1.15
RT_VERSION	0x1baec	0x26c	data	Hebrew	Israel	0.5193548387096775
RT_MANIFEST	0x1bd58	0x16a	ASCII text, with CRLF line terminators	English	United States	0.649171270718232

Imports

DLL	Import
msvcrt.dll	memmove, wcschr, wcslen, wcsncmp, _itoa, _strlwr, qsort, strncmp, _snprintf, _mbsrchr, _mbsnbicmp, __dllonexit, _onexit, _c_exit, _exit, _XcptFilter, _cexit, _strnicmp, _acmdln, __getmainargs, _initterm, _memicmp, malloc, strrchr, _stricmp, free, modf, memcmp, strtoul, ??3@YAXPAX@Z, ??2@YAPAXI@Z, memcpy, sprintf, _mbsicmp, atoi, _strcmpi, strlen, strcmp, exit, _adjust_fdiv, wcsstr, log, _mbscmp, strchr, _purecall, strncat, abs, strcat, _ultoa, strcpy, memset, __p__commode, __p__fmode, __set_app_type, _controlfp, _except_handler3, __setusermatherr
COMCTL32.dll	CreateToolbarEx, ImageList_Create, ImageList_AddMasked, ImageList_SetImageCount, ImageList_ReplaceIcon
RPCRT4.dll	UuidFromStringA
KERNEL32.dll	GetCurrentDirectoryA, GetModuleHandleA, SetCurrentDirectoryA, GetCurrentProcess, ExitProcess, GetCurrentProcessId, ReadProcessMemory, OpenProcess, GetStdHandle, GetPrivateProfileIntA, EnumResourceNamesA, WritePrivateProfileStringA, GetComputerNameA, GetFileSize, CreateFileA, GlobalUnlock, GlobalLock, GetTempPathA, GlobalAlloc, CloseHandle, FindResourceA, LoadResource, EnumResourceTypesA, SizeofResource, LockResource, DeleteFileA, GetStartupInfoA, GetPrivateProfileStringA, MultiByteToWideChar, WideCharToMultiByte, ExpandEnvironmentStringsA, LocalFree, WriteFile, GetPrivateProfileSectionA, FreeLibrary, GetProcAddress, LoadLibraryA, GetModuleFileNameA, FindFirstFileA, FindNextFileA, SetFilePointer, GetLastError, LoadLibraryExA, GetFileAttributesA, GetTempFileNameA, FindClose, FormatMessageA, GetWindowsDirectoryA, ReadFile, GetVersionExA
USER32.dll	GetClassNameA, GetMessageA, TranslateMessage, RegisterWindowMessageA, PostQuitMessage, TrackPopupMenu, PostMessageA, GetFocus, DispatchMessageA, DrawTextExA, IsDialogMessageA, GetWindowTextA, GetMenuItemInfoA, EnumChildWindows, DestroyMenu, GetDlgCtrlID, DialogBoxParamA, ShowWindow, SetCursor, LoadCursorA, ChildWindowFromPoint, GetSysColorBrush, EndDialog, GetDlgItem, CreateWindowExA, InvalidateRect, SetDlgItemInt, BeginPaint, GetClientRect, GetWindow, SetDlgItemTextA, DrawFrameControl, GetDlgItemTextA, SendDlgItemMessageA, SetWindowTextA, GetWindowRect, GetSystemMetrics, GetDlgItemInt, DeferWindowPos, EndPaint, DefWindowProcA, TranslateAcceleratorA, MessageBoxA, GetWindowPlacement, RegisterClassA, UpdateWindow, SetMenu, LoadAcceleratorsA, SetWindowPos, SendMessageA, LoadIconA, GetWindowLongA, SetWindowLongA, SetFocus, BeginDeferWindowPos, EndDeferWindowPos, CheckMenuItem, GetMenuItemCount, SetClipboardData, GetMenuStringA, EnableWindow, DestroyWindow, GetCursorPos, LoadImageA, GetSysColor, MapWindowPoints, GetMenu, CloseClipboard, GetParent, OpenClipboard, GetDC, EmptyClipboard, MoveWindow, GetSubMenu, EnableMenuItem, ReleaseDC, LoadMenuA, LoadStringA, CreateDialogParamA, ModifyMenuA
GDI32.dll	GetDeviceCaps, SetTextColor, CreateFontIndirectA, SetBkMode, DeleteObject, GetTextExtentPoint32A, SetBkColor, SelectObject
comdlg32.dll	GetOpenFileNameA, GetSaveFileNameA, FindTextA
ADVAPI32.dll	RegEnumKeyA, RegEnumKeyExA, RegQueryValueExA, RegOpenKeyExA, RegDeleteKeyA, GetUserNameA, RegCloseKey
SHELL32.dll	SHBrowseForFolderA, SHGetPathFromIDListA, SHGetMalloc, ShellExecuteA
ole32.dll	CoInitialize, CoTaskMemFree, CoUninitialize

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Hebrew	Israel

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 01:32:18.235605955 CEST	53	64857	162.159.36.2	192.168.2.9
May 23, 2024 01:32:18.930286884 CEST	53	57889	1.1.1.1	192.168.2.9

Target ID:	0
Start time:	19:31:31
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe"
Imagebase:	0x400000
File size:	102'400 bytes
MD5 hash:	A878DD0345C3721D93791AB68FCC1FAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000000.1536326687.0000000000413000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000002.2791709876.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	1808
Total number of Limit Nodes:	59

Executed Functions

Function 004073B6 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00407418
memset.MSVCRT ref: 0040742C
memset.MSVCRT ref: 00407446
memset.MSVCRT ref: 0040745B
GetComputerNameA.KERNEL32(?,?), ref: 0040747D
GetUserNameA.ADVAPI32(?,?), ref: 00407491
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074B0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074C5
strlen.MSVCRT ref: 004074CE
strlen.MSVCRT ref: 004074DD
memcpy.MSVCRT ref: 004074EF

Strings

}, xrefs: 0040740A
H, xrefs: 0040740E
O, xrefs: 00407402
b, xrefs: 004073E6
i, xrefs: 004073DE
5, xrefs: 004073FA
}, xrefs: 004073FE

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$ByteCharMulusermeWidestrlen$ComputerUsermemcpy
String ID: 5$H$O$b$i$}$}
API String ID: 1832431107-3760989150
Opcode ID: aceb3002e6d76f9fd17eae514da83f7be29cbb3531b765aef18c994d04d9c626
Instruction ID: c4a028c48163d552ebb965a22663fb4caedd15d38ec5c0ca2e6f283cdba292cd
Opcode Fuzzy Hash: aceb3002e6d76f9fd17eae514da83f7be29cbb3531b765aef18c994d04d9c626
Instruction Fuzzy Hash: 7A51E771C0025DAEDB11CFA8CC40BEEBBBCEF49314F0442AAE555E6191D3789B85CB65

Function 00403C17 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 184
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EF05: FreeLibrary.KERNELBASE(?,0040EF39,?,?,?,?,?,?,00404221), ref: 0040EF11

LoadLibraryA.KERNELBASE(pstorec.dll), ref: 00403C36
GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 00403C4B
strcpy.MSVCRT(?,?), ref: 00403E55

Strings

Software\Microsoft\Windows Messaging Subsystem\Profiles, xrefs: 00403D3C
Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00403CD7
www.google.com:443/Please log in to your Gmail account, xrefs: 00403C91
www.google.com/Please log in to your Gmail account, xrefs: 00403C87
pstorec.dll, xrefs: 00403C31
www.google.com/Please log in to your Google Account, xrefs: 00403C9B
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 00403D43
www.google.com:443/Please log in to your Google Account, xrefs: 00403CA5
Software\Microsoft\Office\16.0\Outlook\Profiles, xrefs: 00403DA5
PStoreCreateInstance, xrefs: 00403C45
Software\Microsoft\Office\15.0\Outlook\Profiles, xrefs: 00403D6F
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00403CFC

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProcstrcpy
String ID: PStoreCreateInstance$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\15.0\Outlook\Profiles$Software\Microsoft\Office\16.0\Outlook\Profiles$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows Messaging Subsystem\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$pstorec.dll$www.google.com/Please log in to your Gmail account$www.google.com/Please log in to your Google Account$www.google.com:443/Please log in to your Gmail account$www.google.com:443/Please log in to your Google Account
API String ID: 2884822230-317895162
Opcode ID: edd8b6eb8bcfee5f27bfe3d894378078f305261ef97242b4e9c725312b665777
Instruction ID: c79aa312a60a802310c0dbcdda9968b0b76b201639e98401828b305836cf62c0
Opcode Fuzzy Hash: edd8b6eb8bcfee5f27bfe3d894378078f305261ef97242b4e9c725312b665777
Instruction Fuzzy Hash: BE51C472604601BAD710AF72CC46FDABA6CAF01709F14017FF905B61C2EB7DAB548A99

Function 0040702D Relevance: 6.1, APIs: 4, Instructions: 58filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000103,00000247,?,?,0041134A,*.oeaccount,0041141B,?,00000104), ref: 00407043
FindNextFileA.KERNELBASE(000000FF,00000247,?,?,0041134A,*.oeaccount,0041141B,?,00000104), ref: 00407061
strlen.MSVCRT ref: 00407091
strlen.MSVCRT ref: 00407099

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileFindstrlen$FirstNext
String ID:
API String ID: 379999529-0
Opcode ID: 23327769c2c6ed145b7f0a678d94cded64fbce7ba272a02f3800eca3ff4be886
Instruction ID: ee1fc6f362411e34e0c03f62be7ba86f9bee0943d1b98e177d8d8cef5f5d9398
Opcode Fuzzy Hash: 23327769c2c6ed145b7f0a678d94cded64fbce7ba272a02f3800eca3ff4be886
Instruction Fuzzy Hash: 1E1182728092059FD3149B34D844ADBB7DC9F04325F204A3FF05AD31D0EB38B945876A

Function 0040F37C Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0040F389
SizeofResource.KERNEL32(?,00000000), ref: 0040F39A
LoadResource.KERNEL32(?,00000000), ref: 0040F3AA
LockResource.KERNEL32(00000000), ref: 0040F3B5

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 9cd59cfcab74544fb09ebac2717695010326dcaa36405c725c3e94a77d8c1a91
Instruction ID: 02aaebfec467b3bf7519b160cf801d0b857f87d6ebd9b35fbb0925b6dc32657f
Opcode Fuzzy Hash: 9cd59cfcab74544fb09ebac2717695010326dcaa36405c725c3e94a77d8c1a91
Instruction Fuzzy Hash: B601D6327002156BCB294FA5DC45A9BBFAEFF857A1704803AFC09E72A1DB70C905D6C8

Function 00401E4A Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401E6C

Part of subcall function 0040F4CA: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040F501

strlen.MSVCRT ref: 00401E85
strlen.MSVCRT ref: 00401E93
strlen.MSVCRT ref: 00401ED9
strlen.MSVCRT ref: 00401EE7
memset.MSVCRT ref: 00401F92
atoi.MSVCRT ref: 00401FC1
memset.MSVCRT ref: 00401FE4
sprintf.MSVCRT ref: 00402011

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

memset.MSVCRT ref: 00402067
memset.MSVCRT ref: 0040207C
strlen.MSVCRT ref: 00402082
strlen.MSVCRT ref: 00402090
strlen.MSVCRT ref: 004020C3
strlen.MSVCRT ref: 004020D1
memset.MSVCRT ref: 00401FF9

Part of subcall function 004062B7: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062BF
Part of subcall function 004062B7: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062CE

strcpy.MSVCRT(?,00000000), ref: 00402158
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402162
ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040217D

Part of subcall function 00406155: GetFileAttributesA.KERNELBASE(?,00408328,?,004083DE,00000000,?,00000000,00000104,?), ref: 00406159

Strings

Mozilla\Profiles, xrefs: 00401E7F, 00401E84, 00401EAC
current, xrefs: 00401F20
Install Directory, xrefs: 0040201E
Software\Classes\Software\Qualcomm\Eudora\CommandLine\current, xrefs: 00401F4B
sqlite3.dll, xrefs: 00401FB5, 00402081, 004020A6
nss3.dll, xrefs: 004020BE, 004020E6
%programfiles%\Mozilla Thunderbird, xrefs: 00402178
%s\Main, xrefs: 0040200B
Software\Qualcomm\Eudora\CommandLine, xrefs: 00401F25
Thunderbird\Profiles, xrefs: 00401ECE, 00401EFC
Software\Mozilla\Mozilla Thunderbird, xrefs: 00401F67

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen$memset$Closestrcpy$AttributesEnvironmentExpandFileFolderPathSpecialStringsatoisprintfstrcat
String ID: %programfiles%\Mozilla Thunderbird$%s\Main$Install Directory$Mozilla\Profiles$Software\Classes\Software\Qualcomm\Eudora\CommandLine\current$Software\Mozilla\Mozilla Thunderbird$Software\Qualcomm\Eudora\CommandLine$Thunderbird\Profiles$current$nss3.dll$sqlite3.dll
API String ID: 1212093029-4223776976
Opcode ID: 59627f2f584a0fc03280b870890c3a08f891bace1e47a2458c552be32f244d3b
Instruction ID: 6d070b6b648a05e91db5632b048882ca6db18ac9797f22d42d855398ddad24fb
Opcode Fuzzy Hash: 59627f2f584a0fc03280b870890c3a08f891bace1e47a2458c552be32f244d3b
Instruction Fuzzy Hash: 8B91C772804159AEDB21E6958C45FDB7BAD9F18309F1400BBF608F2182EB789BC58B5D

Function 0040BB8D Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404841: LoadLibraryA.KERNEL32(comctl32.dll,76F90A60,?,00000000,?,?,?,0040BBA9,76F90A60), ref: 00404860
Part of subcall function 00404841: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404872
Part of subcall function 00404841: FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040BBA9,76F90A60), ref: 00404886
Part of subcall function 00404841: MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004048B1

??3@YAXPAX@Z.MSVCRT ref: 0040BDD9
DeleteObject.GDI32(?), ref: 0040BDEF

Strings

/savelangfile, xrefs: 0040BBFF
/deleteregkey, xrefs: 0040BC2D
, xrefs: 0040BBC7
Error, xrefs: 0040BC7A
|EA, xrefs: 0040BDD1
Failed to load the executable file !, xrefs: 0040BC7F
l4A, xrefs: 0040BE00

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$??3@AddressDeleteFreeLoadMessageObjectProc
String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !$l4A$|EA
API String ID: 745651260-3164406189
Opcode ID: 3c00f802ca4795d2e9304cd0230107946e140242e0069c15af536683ec85def6
Instruction ID: 8d811f0c9aed7e5f9a0d70865fafe098279c62815184764300974fb8b6b83255
Opcode Fuzzy Hash: 3c00f802ca4795d2e9304cd0230107946e140242e0069c15af536683ec85def6
Instruction Fuzzy Hash: A8618C71508345ABC720AFA1DC49A9BBBF9FF84705F00483FF545A22A0DB789904CB5E

Function 0040A88E Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 285
windowregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00407D23: LoadMenuA.USER32(00000000), ref: 00407D2B
Part of subcall function 00407D23: sprintf.MSVCRT ref: 00407D4E

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0040A9C1
#6.COMCTL32(50000000,0041344F,?,00000101), ref: 0040A9DC
SendMessageA.USER32(00000000,00000404,00000001,?), ref: 0040A9F4
LoadImageA.USER32(00000068,00000000,00000000,00000000,00009060), ref: 0040AA0A
CreateToolbarEx.COMCTL32(?,50010900,00000102,00000007,00000000,00000000,?,00000008,00000010,00000010,00000070,00000010,00000014), ref: 0040AA34
CreateWindowExA.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000), ref: 0040AA6A
LoadIconA.USER32(00000066,00000000), ref: 0040AAD9
ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 0040AAE7
_stricmp.MSVCRT(0041344F,/noloadsettings), ref: 0040AB31
RegDeleteKeyA.ADVAPI32(80000001,0041344F), ref: 0040AB46
SetFocus.USER32(?,00000000), ref: 0040AB6C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\), ref: 0040AB85
GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\), ref: 0040AB95
strlen.MSVCRT ref: 0040AB9C
strlen.MSVCRT ref: 0040ABAA
RegisterWindowMessageA.USER32(commdlg_FindReplace,?,00000001), ref: 0040AC06

Part of subcall function 0040492F: strlen.MSVCRT ref: 0040494C
Part of subcall function 0040492F: SendMessageA.USER32(00000000,0000101B,00000000,?), ref: 00404970

SendMessageA.USER32(?,00000404,00000002,?), ref: 0040AC51
SendMessageA.USER32(?,00000401,00001001,00000000), ref: 0040AC64

Strings

O4A, xrefs: 0040AB26
/noloadsettings, xrefs: 0040AB2B
commdlg_FindReplace, xrefs: 0040AC01
C:\Users\user\AppData\Local\Temp\, xrefs: 0040AB72, 0040AB78, 0040AB84, 0040AB8F, 0040AB9B, 0040ABC0
SysListView32, xrefs: 0040AA64
report.html, xrefs: 0040ABA3, 0040ABBB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$Send$Loadstrlen$CreateIconImageWindow$AttributesCallbackDeleteDispatcherFileFocusList_MenuPathRegisterReplaceTempToolbarUser_stricmpsprintf
String ID: /noloadsettings$C:\Users\user\AppData\Local\Temp\$O4A$SysListView32$commdlg_FindReplace$report.html
API String ID: 2016272751-3164717526
Opcode ID: b76aa5e4e0e99f284af308c1536f566fb802b9c2352f130d75eff2927cf6ca50
Instruction ID: e1998a72efec4b56c1f9895f5ce6fdd1159dce7011e853ef75bd655fd4d55b37
Opcode Fuzzy Hash: b76aa5e4e0e99f284af308c1536f566fb802b9c2352f130d75eff2927cf6ca50
Instruction Fuzzy Hash: DBB10071644388EFEB16CF74C845BDABFB5BF14304F00406AF644A7292C7B9A954CB5A

Function 0040A02E Relevance: 25.6, APIs: 17, Instructions: 108
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040A05B
ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 0040A066
SendMessageA.USER32(?,00001003,00000001,?), ref: 0040A07B
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040A090
ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 0040A09B
SendMessageA.USER32(?,00001003,00000000,?), ref: 0040A0B0
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040A0BC
ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 0040A0C7
LoadImageA.USER32(00000085,00000000,00000010,00000010,00001000), ref: 0040A0E5
LoadImageA.USER32(00000086,00000000,00000010,00000010,00001000), ref: 0040A101
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040A10D
GetSysColor.USER32(0000000F), ref: 0040A111
ImageList_AddMasked.COMCTL32(?,?,00000000), ref: 0040A12C
ImageList_AddMasked.COMCTL32(?,00000000,?), ref: 0040A139
DeleteObject.GDI32(?), ref: 0040A145
DeleteObject.GDI32(00000000), ref: 0040A148
SendMessageA.USER32(00000000,00001208,00000000,?), ref: 0040A166

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Image$List_$Count$CreateMessageSend$DeleteLoadMaskedObject$Color
String ID:
API String ID: 3411798969-0
Opcode ID: 1bd64ef7cf6ebfbe1216c8ae3712fe611673920fae5758317d27ef3baf5e7dda
Instruction ID: 418605dbbba7a2bdca51e359c3d30d4779c94778b6a4b101a6c03afd9e8c1dd7
Opcode Fuzzy Hash: 1bd64ef7cf6ebfbe1216c8ae3712fe611673920fae5758317d27ef3baf5e7dda
Instruction Fuzzy Hash: F13121716803087EFA316B709C47FD6BB95EB48B05F104829F3956A1E1CAF279909B18

Function 0040E057 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 101
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?,?,?,?,?,00403E80,?), ref: 0040E088
RegOpenKeyExA.KERNELBASE(?,Dynamic Salt,00000000,00020019,?,?,?,?,?,00403E80,?), ref: 0040E0A2
RegQueryValueExA.ADVAPI32(?,Value,00000000,?,?,?,?,?,?,?,00403E80,?), ref: 0040E0CD
RegCloseKey.ADVAPI32(?,?,?,?,?,00403E80,?), ref: 0040E17E

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

memcpy.MSVCRT ref: 0040E13B
memcpy.MSVCRT ref: 0040E150

Part of subcall function 0040DD59: RegOpenKeyExA.ADVAPI32(p@,Creds,00000000,00020019,p@,%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd,00000040,?,?,0040E170,?,?,?,?), ref: 0040DD83
Part of subcall function 0040DD59: memset.MSVCRT ref: 0040DDA1
Part of subcall function 0040DD59: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040DEA5
Part of subcall function 0040DD59: RegCloseKey.ADVAPI32(?), ref: 0040DEB6

LocalFree.KERNEL32(?,?,00001000,?,?,?,?,?,00403E80,?), ref: 0040E174
RegCloseKey.KERNELBASE(?,?,?,?,?,00403E80,?), ref: 0040E188

Strings

Dynamic Salt, xrefs: 0040E099
%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd, xrefs: 0040E112, 0040E139
Value, xrefs: 0040E0BC
Software\Microsoft\IdentityCRL, xrefs: 0040E07E

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Dynamic Salt$Software\Microsoft\IdentityCRL$Value
API String ID: 2768085393-1693574875
Opcode ID: 7df82dd4f7763ce5193550669c390a20838b5133b5989fa9b4096a2fc0febe08
Instruction ID: a1b69f5673053fc040be98c60ebfc88e8990dfc0172556f981ec686efddd513d
Opcode Fuzzy Hash: 7df82dd4f7763ce5193550669c390a20838b5133b5989fa9b4096a2fc0febe08
Instruction Fuzzy Hash: 99313CB2504305AFD700DF51DC40E9BBBECEF88798F00493AFA94E2160D775DA598B6A

Function 0040B656 Relevance: 18.1, APIs: 12, Instructions: 142
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetBkMode.GDI32(?,00000001), ref: 0040B6CF
SetTextColor.GDI32(?,00FF0000), ref: 0040B6DD
SelectObject.GDI32(?,?), ref: 0040B6F2
DrawTextExA.USER32(?,?,000000FF,?,00000004,?), ref: 0040B727
SelectObject.GDI32(00000014,?), ref: 0040B733

Part of subcall function 0040B48C: GetCursorPos.USER32(?), ref: 0040B499
Part of subcall function 0040B48C: GetSubMenu.USER32(?,00000000), ref: 0040B4A7
Part of subcall function 0040B48C: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0040B4D4

LoadCursorA.USER32(00000067), ref: 0040B754
SetCursor.USER32(00000000), ref: 0040B75B
PostMessageA.USER32(?,0000041C,00000000,00000000), ref: 0040B77D
SetFocus.USER32(?), ref: 0040B7B8
SetFocus.USER32(?), ref: 0040B831

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Cursor$FocusMenuObjectSelectText$ColorDrawLoadMessageModePopupPostTrack
String ID:
API String ID: 1416211542-0
Opcode ID: 3778869b55221fcc12fd94bbd8486a161371f0d47134fd12c30968efd1e1df11
Instruction ID: bf574778d17b78baaeffb7f566a8ea64d240ccb0deb227a445330b453fade6b9
Opcode Fuzzy Hash: 3778869b55221fcc12fd94bbd8486a161371f0d47134fd12c30968efd1e1df11
Instruction Fuzzy Hash: 4A519271100605EFCB15EF69CC88AEA7BA5FF44301F10443AF615AB2A1CB38AD51DB9D

Function 0041211A Relevance: 18.1, APIs: 12, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,004133E0,00000070), ref: 0041212F
__set_app_type.MSVCRT ref: 00412188
__p__fmode.MSVCRT ref: 0041219D
__p__commode.MSVCRT ref: 004121AB
__setusermatherr.MSVCRT ref: 004121D7
_initterm.MSVCRT ref: 004121ED
__getmainargs.MSVCRT ref: 00412210
_initterm.MSVCRT ref: 00412223
GetStartupInfoA.KERNEL32(?), ref: 00412262
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00412286
exit.MSVCRT ref: 00412299
_cexit.MSVCRT ref: 0041229F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 3662548030-0
Opcode ID: 0cd59659463b3ba6b54fd34f3b5747a647caaa08127f994ca48f4bf1f9d9109b
Instruction ID: c2e845550ef1ad64eb6aea8f75856b2ed0c0391cefdfa0dcc66b3553e8bd0076
Opcode Fuzzy Hash: 0cd59659463b3ba6b54fd34f3b5747a647caaa08127f994ca48f4bf1f9d9109b
Instruction Fuzzy Hash: 46419070D04249EFCB209FA4D9496ED7BB4EB09315F2081BBE861D7291D7B859D2CB1C

Function 004113C4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004113E5

Part of subcall function 0040F4CA: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040F501

Part of subcall function 00406763: strlen.MSVCRT ref: 00406765
Part of subcall function 00406763: strlen.MSVCRT ref: 00406770
Part of subcall function 00406763: strcat.MSVCRT(00000000,0041140D,0000001C,0041140D,\Microsoft\Windows Mail,?,?,?), ref: 00406787

Part of subcall function 0040F4CA: memset.MSVCRT ref: 0040F51F
Part of subcall function 0040F4CA: RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000104), ref: 0040F588
Part of subcall function 0040F4CA: strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040F596

memset.MSVCRT ref: 00411453
memset.MSVCRT ref: 0041146E

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?), ref: 004114A7
strlen.MSVCRT ref: 004114B5
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?,?), ref: 004114DB

Strings

\Microsoft\Windows Mail, xrefs: 00411403
Store Root, xrefs: 0041147F
\Microsoft\Windows Live Mail, xrefs: 0041142A
Software\Microsoft\Windows Live Mail, xrefs: 00411484

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$strlen$Close$EnvironmentExpandFolderPathSpecialStrings_stricmpstrcatstrcpy
String ID: Software\Microsoft\Windows Live Mail$Store Root$\Microsoft\Windows Live Mail$\Microsoft\Windows Mail
API String ID: 4292528749-2578778931
Opcode ID: b40a09ed6084c6be5fd3c209054c2b05923c65405b3fd14be26e8a18b8bd9bbc
Instruction ID: e9664ad0f3b84b924b74ee59ba002f7e9f43dcf230935329a4dad2143823624c
Opcode Fuzzy Hash: b40a09ed6084c6be5fd3c209054c2b05923c65405b3fd14be26e8a18b8bd9bbc
Instruction Fuzzy Hash: 45317772504348ABD320EBA9DD46FCB7BDC9B88714F00442FF649D7182EA78D55487AA

Function 0040B91E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B945
??2@YAPAXI@Z.MSVCRT ref: 0040B963
DeleteObject.GDI32(?), ref: 0040B9A1
memset.MSVCRT ref: 0040B9DD
LoadIconA.USER32(00000065), ref: 0040B9ED
strcpy.MSVCRT(?,00000000,?,00000000), ref: 0040BA0B

Strings

xDA, xrefs: 0040B9F9

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$DeleteIconLoadObjectmemsetstrcpy
String ID: xDA
API String ID: 3205015851-812456957
Opcode ID: ad96368dabae8c74e1e24747d7fbaeb21c173cde6fa866393d14417aa5932aab
Instruction ID: 1611dc68708d9a603d76385fea93fddb5fcd3a07b13b65f331774950c43fbb3a
Opcode Fuzzy Hash: ad96368dabae8c74e1e24747d7fbaeb21c173cde6fa866393d14417aa5932aab
Instruction Fuzzy Hash: 9C2192F19002509BCB50EF758E897C97BA8AB44705F1444BBEE0CEF296D7B845818BAD

Function 0040378B Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 86
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004037AC
memset.MSVCRT ref: 004037C0

Part of subcall function 00411622: memset.MSVCRT ref: 00411644
Part of subcall function 00411622: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,000003FF), ref: 004116B0

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

strchr.MSVCRT ref: 0040382F
strcpy.MSVCRT(?,?,?,?,?), ref: 0040384C
strlen.MSVCRT ref: 00403858
sprintf.MSVCRT ref: 00403878
strcpy.MSVCRT(?,?,?,?,?), ref: 0040388E

Strings

%s@yahoo.com, xrefs: 00403872

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$strcpystrlen$Closememcpysprintfstrchr
String ID: %s@yahoo.com
API String ID: 1649821605-3288273942
Opcode ID: 28c71e32e2af50959a8f735d191157fb7031000e76f71a7bd421d4c80fd3058b
Instruction ID: fac56a1422f5c84d721e9c9d17906f33e473bda0e694fa5a8ecc328811f6b8f6
Opcode Fuzzy Hash: 28c71e32e2af50959a8f735d191157fb7031000e76f71a7bd421d4c80fd3058b
Instruction Fuzzy Hash: 952186B3D0012C6EDB21EA54DD41BDA77AC9F45348F0401EBF649F6181E6B8AF848F69

Function 0040A7B2 Relevance: 12.1, APIs: 8, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 0040A7D1
GetWindowRect.USER32(?,?), ref: 0040A7E7
GetWindowRect.USER32(?,?), ref: 0040A7FA
BeginDeferWindowPos.USER32(00000003), ref: 0040A817
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040A834
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040A854
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 0040A87B
KiUserCallbackDispatcher.NTDLL(?), ref: 0040A884

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$Defer$Rect$BeginCallbackClientDispatcherUser
String ID:
API String ID: 466569379-0
Opcode ID: e3d9293826481cef379b2e174ab533f7da62d5a41b3e9301ba56b14c5600b15e
Instruction ID: 09cbeee5e8014f0efd252c30326660bc7ddd54a992e069e65e32613af5811a3b
Opcode Fuzzy Hash: e3d9293826481cef379b2e174ab533f7da62d5a41b3e9301ba56b14c5600b15e
Instruction Fuzzy Hash: AF21C871A00209FFDB11DFA8DD89FEEBBB9FB08311F104465FA55A2160CA71AA519B24

Function 0040B84C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040B86E
memset.MSVCRT ref: 0040B882
RegisterClassA.USER32(?), ref: 0040B8C5

Part of subcall function 004019DA: strncat.MSVCRT ref: 004019FA

CreateWindowExA.USER32(00000000,00000000,00000000,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,?), ref: 0040B908

Strings

xDA, xrefs: 0040B8FC
P4A, xrefs: 0040B8EB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$ClassCreateRegisterWindowstrncat
String ID: P4A$xDA
API String ID: 3664037073-2763913229
Opcode ID: be5346cb48c8cedca28fb9c953b908c4a3ca165af802d2e293ff076a17b9cc61
Instruction ID: a433a9f07fbe34a5cd63bc5fe357f5218a2175739f92369553503b68093de8d1
Opcode Fuzzy Hash: be5346cb48c8cedca28fb9c953b908c4a3ca165af802d2e293ff076a17b9cc61
Instruction Fuzzy Hash: F1211FB5C01218AFDB50DF95DD85ADFBBBCEB08354F0040BAE549B3251C778AE848BA4

Function 004034A5 Relevance: 10.5, APIs: 4, Strings: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004034C5
memset.MSVCRT ref: 004034DB

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

strcpy.MSVCRT(00000000,00000000), ref: 00403516

Part of subcall function 00405F29: strlen.MSVCRT ref: 00405F2A
Part of subcall function 00405F29: strcat.MSVCRT(00000000,00414078,004062C9,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 00405F41

strcat.MSVCRT(00000000,fb.dat,00000000,00000000), ref: 0040352E

Strings

Software\Group Mail, xrefs: 004034F1
InstallPath, xrefs: 004034EC
fb.dat, xrefs: 00403528

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memsetstrcat$Closestrcpystrlen
String ID: InstallPath$Software\Group Mail$fb.dat
API String ID: 1387626053-966475738
Opcode ID: 38ec8536de8e14aff3b9b3d106331788fa2226ffb78b3e274a34b9b5a513c2d5
Instruction ID: 36ed55b5d374e154850240320204e9d1b3c473ccad1168af83c786b56a3c059d
Opcode Fuzzy Hash: 38ec8536de8e14aff3b9b3d106331788fa2226ffb78b3e274a34b9b5a513c2d5
Instruction Fuzzy Hash: 8201D8B294012879D720E655DD46FCA7A6C5F34745F0000E6BA48F21C2DAFCABD58B69

Function 004076B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004073B6: memset.MSVCRT ref: 00407418
Part of subcall function 004073B6: memset.MSVCRT ref: 0040742C
Part of subcall function 004073B6: memset.MSVCRT ref: 00407446
Part of subcall function 004073B6: memset.MSVCRT ref: 0040745B
Part of subcall function 004073B6: GetComputerNameA.KERNEL32(?,?), ref: 0040747D
Part of subcall function 004073B6: GetUserNameA.ADVAPI32(?,?), ref: 00407491
Part of subcall function 004073B6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074B0
Part of subcall function 004073B6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074C5
Part of subcall function 004073B6: strlen.MSVCRT ref: 004074CE
Part of subcall function 004073B6: strlen.MSVCRT ref: 004074DD
Part of subcall function 004073B6: memcpy.MSVCRT ref: 004074EF

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00407705

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

memset.MSVCRT ref: 00407756
RegCloseKey.ADVAPI32(?,?,?), ref: 00407794
RegCloseKey.ADVAPI32(?), ref: 004077BB

Strings

Software\Google\Google Talk\Accounts, xrefs: 004076D6

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$ByteCharCloseMulusermeWidestrlen$ComputerEnumOpenUsermemcpy
String ID: Software\Google\Google Talk\Accounts
API String ID: 2959138223-1079885057
Opcode ID: c9cce60634fc59fb7108b3190625f52d3406a5535f91f01c2962c8a28a0ab0b7
Instruction ID: a99152f29cb3baba476c483fa4670b136c65b11177ef5495e630776d68c42b47
Opcode Fuzzy Hash: c9cce60634fc59fb7108b3190625f52d3406a5535f91f01c2962c8a28a0ab0b7
Instruction Fuzzy Hash: 93219471408209BED610DE51DD42EABBBECEF84344F00043AB944D1192E635DD5D9BA7

Function 0040F4CA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F41D: LoadLibraryA.KERNEL32(shell32.dll,0040BBB8,76F90A60,?,00000000), ref: 0040F42B
Part of subcall function 0040F41D: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040F440

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040F501
memset.MSVCRT ref: 0040F51F
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000104), ref: 0040F588
strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040F596

Part of subcall function 00406282: GetVersionExA.KERNEL32(00418118,0000001A,0040F4E8,00000104), ref: 0040629C

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040F53A, 0040F54A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersionmemsetstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 1359237156-2036018995
Opcode ID: 688813e34a40ff9dac7194856c9665e444ed430276b4d0f07d4d5b497ec3e936
Instruction ID: 8c400c1df07908664f594f880775229253182a5e7b911f92c7f22337ad7f8634
Opcode Fuzzy Hash: 688813e34a40ff9dac7194856c9665e444ed430276b4d0f07d4d5b497ec3e936
Instruction Fuzzy Hash: 34119971801114BADB30AA989C899DF77AC9715308F5400BBFD51B2593D6385F9C8A99

Function 0040A632 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 0040A64F

Part of subcall function 00405E36: LoadCursorA.USER32(00000000,00007F02), ref: 00405E3D
Part of subcall function 00405E36: SetCursor.USER32(00000000,?,0040BCA6), ref: 00405E44

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 0040A672

Part of subcall function 0040A5A1: sprintf.MSVCRT ref: 0040A5C7
Part of subcall function 0040A5A1: sprintf.MSVCRT ref: 0040A5F1
Part of subcall function 0040A5A1: strcat.MSVCRT(?,?,?,00000000,00000000), ref: 0040A604
Part of subcall function 0040A5A1: SendMessageA.USER32(?,00000401,00000000,?), ref: 0040A62A

SetCursor.USER32(?,?,0040B7F8), ref: 0040A697
SetFocus.USER32(?,?,?,0040B7F8), ref: 0040A6A9
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0040A6C0

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSend$Cursor$sprintf$FocusLoadstrcat
String ID:
API String ID: 2210206837-0
Opcode ID: c4500f01a9179d05fffa9e4a2d537714384da649f00e33917d281301b44e2473
Instruction ID: 509cc9229267159212bead5259dcc336d8983f4e7fdf05ffa4c6fe4d4677fdd3
Opcode Fuzzy Hash: c4500f01a9179d05fffa9e4a2d537714384da649f00e33917d281301b44e2473
Instruction Fuzzy Hash: C601E9B1244604EFD326AB75CD89FA6B7E9FF48305F0544B9F15D9B271CA716E018B10

Function 00403946 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\MSNMessenger,00000000,00020019,?), ref: 0040399F

Part of subcall function 0040DC39: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040DD05
Part of subcall function 0040DC39: strlen.MSVCRT ref: 0040DD15
Part of subcall function 0040DC39: strcpy.MSVCRT(?,?), ref: 0040DD26
Part of subcall function 0040DC39: LocalFree.KERNEL32(?), ref: 0040DD33

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\MessengerService,00000000,00020019,?), ref: 004039D1

Strings

Software\Microsoft\MSNMessenger, xrefs: 00403999
Software\Microsoft\MessengerService, xrefs: 004039CB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Openstrcpy$ByteCharFreeLocalMultiWidestrlen
String ID: Software\Microsoft\MSNMessenger$Software\Microsoft\MessengerService
API String ID: 1910562259-1741179510
Opcode ID: cd4cad58a6bbdb2152182e06e1211f683bfeac5af0318659dfdfa5e05705f839
Instruction ID: a8690c8f59c2d6ddd84299c782105f2e65a9bc437c951c5f77a69b85a32d1474
Opcode Fuzzy Hash: cd4cad58a6bbdb2152182e06e1211f683bfeac5af0318659dfdfa5e05705f839
Instruction Fuzzy Hash: 1111D8B1108309AED320EE5198818ABBFEC9B95355F50843FF544A2081D3789A4DCAAB

Function 0040F0E3 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F10B

Part of subcall function 00406792: sprintf.MSVCRT ref: 004067CA
Part of subcall function 00406792: memcpy.MSVCRT ref: 004067DD

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 0040F12F
memset.MSVCRT ref: 0040F146
GetPrivateProfileStringA.KERNEL32(?,?,0041344F,?,00002000,?), ref: 0040F164

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PrivateProfileStringmemset$Writememcpysprintf
String ID:
API String ID: 3143880245-0
Opcode ID: 0d5fc167f86d686615e01c1cacfdddd6df1b8ca8c3ebe4bad4095cdeb2aac3fe
Instruction ID: bc019f7bd72990c6dd937b38e23e5507a0673011dafb680486f8cad4f2b6b185
Opcode Fuzzy Hash: 0d5fc167f86d686615e01c1cacfdddd6df1b8ca8c3ebe4bad4095cdeb2aac3fe
Instruction Fuzzy Hash: DF01657240421DAFEF16AF50DD89EDB7B79EF04344F104076B609A1052D6359A64DB68

Function 004079E7 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00407A0F
??2@YAPAXI@Z.MSVCRT ref: 00407A2D
??2@YAPAXI@Z.MSVCRT ref: 00407A4B
??2@YAPAXI@Z.MSVCRT ref: 00407A5B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 5da1b589d0a8832eef683b15a6d122c0a6d1a7040e709ba4429a645e3444abce
Instruction ID: c43431202d49818a45d5cc7318ffcbdb911bff3577ce92db202b1535657ef0fb
Opcode Fuzzy Hash: 5da1b589d0a8832eef683b15a6d122c0a6d1a7040e709ba4429a645e3444abce
Instruction Fuzzy Hash: C2F0FFB1542210AEDB94DB34EE467953AE6E708354F10813EE60ACA2B1FFB85440CB0C

Function 00406104 Relevance: 3.8, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00406120
memcpy.MSVCRT ref: 00406138
free.MSVCRT(00000000,00000000,76F90A60,00406B78,00000001,?,00000000,76F90A60,00406EF2,00000000,?,?), ref: 00406141

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 2c99a99ae30e83ce40482d8e5bccf8072ec36ae410a4a270b365b928ce6b5d38
Instruction ID: 359978e28c917f6ac826eaac10a3cae38cc8b637956f46d5a6e637dfc07492fc
Opcode Fuzzy Hash: 2c99a99ae30e83ce40482d8e5bccf8072ec36ae410a4a270b365b928ce6b5d38
Instruction Fuzzy Hash: DFF089726052229FC708AF76A98145BB79DAF48354712487FF505E7282DB38DCA0C7A4

Function 0040625C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 0040619B: memset.MSVCRT ref: 004061A5
Part of subcall function 0040619B: strcpy.MSVCRT(?,00000000,?,00000000,0000003C,00000000,?,00406273,Arial,0000000E,00000000), ref: 004061E5

CreateFontIndirectA.GDI32(?), ref: 0040627A

Strings

Arial, xrefs: 00406266

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateFontIndirectmemsetstrcpy
String ID: Arial
API String ID: 3275230829-493054409
Opcode ID: 4817efd26ad33d4b637fc7e29178505d6c073bef41158034ee275bb9fa043b80
Instruction ID: 6f23277ce9f10cc220d5cb12b38cfb89722835dabc034d80cc056b5664af2580
Opcode Fuzzy Hash: 4817efd26ad33d4b637fc7e29178505d6c073bef41158034ee275bb9fa043b80
Instruction Fuzzy Hash: 8FD01270D4020D77E610FBA0FC07FC97BAC5B00B05F504431B901F50E6FAE8E2598699

Function 0040A175 Relevance: 3.0, APIs: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001037,00000000,00000000), ref: 0040A190
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 0040A1AA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: dd3c990b6f06f7b2c2dc03ff0729752becd90f53d511295c87def889df5af8d9
Instruction ID: e11a758ee00da1144c6059c362540eea0e8ddd3b96c7f8f8d0d1d8718a4c60ba
Opcode Fuzzy Hash: dd3c990b6f06f7b2c2dc03ff0729752becd90f53d511295c87def889df5af8d9
Instruction Fuzzy Hash: E2E08C727803107AF2208A845C82FB6A29C9BA5B96F14443BB310AA0D086FC6D1597A9

Function 0040492F Relevance: 3.0, APIs: 2, Instructions: 26stringwindowCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0040494C
SendMessageA.USER32(00000000,0000101B,00000000,?), ref: 00404970

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSendstrlen
String ID:
API String ID: 2816241398-0
Opcode ID: cb208c766c1001eb7ba4300ff83e866a755fc887a556a9000c54e44cd27ded0d
Instruction ID: 9d3c5f83707486ce63b794c921ddeab77c6af5fa5737131b185e384af3409ada
Opcode Fuzzy Hash: cb208c766c1001eb7ba4300ff83e866a755fc887a556a9000c54e44cd27ded0d
Instruction Fuzzy Hash: 51F0FEB1D0420EAFDF04DF95D9457EEBBB8BB08315F108429E914B2281D7788641CFA4

Function 004047AA Relevance: 3.0, APIs: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004047FB: FreeLibrary.KERNELBASE(?,?), ref: 00404810

LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: 79a2d912799eded2ecd004947e833272afd2c53e23871a46eb3e118a9608fd27
Instruction ID: a05247dfa83e1e5897bdf1ebfda0bf15c3173a66790072ff667e3a7d903ceddc
Opcode Fuzzy Hash: 79a2d912799eded2ecd004947e833272afd2c53e23871a46eb3e118a9608fd27
Instruction Fuzzy Hash: C6F0E5B46007038BD720DF39D849797B7E8AF45701F00853EF166E3185E778A641C758

Function 0040174E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: d4079c97fea363649fd402a4fcc1020c1411aa7f5a7ac2feb31ee8da9293c8e4
Instruction ID: 98d015050fab8b107beb11645b231ec9ddeee47dde9a658ed6f4cbb8f47cff71
Opcode Fuzzy Hash: d4079c97fea363649fd402a4fcc1020c1411aa7f5a7ac2feb31ee8da9293c8e4
Instruction Fuzzy Hash: E1117C31900609EFCF11AF90C804AEE3BB1FF08320F10C16AF8156B2A0C7799A51DF69

Function 0040F17F Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 0040F1A6

Part of subcall function 0040F097: memset.MSVCRT ref: 0040F0B5
Part of subcall function 0040F097: _itoa.MSVCRT ref: 0040F0CC
Part of subcall function 0040F097: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 0040F0DB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PrivateProfile$StringWrite_itoamemset
String ID:
API String ID: 4165544737-0
Opcode ID: 60443182dfafd2705f0bd8163bf991a75ed65358abc62ac36d7f3c586c4344a1
Instruction ID: ef80bc42b69c7626de0f5e8b39bb4bd6d74a87ec05759e80c101291bc1ad5009
Opcode Fuzzy Hash: 60443182dfafd2705f0bd8163bf991a75ed65358abc62ac36d7f3c586c4344a1
Instruction Fuzzy Hash: 22E0B632004209FBCF125F90EC01AA93FA6FF04315F148479F95C14961E33295B4AB84

Function 004017BD Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004017CB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b09b4f46af4af4ec09f127408c7b8750a63144aa3ee2ed7c4ad6510036d3ab84
Instruction ID: ac6048c5c4f70b5451fe2278e29ff5f30c102ff2b03874ea15ff7294586fe6d8
Opcode Fuzzy Hash: b09b4f46af4af4ec09f127408c7b8750a63144aa3ee2ed7c4ad6510036d3ab84
Instruction Fuzzy Hash: 99E08C31E04108DBCF10ABA189465DE77B2AB04325F10C1A6E961772E1C3781E41CF69

Function 004047FB Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?), ref: 00404810

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9daaca44af3c137c04138a24eb8ff8cf64b72ee1785e34895ec44d417b16343b
Instruction ID: a9857fde68bfdf8991c7705c8330266d98638ef7b5ff2aef664b3e01c595234a
Opcode Fuzzy Hash: 9daaca44af3c137c04138a24eb8ff8cf64b72ee1785e34895ec44d417b16343b
Instruction Fuzzy Hash: 54D012B61003118FDB209F14EC0CBE133ECAF40312F15C4B9E951A7156C3349540CA58

Function 0040F402 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesA.KERNEL32(?,?,0040F37C,00000000), ref: 0040F411

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 37d1da76d95b5e126e15f716cf118d031e4b8f34fe6c8a3d6132a8d2fb8fd21e
Instruction ID: fad5876d7f8aa1560905c766ba53a11d3010bfcf0403834e812c2ac38a9eeaed
Opcode Fuzzy Hash: 37d1da76d95b5e126e15f716cf118d031e4b8f34fe6c8a3d6132a8d2fb8fd21e
Instruction Fuzzy Hash: 88C09B31594341D7C711DF208C05F1BFEE5BB5C702F108C3D7151D40E4C77180189615

Function 004070C5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,00406FDF,?,?,00000000,?,00411327,*.oeaccount,0041141B,?,00000104), ref: 004070CF

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 1626034a8a252c87a5f1d6eb16cf0afdbdd25481107d0dfa13c5d9d9acae7190
Instruction ID: fb6f9d5761a39194e530e87d941626cbb459cc8d01e30c2ad93bf7984ca40ca8
Opcode Fuzzy Hash: 1626034a8a252c87a5f1d6eb16cf0afdbdd25481107d0dfa13c5d9d9acae7190
Instruction Fuzzy Hash: 77C09230510A01ABD23C5F389C5A46A7BA0AF593323B48F6CE0F3D24F0E73899868A04

Function 0040EF05 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,0040EF39,?,?,?,?,?,?,00404221), ref: 0040EF11

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2e074f5d4832a7d58a2bd7b26742b92faf01e6cbf369b165caea939fd76fa933
Instruction ID: 3414d520a0ca87f174e03c7aae78275fe345844bef97b548c291c08909f1245b
Opcode Fuzzy Hash: 2e074f5d4832a7d58a2bd7b26742b92faf01e6cbf369b165caea939fd76fa933
Instruction Fuzzy Hash: 62C04C31210702DBEB218B12C849753B7E8AB40317F40CC68945695494D77DE454CE18

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00408328,?,004083DE,00000000,?,00000000,00000104,?), ref: 00406159

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 926f1fff4bfe7087d2453ca09093eb98846d62159ddff5e69568d7a31b1a8361
Instruction ID: f305466360af1034a225c08a34d2ddc6697937c487c9f6746c0aa1a011dcbbf5
Opcode Fuzzy Hash: 926f1fff4bfe7087d2453ca09093eb98846d62159ddff5e69568d7a31b1a8361
Instruction Fuzzy Hash: CCB012753100005BCB080B349C4A0CD35506F446327204B3CB033C00F0D720CE60BA00

Function 0040F1B0 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0defe296c07798555785544969a09239eaeede922113c6288443005d002a046f
Instruction ID: 6c28280414aaf847a098fae787e0885161fd0282473b9be1e1f1fd42ed515737
Opcode Fuzzy Hash: 0defe296c07798555785544969a09239eaeede922113c6288443005d002a046f
Instruction Fuzzy Hash: 41C09B35544301FFDE118F40ED05F09BFA1AB88B05F008414B244240B1C2718414EB17

Function 00401808 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?,004019D4,?,?,?), ref: 0040181A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 41d0657a6ca65bec123c94d32be3811cc646216fbedcb2d1f0efeb7b09bfaf38
Instruction ID: fb3ddee3b07d71e7bca7acd0b5fe8f04ac65e6ee1acd5581bfa893650ac4d969
Opcode Fuzzy Hash: 41d0657a6ca65bec123c94d32be3811cc646216fbedcb2d1f0efeb7b09bfaf38
Instruction Fuzzy Hash: 5CC00C76508100FFCE425F50DD04D4ABB66AB95315F15C469F19944135C7738561EB15

Function 0040AEB7 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,00000415,00000000,00000000), ref: 0040AEC6

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 60ea05e37354249f88e66d0bcdee44a25c2cc333a442d33a2d3445e2a47da255
Instruction ID: ea89e85155476ffbf5940f574962b467ecbbbfdc4f529f07fe84d42430be8e09
Opcode Fuzzy Hash: 60ea05e37354249f88e66d0bcdee44a25c2cc333a442d33a2d3445e2a47da255
Instruction Fuzzy Hash: 11B002B07C4704BAED515F559D0EFD575515750B05F1540B073457D0F19ED11591950C

Non-executed Functions

Function 0040FCBC Relevance: 61.4, APIs: 22, Strings: 13, Instructions: 143libraryloaderstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FCE5
strcpy.MSVCRT(?,?,?,?,00000000), ref: 0040FCFC
memset.MSVCRT ref: 0040FD29
strcpy.MSVCRT(?,?,?,00000000,00000104,?,?,00000000), ref: 0040FD3C
strcat.MSVCRT(?,\sqlite3.dll,?,?,?,00000000,00000104,?,?,00000000), ref: 0040FD4D
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FD73
strcat.MSVCRT(?,\mozsqlite3.dll,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FD84
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDAB
strcat.MSVCRT(?,\nss3.dll,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDBC
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDCB
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDE2
GetModuleHandleA.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040FDF0
LoadLibraryA.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040FDFE
GetProcAddress.KERNEL32(?,sqlite3_open), ref: 0040FE1E
GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 0040FE2A
GetProcAddress.KERNEL32(?,sqlite3_step), ref: 0040FE37
GetProcAddress.KERNEL32(?,sqlite3_column_text), ref: 0040FE44
GetProcAddress.KERNEL32(?,sqlite3_column_int), ref: 0040FE51
GetProcAddress.KERNEL32(?,sqlite3_column_int64), ref: 0040FE5E
GetProcAddress.KERNEL32(?,sqlite3_finalize), ref: 0040FE6B
GetProcAddress.KERNEL32(?,sqlite3_close), ref: 0040FE78
GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 0040FE85

Strings

\sqlite3.dll, xrefs: 0040FD47
sqlite3.dll, xrefs: 0040FDEA, 0040FDEF, 0040FDFD
sqlite3_step, xrefs: 0040FE2C
\nss3.dll, xrefs: 0040FDB6
sqlite3_close, xrefs: 0040FE6D
sqlite3_exec, xrefs: 0040FE7A
\mozsqlite3.dll, xrefs: 0040FD7E
sqlite3_prepare, xrefs: 0040FE20
sqlite3_column_int, xrefs: 0040FE46
sqlite3_open, xrefs: 0040FE18
sqlite3_finalize, xrefs: 0040FE60
sqlite3_column_int64, xrefs: 0040FE53
sqlite3_column_text, xrefs: 0040FE39

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$strcpy$strcat$HandleLibraryLoadModulememset
String ID: \mozsqlite3.dll$\nss3.dll$\sqlite3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
API String ID: 2571629209-2385123308
Opcode ID: f879ae07ce377879295b5903e709fdbb1205cb1f9dca58ec31e17bd31d5cb62c
Instruction ID: c8562112cbf9eae777f2394b99ada5fc335e217e34df457794dbf1c8b1b14659
Opcode Fuzzy Hash: f879ae07ce377879295b5903e709fdbb1205cb1f9dca58ec31e17bd31d5cb62c
Instruction Fuzzy Hash: 86516371900308AECB30EFA1DD45ECB7BF8AF58704F10497BE649E2641E678E6858F58

Function 00402D74 Relevance: 29.9, APIs: 5, Strings: 12, Instructions: 153stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

Part of subcall function 0040F1CA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00402904,?,?,?,?,00402904,?,?), ref: 0040F1E9

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

strcpy.MSVCRT(?,?), ref: 00402E8B
strcpy.MSVCRT(?,?,?,?), ref: 00402E9E
strcpy.MSVCRT(?,?), ref: 00402F2B
strcpy.MSVCRT(?,?,?,?), ref: 00402F38
RegCloseKey.ADVAPI32(?), ref: 00402F92

Strings

SMTPServer, xrefs: 00402EC0
PopServer, xrefs: 00402E26
SMTPAccount, xrefs: 00402EAA
SMTPLogSecure, xrefs: 00402EEA
PopPassword, xrefs: 00402E65
PopPort, xrefs: 00402E39
SMTPPassword, xrefs: 00402F05
EmailAddress, xrefs: 00402DFA
SMTPPort, xrefs: 00402ED6
PopLogSecure, xrefs: 00402E4A
DisplayName, xrefs: 00402DCD
PopAccount, xrefs: 00402E10

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$QueryValue$CloseOpen
String ID: DisplayName$EmailAddress$PopAccount$PopLogSecure$PopPassword$PopPort$PopServer$SMTPAccount$SMTPLogSecure$SMTPPassword$SMTPPort$SMTPServer
API String ID: 4127491968-1534328989
Opcode ID: 4a263c393ebea8c7b3aa3f5485092cacd202bcda1693c223d9a8b8372ccc35ea
Instruction ID: 3eb728c69d877055b887914c3e29035f7ad0c3b4bfdbdde50966da93315596c3
Opcode Fuzzy Hash: 4a263c393ebea8c7b3aa3f5485092cacd202bcda1693c223d9a8b8372ccc35ea
Instruction Fuzzy Hash: 315139B1910218BEDB21EF51CD06BDE777CAF04304F1081B7BA08B6191E7789B989F58

Function 00405FD0 Relevance: 16.6, APIs: 11, Instructions: 58clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00405FDA

Part of subcall function 00405ED5: CreateFileA.KERNEL32(0041133F,80000000,00000001,00000000,00000003,00000000,00000000,0041127B,0041141B,?,0041133F,?,?,*.oeaccount,0041141B,?), ref: 00405EE7

GetFileSize.KERNEL32(00000000,00000000), ref: 00405FF7
GlobalAlloc.KERNEL32(00002000,00000001), ref: 00406008
GlobalLock.KERNEL32(00000000), ref: 00406015
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406028
GlobalUnlock.KERNEL32(00000000), ref: 00406037
SetClipboardData.USER32(00000001,00000000), ref: 00406040
GetLastError.KERNEL32 ref: 00406048
CloseHandle.KERNEL32(?), ref: 00406054
GetLastError.KERNEL32 ref: 0040605F
CloseClipboard.USER32 ref: 00406068

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: 5d04c3275f228edfc2a9dcea81e5f6d2cb0bf8e7915dc2d704a3e214ce43d208
Instruction ID: 46ab690def339a2f00972c0b4152e32a3d13c207705114ffa6be22e44c23a91c
Opcode Fuzzy Hash: 5d04c3275f228edfc2a9dcea81e5f6d2cb0bf8e7915dc2d704a3e214ce43d208
Instruction Fuzzy Hash: A0112875544205BFDB10AFA4AC48B9A7FB8EB08316F118176F906E22A1DB748A44CA69

Function 00406073 Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemorystringCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 0040607B
strlen.MSVCRT ref: 00406088
GlobalAlloc.KERNEL32(00002000,00000001,?,?,?,?,0040AFC1,?), ref: 00406097
GlobalLock.KERNEL32(00000000,?,?,?,?,0040AFC1,?), ref: 004060A4
memcpy.MSVCRT ref: 004060AD
GlobalUnlock.KERNEL32(00000000), ref: 004060B6
SetClipboardData.USER32(00000001,00000000), ref: 004060BF
CloseClipboard.USER32 ref: 004060CF

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpystrlen
String ID:
API String ID: 3116012682-0
Opcode ID: c70b900a696f57a29a369809a0454994a779be389cf8b88d1f6a35ab18b15240
Instruction ID: d09f43d2fefddb7d7ea69405cde3b0bd2fff4912bca4764858ce7f0ae225efb5
Opcode Fuzzy Hash: c70b900a696f57a29a369809a0454994a779be389cf8b88d1f6a35ab18b15240
Instruction Fuzzy Hash: 09F090371402296BC2102FA4BC4CE9B7FACDF88B56B058139FA0AD2251DE74894486A9

Function 0040ADA4 Relevance: 9.1, APIs: 6, Instructions: 54fileclipboardCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 0040ADBE
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040ADD0
GetTempFileNameA.KERNEL32(?,0041444C,00000000,?), ref: 0040ADF2
OpenClipboard.USER32(?), ref: 0040AE12
GetLastError.KERNEL32 ref: 0040AE2B
DeleteFileA.KERNEL32(00000000), ref: 0040AE48

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
String ID:
API String ID: 2014771361-0
Opcode ID: b36e7ecf8624d8c90ea66491b75dc4c52724ce01200d4d7616f195176cae1ddb
Instruction ID: 7dfed4210218cbe3633ab85fc006b2e48c808a0cdacf0b0ca9692cf87dba871e
Opcode Fuzzy Hash: b36e7ecf8624d8c90ea66491b75dc4c52724ce01200d4d7616f195176cae1ddb
Instruction Fuzzy Hash: 071165725443186BDB209B61DC49FCB7BBCAF14706F0441B6F689E2091EB78DAC48B69

Function 004033B1 Relevance: 7.6, Strings: 6, Instructions: 61COMMON

Download Yara Rule

Strings

ESMTPUsername, xrefs: 00403409
SMTPServer, xrefs: 004033ED
POP3Server, xrefs: 0040342D
ESMTPPassword, xrefs: 0040341B
POP3Password, xrefs: 00403451
POP3Username, xrefs: 0040343F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PrivateProfileString_mbscmpstrlen
String ID: ESMTPPassword$ESMTPUsername$POP3Password$POP3Server$POP3Username$SMTPServer
API String ID: 3963849919-1658304561
Opcode ID: 597409f585b18e28f020b58d473e644e7b11ec3109896bedd661c4ad4da97b59
Instruction ID: ad4fe9f44f4ec6704836124f0b121ca839780027ba1e1250375890495da90f14
Opcode Fuzzy Hash: 597409f585b18e28f020b58d473e644e7b11ec3109896bedd661c4ad4da97b59
Instruction Fuzzy Hash: F421BEB1C0022C6EDB61EF118D86FED7B7C9F45705F4000ABAA48B6092DB7C5BC59E59

Function 00406282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00418118,0000001A,0040F4E8,00000104), ref: 0040629C

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4ef98d3589c27af49cae22675b267854afe1d3363596bc0cac78b0a9285f8b1d
Instruction ID: 237572770da6cdec3f20c1cd15f55f1c4e3d09a34ceac29ab19b180c030d7de4
Opcode Fuzzy Hash: 4ef98d3589c27af49cae22675b267854afe1d3363596bc0cac78b0a9285f8b1d
Instruction Fuzzy Hash: 2AC04C36511120BBD7505B69FC0ABC576989709326F15C07EB901A2256CBB80E878FDC

Function 0040BF6B Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84eadeceb15b833d74a6b3ddcf4bdaa302aef256980365e51470e07e4227508
Instruction ID: 8e3ad788e2b47047ad7c21b66b362804302468dbbdc0c1ed7242a88a839864d8
Opcode Fuzzy Hash: b84eadeceb15b833d74a6b3ddcf4bdaa302aef256980365e51470e07e4227508
Instruction Fuzzy Hash: FC42D5B7E403299FCB14CFD5C8C0589F7B2BFD8314B1B95958918BB216D2B4BA468BD0

Function 00404F58 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a2655c9ce598f9aff01b1782757f780416675e5ac7cea9a557e58993665817
Instruction ID: c8780dc2752f1dd6eab6e238a0c3ddba928e41edca2983f589a9e6463379b6bc
Opcode Fuzzy Hash: 45a2655c9ce598f9aff01b1782757f780416675e5ac7cea9a557e58993665817
Instruction Fuzzy Hash: 0FA1CE37BA4B0A07E30889EAACC6395B5D397D8314F6E423D9B34C73D2E9FC59168194

Function 00404EC7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bbcacfff3d007f8ba4df6050e74c9d9e9b3729906fc48c14092c1c50e174df2
Instruction ID: f119ae820a612d4e49c816f819756393efe6ef5ca55a1a060cd83ef1bb4a5302
Opcode Fuzzy Hash: 0bbcacfff3d007f8ba4df6050e74c9d9e9b3729906fc48c14092c1c50e174df2
Instruction Fuzzy Hash: 09018C757286068FD308CFA9EC80966B3B2FB992657188538DA11C3266DE34A511CA54

Function 00404DE5 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4540386dd2ecfa8358b54f970b731510518c9cc2a47fdc7166f1c0352bd1f31
Instruction ID: e46ac8c8d649937048925bbc22b10e31c7d260e61c9919193dd0f57e0586c858
Opcode Fuzzy Hash: d4540386dd2ecfa8358b54f970b731510518c9cc2a47fdc7166f1c0352bd1f31
Instruction Fuzzy Hash: 75011E326019208FA38DCE3AC80545377E3FFCA325326C1E8D845AB579D6316802CBD4

Function 00404E56 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf104503c4d1f63e508e528481e2c1d582825b9df7b848c5f582128bf29b2c3b
Instruction ID: 1c8cf4990013556009a943ce68bbe5c533817c3d042a03847a5f6a4628de1edc
Opcode Fuzzy Hash: cf104503c4d1f63e508e528481e2c1d582825b9df7b848c5f582128bf29b2c3b
Instruction Fuzzy Hash: DA01E8326159308FA389DE3AC80144377E3FFCA32532AC1E5C945AB57DD6316847DB90

Function 0040FEB1 Relevance: 87.8, APIs: 8, Strings: 42, Instructions: 307stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004102D0
strncmp.MSVCRT(?,00414FF4,00000000,00414FF4,?,?,?), ref: 004102E0
memcpy.MSVCRT ref: 0041035C
atoi.MSVCRT ref: 0041036D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00410399

Strings

$QA, xrefs: 00410048
RA, xrefs: 0041027D
4RA, xrefs: 004101A9
DRA, xrefs: 004101BD
<RA, xrefs: 004101B3
,PA, xrefs: 0040FF12
PA, xrefs: 00410002
tRA, xrefs: 004101F9
|QA, xrefs: 004100B6
LPA, xrefs: 0040FF3A
DQA, xrefs: 00410070
\RA, xrefs: 004101DB
lRA, xrefs: 004101EF
QA, xrefs: 00410138
,RA, xrefs: 00410192
TRA, xrefs: 004101D1
<PA, xrefs: 0040FF26
,QA, xrefs: 00410052
lPA, xrefs: 0040FF62
TPA, xrefs: 0040FF44
\QA, xrefs: 0041008E
$PA, xrefs: 0040FF08
PA, xrefs: 0040FFF8
TQA, xrefs: 00410084
dRA, xrefs: 004101E5
4PA, xrefs: 0040FF1C
LRA, xrefs: 004101C7
RA, xrefs: 00410276
$RA, xrefs: 00410188
dQA, xrefs: 00410098
lQA, xrefs: 004100A2
dPA, xrefs: 0040FF58
LQA, xrefs: 0041007A
<QA, xrefs: 00410066
QA, xrefs: 00410142
4QA, xrefs: 0041005C
|PA, xrefs: 0040FF76
DPA, xrefs: 0040FF30
tPA, xrefs: 0040FF6C
|RA, xrefs: 00410203
tQA, xrefs: 004100AC
\PA, xrefs: 0040FF4E

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWideatoimemcpystrlenstrncmp
String ID: $PA$$QA$$RA$,PA$,QA$,RA$4PA$4QA$4RA$<PA$<QA$<RA$DPA$DQA$DRA$LPA$LQA$LRA$TPA$TQA$TRA$\PA$\QA$\RA$dPA$dQA$dRA$lPA$lQA$lRA$tPA$tQA$tRA$|PA$|QA$|RA$PA$PA$QA$QA$RA$RA
API String ID: 1895597112-403538104
Opcode ID: f81056c634e1afed85b28816bcd2f342141d731626830ff6453ade7d9a479c77
Instruction ID: 0fafc75884cef128377fd64f4b7a28f8ddc93d47313dbc0ddeda27c5dc7f40ea
Opcode Fuzzy Hash: f81056c634e1afed85b28816bcd2f342141d731626830ff6453ade7d9a479c77
Instruction Fuzzy Hash: 6FF1D5B1805A98DEDF21CF94C9887DDBBB0BB85308F1481CAD5586B241C7B94AC9CF9D

Function 00410D67 Relevance: 80.8, APIs: 23, Strings: 23, Instructions: 309stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00410D79
strcmp.MSVCRT ref: 00410DC5
strcmp.MSVCRT ref: 00410DEE
strcmp.MSVCRT ref: 00410E17
strcmp.MSVCRT ref: 00410E40
strcmp.MSVCRT ref: 00410E69
strcmp.MSVCRT ref: 00410E9C
strcmp.MSVCRT ref: 00410ECF
strcmp.MSVCRT ref: 00410F35
strcmp.MSVCRT ref: 00410F5E
strcmp.MSVCRT ref: 00410F87
strcmp.MSVCRT ref: 00410FB0
strcmp.MSVCRT ref: 00410FD9
strcmp.MSVCRT ref: 00411002
strcmp.MSVCRT ref: 00410F02

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

_stricmp.MSVCRT(?,SMTP_Port), ref: 00411049
_stricmp.MSVCRT(?,NNTP_Port), ref: 00411072
_stricmp.MSVCRT(?,IMAP_Port), ref: 00411083
_stricmp.MSVCRT(?,POP3_Port), ref: 00411094
_stricmp.MSVCRT(?,SMTP_Secure_Connection), ref: 004110BD
_stricmp.MSVCRT(?,NNTP_Secure_Connection), ref: 004110E6
_stricmp.MSVCRT(?,IMAP_Secure_Connection), ref: 004110F7
_stricmp.MSVCRT(?,POP3_Secure_Connection), ref: 00411108

Strings

IMAP_User_Name, xrefs: 00410E96
NNTP_Password2, xrefs: 00410F81
Account_Name, xrefs: 00410D73
POP3_Password2, xrefs: 00410F2F
SMTP_Port, xrefs: 0041103D
NNTP_Email_Address, xrefs: 00410FD3
NNTP_Port, xrefs: 0041106C
NNTP_Server, xrefs: 00410E11
SMTP_User_Name, xrefs: 00410EFC
POP3_Secure_Connection, xrefs: 00411102
NNTP_User_Name, xrefs: 00410EC9
IMAP_Server, xrefs: 00410DE8
POP3_User_Name, xrefs: 00410E63
NNTP_Secure_Connection, xrefs: 004110E0
POP3_Server, xrefs: 00410DB9
IMAP_Secure_Connection, xrefs: 004110F1
SMTP_Secure_Connection, xrefs: 004110B7
IMAP_Port, xrefs: 0041107D
SMTP_Email_Address, xrefs: 00410FFC
POP3_Port, xrefs: 0041108E
IMAP_Password2, xrefs: 00410F58
SMTP_Password2, xrefs: 00410FAA
SMTP_Server, xrefs: 00410E3A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcmp$_stricmp$memcpystrlen
String ID: Account_Name$IMAP_Password2$IMAP_Port$IMAP_Secure_Connection$IMAP_Server$IMAP_User_Name$NNTP_Email_Address$NNTP_Password2$NNTP_Port$NNTP_Secure_Connection$NNTP_Server$NNTP_User_Name$POP3_Password2$POP3_Port$POP3_Secure_Connection$POP3_Server$POP3_User_Name$SMTP_Email_Address$SMTP_Password2$SMTP_Port$SMTP_Secure_Connection$SMTP_Server$SMTP_User_Name
API String ID: 1113949926-2499304436
Opcode ID: 0a2286a2ee10144d1cd19d55ef64d0b704ba42cbf857e026c28c1a280e809191
Instruction ID: fdd8238c1ffaca80b8f1a937c0ff3988063f93198c4aeb5310ca970d52cdd6dd
Opcode Fuzzy Hash: 0a2286a2ee10144d1cd19d55ef64d0b704ba42cbf857e026c28c1a280e809191
Instruction Fuzzy Hash: 8E9160B21097049DE628B632ED02BDB73D8AF4431CF21052FF55AE6182EEBDB991465C

Function 0040C9AA Relevance: 61.5, APIs: 21, Strings: 14, Instructions: 232stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C9CF
strlen.MSVCRT ref: 0040C9DA
strncmp.MSVCRT(?,mail.account.account,00000000,mail.account.account,?,00000000,000000FF), ref: 0040C9E7
_stricmp.MSVCRT(00000000,server), ref: 0040CA24
_stricmp.MSVCRT(00000000,identities), ref: 0040CA46
strlen.MSVCRT ref: 0040CA66
strncmp.MSVCRT(?,mail.server,00000000,mail.server), ref: 0040CA73
_stricmp.MSVCRT(00000000,username,00000000), ref: 0040CABC
_stricmp.MSVCRT(00000000,type,00000000), ref: 0040CADE
_stricmp.MSVCRT(00000000,hostname,00000000), ref: 0040CB00
_stricmp.MSVCRT(00000000,port,00000000), ref: 0040CB22
atoi.MSVCRT ref: 0040CB30

Part of subcall function 0040C923: memset.MSVCRT ref: 0040C959
Part of subcall function 0040C923: memcpy.MSVCRT ref: 0040C97B
Part of subcall function 0040C923: atoi.MSVCRT ref: 0040C98F

_stricmp.MSVCRT(00000000,useSecAuth,00000000), ref: 0040CB44
_stricmp.MSVCRT(?,true,00000000), ref: 0040CB57
strlen.MSVCRT ref: 0040CB72
strncmp.MSVCRT(?,mail.identity,00000000,mail.identity), ref: 0040CB7F
_stricmp.MSVCRT(00000000,useremail,00000000), ref: 0040CBC4
_stricmp.MSVCRT(00000000,fullname,00000000), ref: 0040CBE6
_stricmp.MSVCRT(?,signon.signonfilename), ref: 0040CC05
strlen.MSVCRT ref: 0040CC20
strlen.MSVCRT ref: 0040CC2A

Strings

type, xrefs: 0040CAD6
username, xrefs: 0040CAB2
fullname, xrefs: 0040CBDE
signon.signonfilename, xrefs: 0040CBFD
server, xrefs: 0040CA1A
identities, xrefs: 0040CA3E
mail.server, xrefs: 0040CA60, 0040CA65, 0040CA6E
useSecAuth, xrefs: 0040CB3C
true, xrefs: 0040CB4F
port, xrefs: 0040CB1A
useremail, xrefs: 0040CBBA
hostname, xrefs: 0040CAF8
mail.identity, xrefs: 0040CB6C, 0040CB71, 0040CB7A
mail.account.account, xrefs: 0040C9D4, 0040C9D9, 0040C9E2

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _stricmp$strlen$strncmp$atoimemset$memcpy
String ID: fullname$hostname$identities$mail.account.account$mail.identity$mail.server$port$server$signon.signonfilename$true$type$useSecAuth$useremail$username
API String ID: 736090197-593045482
Opcode ID: c049cdfae9ca141b10bbd91dfc467443bb183352d5b84e1e83dacad5e1e92eca
Instruction ID: 863115145772795da6afe78a2776049e9b2399cf567c3eb7605af69a2dd2c254
Opcode Fuzzy Hash: c049cdfae9ca141b10bbd91dfc467443bb183352d5b84e1e83dacad5e1e92eca
Instruction Fuzzy Hash: 4F71C432504209FEEB10EB61DD42BDE77A5DF50328F20426BF945B21D1EB7CAE919A4C

Function 0040D003 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 287stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E56D
Part of subcall function 0040E54C: GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040E59C
Part of subcall function 0040E54C: SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040E5A9
Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E5C0
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5CA
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5D8
Part of subcall function 0040E54C: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040E611
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E62D
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E645
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Init), ref: 0040E65A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0040E666
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040E672
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040E67E
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040E68A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040E696

memset.MSVCRT ref: 0040D0C4
memset.MSVCRT ref: 0040D0D6
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D139
strcpy.MSVCRT(?,0040D972,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D14F
strcpy.MSVCRT(?,0040D972,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D165
strcpy.MSVCRT(?,?,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D17B
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D191
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D1A4
memset.MSVCRT ref: 0040D1BF
memset.MSVCRT ref: 0040D1D3
memset.MSVCRT ref: 0040D239
memset.MSVCRT ref: 0040D24D
memset.MSVCRT ref: 0040D261
sprintf.MSVCRT ref: 0040D279
sprintf.MSVCRT ref: 0040D28B
sprintf.MSVCRT ref: 0040D29D
_stricmp.MSVCRT(?,?), ref: 0040D2B3
_stricmp.MSVCRT(?,?), ref: 0040D2CC
_stricmp.MSVCRT(?,?), ref: 0040D2E5
_stricmp.MSVCRT(?,00000204), ref: 0040D301

Strings

usernameField, xrefs: 0040D104
httpRealm, xrefs: 0040D11E
logins, xrefs: 0040D06F
encryptedUsername, xrefs: 0040D0EB
imap://%s, xrefs: 0040D285
hostname, xrefs: 0040D0DE
O4A, xrefs: 0040D09A
smtp://%s, xrefs: 0040D297
encryptedPassword, xrefs: 0040D0F7
mailbox://%s, xrefs: 0040D273
passwordField, xrefs: 0040D111

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$AddressProcstrcpy$_stricmp$sprintf$CurrentDirectoryLibraryLoadstrlen$HandleModule
String ID: O4A$encryptedPassword$encryptedUsername$hostname$httpRealm$imap://%s$logins$mailbox://%s$passwordField$smtp://%s$usernameField
API String ID: 1176642800-900804342
Opcode ID: 07b75e6ccac2d73e9a819f79207db565455b9c3375c3b4e8148ba61c4ba1c0b5
Instruction ID: cce80d09e33f880f425c5e7640b59ca7d1e8d6c5df6cdb4a6b0c5a683426509d
Opcode Fuzzy Hash: 07b75e6ccac2d73e9a819f79207db565455b9c3375c3b4e8148ba61c4ba1c0b5
Instruction Fuzzy Hash: CDA15372D00119AEDB20EBA5CD819DE77BCAF44308F1405ABF608F7141DA3CAA85CB58

Function 0040D3B5 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 339stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E56D
Part of subcall function 0040E54C: GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040E59C
Part of subcall function 0040E54C: SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040E5A9
Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E5C0
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5CA
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5D8
Part of subcall function 0040E54C: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040E611
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E62D
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E645
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Init), ref: 0040E65A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0040E666
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040E672
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040E67E
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040E68A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040E696

memset.MSVCRT ref: 0040D430
memset.MSVCRT ref: 0040D449
MultiByteToWideChar.KERNEL32(00000000,00000000,0040D954,000000FF,?,00000104,00000104,00000000,?,0040D954,?,00000000), ref: 0040D460
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000,?,0040D954,?,00000000), ref: 0040D47F
memset.MSVCRT ref: 0040D4F2
memset.MSVCRT ref: 0040D504
strcpy.MSVCRT(?,00000000,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D576
strcpy.MSVCRT(?,00000000,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D589
strcpy.MSVCRT(?,00000000,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D59F
strcpy.MSVCRT(?,?,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D5B5
strcpy.MSVCRT(?,?,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D5CB
strcpy.MSVCRT(?,0040D954,0040D954,00000002,0040D954,00000005,0040D954,00000004,0040D954,00000007,0040D954,00000006,0040D954,00000001), ref: 0040D5E1
memset.MSVCRT ref: 0040D5FC
memset.MSVCRT ref: 0040D610
memset.MSVCRT ref: 0040D676
memset.MSVCRT ref: 0040D68A
memset.MSVCRT ref: 0040D69E
sprintf.MSVCRT ref: 0040D6B6
sprintf.MSVCRT ref: 0040D6C8
sprintf.MSVCRT ref: 0040D6DA
_stricmp.MSVCRT(?,?), ref: 0040D6F0
_stricmp.MSVCRT(?,?), ref: 0040D709
_stricmp.MSVCRT(?,?), ref: 0040D722
_stricmp.MSVCRT(?,00000204), ref: 0040D73B

Strings

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins, xrefs: 0040D4B5
imap://%s, xrefs: 0040D6C2
smtp://%s, xrefs: 0040D6D4
mailbox://%s, xrefs: 0040D6B0

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$AddressProcstrcpy$_stricmp$sprintf$ByteCharCurrentDirectoryLibraryLoadMultiWidestrlen$HandleModule
String ID: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins$imap://%s$mailbox://%s$smtp://%s
API String ID: 2893247534-4245710904
Opcode ID: b9c130291edcc358c326a525934ef701acbcd93509fe00eddc44c50268657f0e
Instruction ID: a8d77792ad7cee7e4ffb55223bde2ad9b6e4b2884a1795ffa9bad40f06226133
Opcode Fuzzy Hash: b9c130291edcc358c326a525934ef701acbcd93509fe00eddc44c50268657f0e
Instruction Fuzzy Hash: FEC12D72D04119AEDB20DAA5DD859DEB7BCEF04314F1441BBF609F2191DA389E888B58

Function 0040EB15 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 264stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0040EB42
GetDlgItem.USER32(?,000003E8), ref: 0040EB4E
GetWindowLongA.USER32(00000000,000000F0), ref: 0040EB5D
GetWindowLongA.USER32(?,000000F0), ref: 0040EB69
GetWindowLongA.USER32(00000000,000000EC), ref: 0040EB72
GetWindowLongA.USER32(?,000000EC), ref: 0040EB7E
GetWindowRect.USER32(00000000,?), ref: 0040EB90
GetWindowRect.USER32(?,?), ref: 0040EB9B
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040EBAF
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040EBBD
GetDC.USER32 ref: 0040EBF6
strlen.MSVCRT ref: 0040EC36
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0040EC47
ReleaseDC.USER32(?,?), ref: 0040EC94
sprintf.MSVCRT ref: 0040ED54
SetWindowTextA.USER32(?,?), ref: 0040ED68
SetWindowTextA.USER32(?,00000000), ref: 0040ED86
GetDlgItem.USER32(?,00000001), ref: 0040EDBC
GetWindowRect.USER32(00000000,?), ref: 0040EDCC
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040EDDA
GetClientRect.USER32(?,?), ref: 0040EDF1
GetWindowRect.USER32(?,?), ref: 0040EDFB
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040EE41
GetClientRect.USER32(?,?), ref: 0040EE4B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040EE83

Strings

%s:, xrefs: 0040ED4E
STATIC, xrefs: 0040ECF8
EDIT, xrefs: 0040ED2F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Releasesprintfstrlen
String ID: %s:$EDIT$STATIC
API String ID: 1703216249-3046471546
Opcode ID: 0602b39e8c66a6b3299f776a9e3d4c07d3cdec416fd91f858be2a38e870d1518
Instruction ID: 954468ae603e5140b8f73852e098bd997e11b992376cfaf7be677857a6fc3954
Opcode Fuzzy Hash: 0602b39e8c66a6b3299f776a9e3d4c07d3cdec416fd91f858be2a38e870d1518
Instruction Fuzzy Hash: AAB1EF71108341AFD710DF69C985E6BBBE9FF88704F008A2DF699922A0DB75E914CF16

Function 00401060 Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 004010BC
ChildWindowFromPoint.USER32(?,?,?), ref: 004010CE
GetDlgItem.USER32(?,000003EE), ref: 00401103
ChildWindowFromPoint.USER32(?,?,?), ref: 00401110
GetDlgItem.USER32(?,000003EC), ref: 0040113E
ChildWindowFromPoint.USER32(?,?,?), ref: 00401150
LoadCursorA.USER32(00000067), ref: 0040115F
SetCursor.USER32(00000000,?,?), ref: 00401166
GetDlgItem.USER32(?,000003EE), ref: 00401186
ChildWindowFromPoint.USER32(?,?,?), ref: 00401193
GetDlgItem.USER32(?,000003EC), ref: 004011AD
SetBkMode.GDI32(?,00000001), ref: 004011B9
SetTextColor.GDI32(?,00C00000), ref: 004011C7
GetSysColorBrush.USER32(0000000F), ref: 004011CF
GetDlgItem.USER32(?,000003EE), ref: 004011EF
EndDialog.USER32(?,00000001), ref: 0040121A
DeleteObject.GDI32(?), ref: 00401226
GetDlgItem.USER32(?,000003ED), ref: 0040124A
ShowWindow.USER32(00000000), ref: 00401253
GetDlgItem.USER32(?,000003EE), ref: 0040125F
ShowWindow.USER32(00000000), ref: 00401262
SetDlgItemTextA.USER32(?,000003EE,00418348), ref: 00401273
memset.MSVCRT ref: 0040128E
SetWindowTextA.USER32(?,00000000), ref: 004012AA
SetDlgItemTextA.USER32(?,000003EA,?), ref: 004012C2
SetDlgItemTextA.USER32(?,000003EC,?), ref: 004012D3

Strings

P4A, xrefs: 0040129C

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogLoadModeObjectmemset
String ID: P4A
API String ID: 2998058495-688682323
Opcode ID: 8ebdac4dc682d180df791e79ca3a4ee1758aaaedabd5f88fc31ce58f9e0aca68
Instruction ID: d9fb6b658f62cfbd3d3feccfc88cd7b26f9bda258aecb32a4b2b6428ade5212d
Opcode Fuzzy Hash: 8ebdac4dc682d180df791e79ca3a4ee1758aaaedabd5f88fc31ce58f9e0aca68
Instruction Fuzzy Hash: 21619D31400248FBDF129F60DD89BAA7FA5EB04715F14C1B6F908BA2F1C7759A90DB58

Function 0040E197 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 220windowstringCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 0040E1DF
GetDlgItem.USER32(?,000003EA), ref: 0040E1F7
SendMessageA.USER32(00000000,000000B1,00000000,0000FFFF), ref: 0040E216
SendMessageA.USER32(?,00000301,00000000,00000000), ref: 0040E223
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040E22C
memset.MSVCRT ref: 0040E254
memset.MSVCRT ref: 0040E274
memset.MSVCRT ref: 0040E292
memset.MSVCRT ref: 0040E2AB
memset.MSVCRT ref: 0040E2C9
memset.MSVCRT ref: 0040E2E2
GetCurrentProcess.KERNEL32 ref: 0040E2EA
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0040E30F
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0040E345
memset.MSVCRT ref: 0040E39C
GetCurrentProcessId.KERNEL32 ref: 0040E3AA
memcpy.MSVCRT ref: 0040E3D9
strcpy.MSVCRT(?,00000000), ref: 0040E3FB
sprintf.MSVCRT ref: 0040E466
SetDlgItemTextA.USER32(?,000003EA,?), ref: 0040E47F
GetDlgItem.USER32(?,000003EA), ref: 0040E489
SetFocus.USER32(00000000), ref: 0040E490

Strings

{Unknown}, xrefs: 0040E259
Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s, xrefs: 0040E460

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusTextmemcpysprintfstrcpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s${Unknown}
API String ID: 138940113-3474136107
Opcode ID: 69886baca77838fccc6ea5cb6e0f689363a9b5453ec14ca3e74d88e8d62f8c56
Instruction ID: c9ff55592ed190661b3986ab950919d3506bad0d2814ede43270e5be3f0f5ae2
Opcode Fuzzy Hash: 69886baca77838fccc6ea5cb6e0f689363a9b5453ec14ca3e74d88e8d62f8c56
Instruction Fuzzy Hash: 4571D672404244BFD721DF61DC45EDB7FEDEB48344F00883EF648921A1DA399A65CBAA

Function 0040E54C Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 113libraryloaderstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E56D
GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040E59C
SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040E5A9
memset.MSVCRT ref: 0040E5C0
strlen.MSVCRT ref: 0040E5CA
strlen.MSVCRT ref: 0040E5D8
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040E611
LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E62D
LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E645
GetProcAddress.KERNEL32(?,NSS_Init), ref: 0040E65A
GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0040E666
GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040E672
GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040E67E
GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040E68A
GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040E696
GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 0040E6A2

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

Strings

PK11SDR_Decrypt, xrefs: 0040E698
PK11_Authenticate, xrefs: 0040E68C
NSS_Init, xrefs: 0040E653
PK11_GetInternalKeySlot, xrefs: 0040E668
PK11_CheckUserPassword, xrefs: 0040E680
nss3.dll, xrefs: 0040E5C5, 0040E5EE
PK11_FreeSlot, xrefs: 0040E674
NSS_Shutdown, xrefs: 0040E65C

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$strlen$CurrentDirectoryLibraryLoadmemset$HandleModulememcpy
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 1296682400-4029219660
Opcode ID: b9878449b49199713cb1e65d9f830cec44e52960d34c19136fd466dd6c257c27
Instruction ID: ea12e4d39b815288b34f85ef975f35705c11e21fdcabb8b0f4231a79c1823d94
Opcode Fuzzy Hash: b9878449b49199713cb1e65d9f830cec44e52960d34c19136fd466dd6c257c27
Instruction Fuzzy Hash: 7E4197B1940318AACB20DF75CC49FC6BBE8AF64704F154C6BE185A2180E7B9A6D4CF58

Function 0040FAA6 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 168stringregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FACA
memset.MSVCRT ref: 0040FAE2

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 0040FB1A

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

_mbsnbicmp.MSVCRT ref: 0040FB48
memset.MSVCRT ref: 0040FB67
memset.MSVCRT ref: 0040FB7F
_snprintf.MSVCRT ref: 0040FB9C
_mbsrchr.MSVCRT ref: 0040FBC6
_mbsicmp.MSVCRT ref: 0040FBFA
strcpy.MSVCRT(?,?,?), ref: 0040FC13
strcpy.MSVCRT(?,?,?,?,?), ref: 0040FC26
RegCloseKey.ADVAPI32(0040FD0A), ref: 0040FC51
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FC5F
ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104,?,?,?,?,?,?,?,?,00000000), ref: 0040FC71
GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FC9E

Strings

mozilla, xrefs: 0040FB42
PathToExe, xrefs: 0040FBA9
%programfiles%\Mozilla Thunderbird, xrefs: 0040FC6C
SOFTWARE\Mozilla, xrefs: 0040FAEB
%s\bin, xrefs: 0040FB8B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$strcpy$CloseCurrentDirectoryEnumEnvironmentExpandOpenStrings_mbsicmp_mbsnbicmp_mbsrchr_snprintf
String ID: %programfiles%\Mozilla Thunderbird$%s\bin$PathToExe$SOFTWARE\Mozilla$mozilla
API String ID: 3269028891-3267283505
Opcode ID: 2db57c62c4330eedb1a8fe20c988d36466374da2882950982c509ff309ff3e93
Instruction ID: 1ceab4daf47746688ac62aede77486c23684b0aa94ce4f67dad83c1e3abd437f
Opcode Fuzzy Hash: 2db57c62c4330eedb1a8fe20c988d36466374da2882950982c509ff309ff3e93
Instruction Fuzzy Hash: 3851C67194515DBEDB31E7A18D42EDB7BACAF14304F0004FAB684F2141EA789FC98B69

Function 0040F797 Relevance: 27.1, APIs: 12, Strings: 6, Instructions: 101stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F7B8
memset.MSVCRT ref: 0040F7CC
strcpy.MSVCRT(?,<font,?,?,?,?,?), ref: 0040F7F9
sprintf.MSVCRT ref: 0040F814
strcat.MSVCRT(?,?,?, size="%d",?,?,?,?,?,?), ref: 0040F821
sprintf.MSVCRT ref: 0040F84B
strcat.MSVCRT(?,?,?, color="#%s",00000000,?,?,?,?,?,?,?), ref: 0040F858
strcat.MSVCRT(?,00414E74,?,?,?,?,?), ref: 0040F866
strcat.MSVCRT(?,<b>,?,?,?,?,?), ref: 0040F878
strcat.MSVCRT(?,004097A4,?,?,?,?,?), ref: 0040F883
strcat.MSVCRT(?,</b>,?,?,?,?,?), ref: 0040F895
strcat.MSVCRT(?,</font>,?,?,?,?,?), ref: 0040F8A7

Strings

</font>, xrefs: 0040F8A1
size="%d", xrefs: 0040F80E
</b>, xrefs: 0040F88F
color="#%s", xrefs: 0040F845
<b>, xrefs: 0040F872
<font, xrefs: 0040F7F3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcat$memsetsprintf$strcpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 1662040868-1996832678
Opcode ID: 8a1c3a32b9a96c7bd47b9f04c68cff8eaed577a3d3a668b2d7b8b90f51614222
Instruction ID: 1d89f71d6803e1250473f580c1fd87552222ed23aec69fbe6c7d3cec9cc88889
Opcode Fuzzy Hash: 8a1c3a32b9a96c7bd47b9f04c68cff8eaed577a3d3a668b2d7b8b90f51614222
Instruction Fuzzy Hash: C731E673905714AEC720AA659D42DCBB76CAF14324F1082BFF214A2182D7BC9AD4CA9D

Function 0040B031 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 110stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B056
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000,00000000), ref: 0040B067
strrchr.MSVCRT ref: 0040B076
strcat.MSVCRT(00000000,.cfg), ref: 0040B090
strcpy.MSVCRT(?,00000000,00000000,.cfg), ref: 0040B0C4
strcpy.MSVCRT(00000000,General,?,00000000,00000000,.cfg), ref: 0040B0D5
GetWindowPlacement.USER32(?,?), ref: 0040B16B

Strings

\LA, xrefs: 0040B0E8
.cfg, xrefs: 0040B08A
MarkOddEvenRows, xrefs: 0040B139
ShowGridLines, xrefs: 0040B0EE
General, xrefs: 0040B0CF
SaveFilterIndex, xrefs: 0040B107
WinPos, xrefs: 0040B17F
AddExportHeaderLine, xrefs: 0040B120

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$FileModuleNamePlacementWindowmemsetstrcatstrrchr
String ID: .cfg$AddExportHeaderLine$General$MarkOddEvenRows$SaveFilterIndex$ShowGridLines$WinPos$\LA
API String ID: 1301239246-3877392175
Opcode ID: 0827365863aa91c80afc493f8c43d1ccc0429d1286164b8e7b7a3723fcb05fb6
Instruction ID: 0af9f59d4ba14ec1661be341c61033e05a04fd550f4be300a3a65ce9efdf479e
Opcode Fuzzy Hash: 0827365863aa91c80afc493f8c43d1ccc0429d1286164b8e7b7a3723fcb05fb6
Instruction Fuzzy Hash: F2414A72940118AFCB21DB54CC88FDABBBCAB58700F0441E6F509E7191DB749BC8CBA8

Function 004095F5 Relevance: 25.7, APIs: 10, Strings: 7, Instructions: 182stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409615
memset.MSVCRT ref: 00409638
memset.MSVCRT ref: 0040964E
memset.MSVCRT ref: 0040965E
sprintf.MSVCRT ref: 00409692
strcpy.MSVCRT(00000000, nowrap), ref: 004096D9
sprintf.MSVCRT ref: 00409760
strcat.MSVCRT(?, ), ref: 0040978F

Part of subcall function 0040F6E2: sprintf.MSVCRT ref: 0040F701

strcpy.MSVCRT(?,?), ref: 00409774
sprintf.MSVCRT ref: 004097C3

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

Strings

 , xrefs: 00409789
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040961D
</table><p>, xrefs: 004097E5
nowrap, xrefs: 004096D3
<font color="%s">%s</font>, xrefs: 00409758
bgcolor="%s", xrefs: 0040968C
<table border="1" cellpadding="5">, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memsetsprintf$strcpy$FileWritestrcatstrlen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 2822972341-601624466
Opcode ID: 17b7667225c5a6bbdce009f3410a16bb9bd559968b7daa8f1be1712407fa5f11
Instruction ID: ad5d45e3310275bf8c81aed9ad428c342ee671dbf73ea1c77541a84cad310e98
Opcode Fuzzy Hash: 17b7667225c5a6bbdce009f3410a16bb9bd559968b7daa8f1be1712407fa5f11
Instruction Fuzzy Hash: AA615032900214AFDF18DF94CC85EDE7B79EF08314F1001AAFA05A71D2DB79AA95CB59

Function 0040D7C1 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 166stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406C5E: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040D7DA,?,?,?,?), ref: 00406C77
Part of subcall function 00406C5E: CloseHandle.KERNEL32(00000000,?,?,?), ref: 00406CA3

Part of subcall function 00404638: free.MSVCRT(00000000,0040BE16), ref: 0040463F

Part of subcall function 00406209: strcpy.MSVCRT(?,?,0040D7FB,?,?,?,?,?), ref: 0040620E
Part of subcall function 00406209: strrchr.MSVCRT ref: 00406216

Part of subcall function 0040C70B: memset.MSVCRT ref: 0040C72C
Part of subcall function 0040C70B: memset.MSVCRT ref: 0040C740
Part of subcall function 0040C70B: memset.MSVCRT ref: 0040C754
Part of subcall function 0040C70B: memcpy.MSVCRT ref: 0040C821
Part of subcall function 0040C70B: memcpy.MSVCRT ref: 0040C881

strlen.MSVCRT ref: 0040D81F
strlen.MSVCRT ref: 0040D82D
memset.MSVCRT ref: 0040D86E
strlen.MSVCRT ref: 0040D87D
strlen.MSVCRT ref: 0040D88B
memset.MSVCRT ref: 0040D8CC
strlen.MSVCRT ref: 0040D8DB
strlen.MSVCRT ref: 0040D8E9
_stricmp.MSVCRT(00000504,none,?,?,?,?,?,?), ref: 0040D997
strcpy.MSVCRT(00000004,00000204,?,?,?,?,?,?), ref: 0040D9B2

Part of subcall function 004062B7: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062BF
Part of subcall function 004062B7: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062CE

Strings

signons.sqlite, xrefs: 0040D884, 0040D89F
logins.json, xrefs: 0040D8E2, 0040D8FD
signons.txt, xrefs: 0040D826, 0040D841
none, xrefs: 0040D991

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen$memset$strcpy$memcpy$CloseFileHandleSize_stricmpfreestrcatstrrchr
String ID: logins.json$none$signons.sqlite$signons.txt
API String ID: 1405107918-3138536805
Opcode ID: dc38bddda9e42b5c5320f9286ff75ddff83acf33bc21f5fa31688107119b79d7
Instruction ID: d07004e2ff50c5cd41ef2cdd6425adcf976a56e41a8fa9a3887142b7f0986be6
Opcode Fuzzy Hash: dc38bddda9e42b5c5320f9286ff75ddff83acf33bc21f5fa31688107119b79d7
Instruction Fuzzy Hash: B051E3B2904145AED714EBE0CC85BDAB7ACAF41305F10057BE159E21C2EB78AAD98B5C

Function 0040BA21 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(/shtml,0041344F,0040BB20,?,00000000,00000000,?,?,?,0040BCA6), ref: 0040BA27
_stricmp.MSVCRT(/sverhtml,0041344F,0040BB20,?,00000000,00000000,?,?,?,0040BCA6), ref: 0040BA3C

Strings

/sverhtml, xrefs: 0040BA37
/scomma, xrefs: 0040BA76
/stab, xrefs: 0040BA61
/sxml, xrefs: 0040BA4C
/stabular, xrefs: 0040BA8B
/skeepass, xrefs: 0040BAA0
/shtml, xrefs: 0040BA22

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 2884411883-1959339147
Opcode ID: b70f27fc5aecc47ba7919a44c3d765b9763ae409b21ddab941f54064ab36d7b0
Instruction ID: 9cc75f2135a457fb5b155108ec4f1482e5c4f70433a9f240ecae405c43e57cbb
Opcode Fuzzy Hash: b70f27fc5aecc47ba7919a44c3d765b9763ae409b21ddab941f54064ab36d7b0
Instruction Fuzzy Hash: 0401DE7238A31128F934A1A63E17BD30A44CBE1B7AF30465BF555E41C1EF9D949094AC

Function 0040F8B4 Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 114stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F8D5
memset.MSVCRT ref: 0040F8E9
memset.MSVCRT ref: 0040F8FD
sprintf.MSVCRT ref: 0040F927
sprintf.MSVCRT ref: 0040F951
strcpy.MSVCRT(?,</font>,?,<font color="%s">,00000000,000000FF,?,?,?,?,?,?,?,?,?,00000006), ref: 0040F962
sprintf.MSVCRT ref: 0040F97D
memset.MSVCRT ref: 0040F9B8
sprintf.MSVCRT ref: 0040F9D3
sprintf.MSVCRT ref: 0040FA07

Part of subcall function 0040F6E2: sprintf.MSVCRT ref: 0040F701

Strings

<table border="1" cellpadding="5"><tr%s>, xrefs: 0040F977
</font>, xrefs: 0040F95C
<th%s>%s%s%s, xrefs: 0040FA01
width="%s", xrefs: 0040F9CD
<font color="%s">, xrefs: 0040F94B
bgcolor="%s", xrefs: 0040F921

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: sprintf$memset$strcpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 898937289-3842416460
Opcode ID: 545e006f70f27d5e232efb2f2e670bdaa3235a9e542d9c48a27740188541449b
Instruction ID: e1dfaf3f0aab17dcf8878a0a22dd94d4c671af1ddc0a59b8f6102d88430d0a7a
Opcode Fuzzy Hash: 545e006f70f27d5e232efb2f2e670bdaa3235a9e542d9c48a27740188541449b
Instruction Fuzzy Hash: F94133B2C4111D6EDB21DA54CD41FEB776CEF54348F0401BBB618E2142E2789F988F69

Function 0040DD59 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(p@,Creds,00000000,00020019,p@,%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd,00000040,?,?,0040E170,?,?,?,?), ref: 0040DD83
memset.MSVCRT ref: 0040DDA1
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0040DDCE
RegQueryValueExA.ADVAPI32(?,ps:password,00000000,?,?,?), ref: 0040DDF7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,?,00000000,000000FF,00000000,00000000), ref: 0040DE70
LocalFree.KERNEL32(00000001), ref: 0040DE83
RegCloseKey.ADVAPI32(?), ref: 0040DE8E
RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040DEA5
RegCloseKey.ADVAPI32(?), ref: 0040DEB6

Strings

Creds, xrefs: 0040DD7B
p@, xrefs: 0040DD6F, 0040DD80, 0040DD72
%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd, xrefs: 0040DD6E
ps:password, xrefs: 0040DDE8

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpen$ByteCharEnumFreeLocalMultiQueryValueWidememset
String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Creds$ps:password$p@
API String ID: 551151806-2386532916
Opcode ID: 802061c58ab3b7a0c699a15447d727f2b4d3045fa72b958aab0169898b6b1aff
Instruction ID: 9b96f835ed6997495325440ed53231f0f0ace883948e60a6f3a7b66043991938
Opcode Fuzzy Hash: 802061c58ab3b7a0c699a15447d727f2b4d3045fa72b958aab0169898b6b1aff
Instruction Fuzzy Hash: 61410676900219AFDB11DFA5DC84EEFBBBCEB48755F0040A6F905E2150DA34AB948B64

Function 0040E74B Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,0040E370), ref: 0040E75E
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA), ref: 0040E777
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040E788
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 0040E799
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040E7AA
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 0040E7BB
FreeLibrary.KERNEL32(00000000), ref: 0040E7DB

Strings

GetModuleInformation, xrefs: 0040E7B5
EnumProcessModules, xrefs: 0040E782
psapi.dll, xrefs: 0040E759
GetModuleFileNameExA, xrefs: 0040E793
EnumProcesses, xrefs: 0040E7A4
GetModuleBaseNameA, xrefs: 0040E771

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
API String ID: 2449869053-232097475
Opcode ID: 84e491b4529d3412f2215207142cb03e9d322bcacbabb572ff9b82cad9202ccb
Instruction ID: 4da247ea616dd2a72ab7006308dc9c89d3535959c96c16615461c58e29f3e28a
Opcode Fuzzy Hash: 84e491b4529d3412f2215207142cb03e9d322bcacbabb572ff9b82cad9202ccb
Instruction Fuzzy Hash: B8012530645211AAC711DB266C81FA73DF99B85B80F15843FF400F2694DB7CC5529A6C

Function 004025C5 Relevance: 22.6, APIs: 3, Strings: 12, Instructions: 127stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040266D

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

strcpy.MSVCRT(?,?,?,?,?,76DBEB20,?,00000000), ref: 004026AB
strcpy.MSVCRT(?,?), ref: 00402768

Strings

H6A, xrefs: 004025F6
SMTP Port, xrefs: 0040263C
SMTP Display Name, xrefs: 004026E0
,6A, xrefs: 004025E8
<6A, xrefs: 004025EF
d6A, xrefs: 00402604
SMTP Server, xrefs: 00402712
T6A, xrefs: 004025FD
6A, xrefs: 00402643
SMTP Email Address, xrefs: 004026F5
p6A, xrefs: 0040260B
47A, xrefs: 00402658

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$QueryValuememset
String ID: ,6A$47A$<6A$H6A$SMTP Display Name$SMTP Email Address$SMTP Port$SMTP Server$T6A$d6A$p6A$6A
API String ID: 3373037483-299461207
Opcode ID: e3f80b658476a1f582484f23fef2e1cdc73789c59224b923ecc992e764de9bf2
Instruction ID: 73c24e987151304ffccade67a91af9495e30ddb8d36a1dc6faba254672d7bb93
Opcode Fuzzy Hash: e3f80b658476a1f582484f23fef2e1cdc73789c59224b923ecc992e764de9bf2
Instruction Fuzzy Hash: 534143B190021CBEDB31DF51CD49ADE7BA8AF04348F50457BF918A7291D3799A88CF98

Function 00410BCE Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 136stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

strlen.MSVCRT ref: 00410BF5
??2@YAPAXI@Z.MSVCRT ref: 00410C05
memset.MSVCRT ref: 00410C51
memset.MSVCRT ref: 00410C6E
strcpy.MSVCRT(?,Software\Microsoft\Windows Live Mail), ref: 00410C9C
RegCloseKey.ADVAPI32(?), ref: 00410CE0
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?), ref: 00410D31
LocalFree.KERNEL32(?), ref: 00410D46
??3@YAXPAX@Z.MSVCRT ref: 00410D4F

Part of subcall function 00406541: strtoul.MSVCRT ref: 00406549

Strings

Software\Microsoft\Windows Live Mail, xrefs: 00410C90
Software\Microsoft\Windows Mail, xrefs: 00410C84
Salt, xrefs: 00410CCA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memsetstrcpy$??2@??3@AddressByteCharCloseFreeLibraryLoadLocalMultiProcWidestrlenstrtoul
String ID: Salt$Software\Microsoft\Windows Live Mail$Software\Microsoft\Windows Mail
API String ID: 1673043434-2687544566
Opcode ID: 9f135b3b16ab4a195e4b1df328d548345a80f904511b1533856c3868a2259044
Instruction ID: 35ff079a9a2d20c7a5c67e942e04d515760747927ccc6212efb4229f933df569
Opcode Fuzzy Hash: 9f135b3b16ab4a195e4b1df328d548345a80f904511b1533856c3868a2259044
Instruction Fuzzy Hash: 94419876D0021DAECB11DBA5DC41ADEBBBCAF48304F0441ABEA45F3241DA74DB85CB68

Function 0040CD82 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

_strnicmp.MSVCRT ref: 0040CDB1
_strnicmp.MSVCRT ref: 0040CDD6
memset.MSVCRT ref: 0040CE1F
memset.MSVCRT ref: 0040CE35
sprintf.MSVCRT ref: 0040CE54
sprintf.MSVCRT ref: 0040CE73
_stricmp.MSVCRT(00000000,00000000), ref: 0040CE92
_stricmp.MSVCRT(00000000,00000000), ref: 0040CEB4

Part of subcall function 0040132A: strlen.MSVCRT ref: 00401337

Strings

imap://, xrefs: 0040CDD0
mailbox://%s@%s, xrefs: 0040CE4E
imap://%s@%s, xrefs: 0040CE6D
mailbox://, xrefs: 0040CDAB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _stricmp_strnicmpmemsetsprintf$strlen
String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
API String ID: 4281260487-2229823034
Opcode ID: 024d07740614e5bd8b0db970560de94806a9e64d99aa777f67af906b6590f4e6
Instruction ID: 2d12b684a12309e3f166330e45fd276d2d431d1b057f0c9926c0b37ed6681b29
Opcode Fuzzy Hash: 024d07740614e5bd8b0db970560de94806a9e64d99aa777f67af906b6590f4e6
Instruction Fuzzy Hash: BE41B172604205DFD724DBA4C9C1F97B7E8AF08304F10467BE649E3281D778E955CB58

Function 0040CD80 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

_strnicmp.MSVCRT ref: 0040CDB1
_strnicmp.MSVCRT ref: 0040CDD6
memset.MSVCRT ref: 0040CE1F
memset.MSVCRT ref: 0040CE35
sprintf.MSVCRT ref: 0040CE54
sprintf.MSVCRT ref: 0040CE73
_stricmp.MSVCRT(00000000,00000000), ref: 0040CE92
_stricmp.MSVCRT(00000000,00000000), ref: 0040CEB4

Strings

imap://, xrefs: 0040CDD0
mailbox://%s@%s, xrefs: 0040CE4E
imap://%s@%s, xrefs: 0040CE6D
mailbox://, xrefs: 0040CDAB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _stricmp_strnicmpmemsetsprintf
String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
API String ID: 2822975062-2229823034
Opcode ID: 0f1e78ed6c62de82fcf3c07d446e549c31a630c2920e6e4e59f58844e705f72b
Instruction ID: b4ee7e9bcea435462912fc28dba82f8fd87397000d83f7605d7513f68c800710
Opcode Fuzzy Hash: 0f1e78ed6c62de82fcf3c07d446e549c31a630c2920e6e4e59f58844e705f72b
Instruction Fuzzy Hash: 0C417E72604205EFD724DBA4C9C1F96B7E8AF18304F00467BE64AE3281D778F995CB98

Function 0040278F Relevance: 21.1, APIs: 3, Strings: 11, Instructions: 117stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00402837

Part of subcall function 00402963: RegQueryValueExA.ADVAPI32(00000400,?,00000000,?,?,?), ref: 00402994

strcpy.MSVCRT(?,?,76DBEB20,?,00000000), ref: 00402871

Part of subcall function 00402963: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 004029C2

strcpy.MSVCRT(?,?,?,?,?,?,?,?,76DBEB20,?,00000000), ref: 0040293C

Part of subcall function 0040F1CA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00402904,?,?,?,?,00402904,?,?), ref: 0040F1E9

Strings

Display Name, xrefs: 004028A2
SMTP Port, xrefs: 00402806, 004028E4
Email, xrefs: 004028B5
<6A, xrefs: 004027D5
SMTP Server, xrefs: 004028CD
H6A, xrefs: 004027DC
48A, xrefs: 00402822
8A, xrefs: 0040281B
t7A, xrefs: 0040279D
7A, xrefs: 004027E3
d6A, xrefs: 004027EA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: QueryValuestrcpy$ByteCharMultiWidememset
String ID: 8A$48A$<6A$Display Name$Email$H6A$SMTP Port$SMTP Server$d6A$t7A$7A
API String ID: 1302727986-2717830028
Opcode ID: 832ecfa302c2265efd1f56203e1d837ddfbcb2d0fb3c2068bcbc5ca0dd018d8a
Instruction ID: 308be4cc5b828d0a3e021f21c5187f9384b0cc6d4098b7245e54e25f5b72303c
Opcode Fuzzy Hash: 832ecfa302c2265efd1f56203e1d837ddfbcb2d0fb3c2068bcbc5ca0dd018d8a
Instruction Fuzzy Hash: D9410BB150024DABCF21EF61DD499DD7BA9FF04309F10816BF92466291D3B99A89CF48

Function 0040820D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 86windowCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 0040822E
LoadMenuA.USER32(?,?), ref: 0040823C

Part of subcall function 00408065: GetMenuItemCount.USER32(?), ref: 0040807A
Part of subcall function 00408065: memset.MSVCRT ref: 0040809B
Part of subcall function 00408065: GetMenuItemInfoA.USER32 ref: 004080D6
Part of subcall function 00408065: strchr.MSVCRT ref: 004080ED

DestroyMenu.USER32(00000000), ref: 0040825A
sprintf.MSVCRT ref: 0040829E
CreateDialogParamA.USER32(?,00000000,00000000,00408208,00000000), ref: 004082B3
memset.MSVCRT ref: 004082CF
GetWindowTextA.USER32(00000000,?,00001000), ref: 004082E0
EnumChildWindows.USER32(00000000,Function_00008155,00000000), ref: 00408308
DestroyWindow.USER32(00000000), ref: 0040830F

Strings

menu_%d, xrefs: 00408224
caption, xrefs: 004082F5
dialog_%d, xrefs: 00408294

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Menu$DestroyItemWindowmemsetsprintf$ChildCountCreateDialogEnumInfoLoadParamTextWindowsstrchr
String ID: caption$dialog_%d$menu_%d
API String ID: 3259144588-3822380221
Opcode ID: b9f33812461a0d5adbc64602c5d7d9a501e96417e2329f7b634c61257a0a3adc
Instruction ID: bbac317cb8ff6209085768228bd9594f53373bc5c39c5be55c638663b0a3ff3e
Opcode Fuzzy Hash: b9f33812461a0d5adbc64602c5d7d9a501e96417e2329f7b634c61257a0a3adc
Instruction Fuzzy Hash: 33210532540148BFDF12AF60DD45EEF3B68EB55706F0440BEFA41A1190DBB99E948B2D

Function 004083E4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(004181B8,00000000,00000000,00000000,?,?,00408515,00000000,?,00000000,00000104,?), ref: 004083FC
strcpy.MSVCRT(004182C0,general,004181B8,00000000,00000000,00000000,?,?,00408515,00000000,?,00000000,00000104,?), ref: 0040840C

Part of subcall function 00407FBF: memset.MSVCRT ref: 00407FE4
Part of subcall function 00407FBF: GetPrivateProfileStringA.KERNEL32(004182C0,00000104,0041344F,?,00001000,004181B8), ref: 00408008
Part of subcall function 00407FBF: WritePrivateProfileStringA.KERNEL32(004182C0,?,?,004181B8), ref: 0040801F

EnumResourceNamesA.KERNEL32(00000104,00000004,0040820D,00000000), ref: 00408442
EnumResourceNamesA.KERNEL32(00000104,00000005,0040820D,00000000), ref: 0040844C
strcpy.MSVCRT(004182C0,strings,?,00408515,00000000,?,00000000,00000104,?), ref: 00408454
memset.MSVCRT ref: 00408470
LoadStringA.USER32(00000104,00000000,?,00001000), ref: 00408484

Part of subcall function 0040802D: _itoa.MSVCRT ref: 0040804E

Strings

O4A, xrefs: 00408411
general, xrefs: 00408401
TranslatorName, xrefs: 00408417
TranslatorURL, xrefs: 00408422
strings, xrefs: 0040844E

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Stringstrcpy$EnumNamesPrivateProfileResourcememset$LoadWrite_itoa
String ID: O4A$TranslatorName$TranslatorURL$general$strings
API String ID: 1060401815-2553245061
Opcode ID: 98af3922fbcbedabf84b8f8c529632f1206592c49a551a07e3fdb0f782d43fb9
Instruction ID: 8ec8ecd25de3f69567fa6951aee80203735b19b36847dd402765e4c6546554b2
Opcode Fuzzy Hash: 98af3922fbcbedabf84b8f8c529632f1206592c49a551a07e3fdb0f782d43fb9
Instruction Fuzzy Hash: 201108319401543AD73167569D0AFDB3E6CDB85B94F1040BFBA48A61C1D9BC59C086BC

Function 0040E6C7 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040E377), ref: 0040E6D6
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040E6EF
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0040E700
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0040E711
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040E722
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040E733

Strings

Module32First, xrefs: 0040E6FA
CreateToolhelp32Snapshot, xrefs: 0040E6E9
Module32Next, xrefs: 0040E70B
Process32First, xrefs: 0040E71C
kernel32.dll, xrefs: 0040E6D1
Process32Next, xrefs: 0040E72D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: f149af1be731cb5c9e085b97aebb5c7a1c1acf09fea30269975c3b4f1367bab0
Instruction ID: 5b748ad6718b7057422386d5a916c05b319ca6e7afffd602bf2aa3a230b78167
Opcode Fuzzy Hash: f149af1be731cb5c9e085b97aebb5c7a1c1acf09fea30269975c3b4f1367bab0
Instruction Fuzzy Hash: E6F086B0AC5306A9E750CB26AD84FAB2DF85B85B81719403BF404F22D4DB7884428B6D

Function 00404651 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004046CC: FreeLibrary.KERNEL32(?,00404659,?,0040DC5F,80000001,76DBEC10), ref: 004046D3

LoadLibraryA.KERNEL32(advapi32.dll,?,0040DC5F,80000001,76DBEC10), ref: 0040465E
GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00404677
GetProcAddress.KERNEL32(?,CredFree), ref: 00404683
GetProcAddress.KERNEL32(?,CredDeleteA), ref: 0040468F
GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040469B
GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004046A7

Strings

CredReadA, xrefs: 00404671
CredDeleteA, xrefs: 00404685
CredEnumerateA, xrefs: 00404691
CredFree, xrefs: 00404679
CredEnumerateW, xrefs: 0040469D
advapi32.dll, xrefs: 00404659

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CredDeleteA$CredEnumerateA$CredEnumerateW$CredFree$CredReadA$advapi32.dll
API String ID: 2449869053-4258758744
Opcode ID: ff4db90ed3477d8874eb02d6fed1133769ac9249bccc171794c849054c12c83c
Instruction ID: ff9940379d8f3ddc00738bb66027861fd390550b24bba25458702abe812256fc
Opcode Fuzzy Hash: ff4db90ed3477d8874eb02d6fed1133769ac9249bccc171794c849054c12c83c
Instruction Fuzzy Hash: 1F012CB0A447019ACB30AF75C809B56BAF4AF94705B218D2EE1C5A36A0E77E9181CF58

Function 004116BE Relevance: 19.7, APIs: 12, Strings: 1, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004116E3

Part of subcall function 00411533: strlen.MSVCRT ref: 00411540

strlen.MSVCRT ref: 004116FF
memset.MSVCRT ref: 00411739
memset.MSVCRT ref: 0041174D
memset.MSVCRT ref: 00411761
memset.MSVCRT ref: 00411787

Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BEDF

Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF0B
Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF21
Part of subcall function 0040BEEC: memcpy.MSVCRT ref: 0040BF58
Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF62

memcpy.MSVCRT ref: 004117BE

Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BE91
Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BEBB

Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF33

memcpy.MSVCRT ref: 004117FA
memcpy.MSVCRT ref: 0041180C
strcpy.MSVCRT(?,?), ref: 004118E3
memcpy.MSVCRT ref: 00411914
memcpy.MSVCRT ref: 00411926

Strings

salu, xrefs: 0041171A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpymemset$strlen$strcpy
String ID: salu
API String ID: 2660478486-4177317985
Opcode ID: ecc3e5fc33f7c09d638776c6de414f29c6625a71b5aa4d45c2c235c3495687e5
Instruction ID: f1a42822f8ef7e9ef4ab6207fa972415b32dae4f069819a41f3cbfc12677ad8b
Opcode Fuzzy Hash: ecc3e5fc33f7c09d638776c6de414f29c6625a71b5aa4d45c2c235c3495687e5
Instruction Fuzzy Hash: 84717E7290011DAACB10EB95CC81ADE77BDFF08348F1445BAF648E7151DB749B888F98

Function 00404292 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100stringCOMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 004042C7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 0040430E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 00404322
strcpy.MSVCRT(?,?), ref: 00404332
strcpy.MSVCRT(?,?,?,?), ref: 00404345
strchr.MSVCRT ref: 00404353
strlen.MSVCRT ref: 00404367
sprintf.MSVCRT ref: 00404388
strchr.MSVCRT ref: 00404399

Strings

www.google.com, xrefs: 004042C1
%s@gmail.com, xrefs: 00404382

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidestrchrstrcpy$sprintfstrlenwcsstr
String ID: %s@gmail.com$www.google.com
API String ID: 1359934567-4070641962
Opcode ID: a3cc65550b97ecd1211b0065db1cf81a5f65b27e49af438170d461af2d2a7879
Instruction ID: 1c9d9e350e6bfb7db098629835421676e34b4d03cf30903a353d84187424ac51
Opcode Fuzzy Hash: a3cc65550b97ecd1211b0065db1cf81a5f65b27e49af438170d461af2d2a7879
Instruction Fuzzy Hash: AE3166B2904219AFDB11DB91DD81FDBB7ACAB14314F1001A7B708E2180D678AF958A98

Function 00403E97 Relevance: 18.1, APIs: 7, Strings: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

memset.MSVCRT ref: 00403ECF
memset.MSVCRT ref: 00403EE3
memset.MSVCRT ref: 00403EF7
sprintf.MSVCRT ref: 00403F18
strcpy.MSVCRT(?,<table dir="rtl"><tr><td>), ref: 00403F34
sprintf.MSVCRT ref: 00403F6B
sprintf.MSVCRT ref: 00403F9C

Strings

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00403EA7
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00403F46
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00403F12
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00403F96
<table dir="rtl"><tr><td>, xrefs: 00403F2E

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memsetsprintf$FileWritestrcpystrlen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1043021993-1670831295
Opcode ID: 163ad70dd9f880e3028995f9713b9bd221414d9478fc282d95e5eed4acd236de
Instruction ID: 99203b830fad9dc7343b4b85adec4cad5e30f503418e1d4ebc977d79dce285bf
Opcode Fuzzy Hash: 163ad70dd9f880e3028995f9713b9bd221414d9478fc282d95e5eed4acd236de
Instruction Fuzzy Hash: F13166B2D00119AEDB54EB95DC41EDF7BACEB08304F1441ABB608E3141DA786FD48B69

Function 00402C1E Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 104registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00402C5E

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

RegCloseKey.ADVAPI32(?), ref: 00402D60

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

memset.MSVCRT ref: 00402CB8
sprintf.MSVCRT ref: 00402CD1
sprintf.MSVCRT ref: 00402D0F

Part of subcall function 00402B92: memset.MSVCRT ref: 00402BB2
Part of subcall function 00402B92: RegCloseKey.ADVAPI32 ref: 00402C16

Strings

Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00402CBD
Identities, xrefs: 00402C2C
%s\%s, xrefs: 00402C80, 00402CCF, 00402D0D
Username, xrefs: 00402C91
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00402CFB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Closememset$sprintf$EnumOpen
String ID: %s\%s$Identities$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Username
API String ID: 1831126014-3814494228
Opcode ID: aa5e6b6edcfc89fa36e6c73b68bb675aec0b52e4a9a4f07f5dc5d81ecae78039
Instruction ID: 6132c75c80fc905e8fcbbac6237d45e27d646b3e48d82405447337ab985425ff
Opcode Fuzzy Hash: aa5e6b6edcfc89fa36e6c73b68bb675aec0b52e4a9a4f07f5dc5d81ecae78039
Instruction Fuzzy Hash: 66314072D0011DBADB21EA91CD42EEF7B7CAF18345F0404BABA14F2091E7B49F888B54

Function 0040F44C Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(?,Common Programs,0040F56A,?,?,?,?,?,00000104), ref: 0040F4BF

Strings

Programs, xrefs: 0040F485
Startup, xrefs: 0040F477
Common Desktop, xrefs: 0040F4AB
Common Startup, xrefs: 0040F4B2
Start Menu, xrefs: 0040F470
AppData, xrefs: 0040F4A4
Common Programs, xrefs: 0040F4B9
Favorites, xrefs: 0040F47E
Common Start Menu, xrefs: 0040F48C
Desktop, xrefs: 0040F469

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy
String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
API String ID: 3177657795-318151290
Opcode ID: 46c502567c8f6af6d591b013d3d66ac45f3f8eb4ada5af74b17da760bd137375
Instruction ID: 3fcc29bccd1c625ad2997487a879199120d1d943b4c0761a6650e27991626466
Opcode Fuzzy Hash: 46c502567c8f6af6d591b013d3d66ac45f3f8eb4ada5af74b17da760bd137375
Instruction Fuzzy Hash: B9F01D732BEE0A60D43405681F06EF70402A0F17553BA86336D42F5ED6E9BC888E60AF

Function 00402F9C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 106registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00402FDF

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

memset.MSVCRT ref: 0040302C
sprintf.MSVCRT ref: 00403044
memset.MSVCRT ref: 00403075
RegCloseKey.ADVAPI32(?), ref: 004030BD
RegCloseKey.ADVAPI32(?), ref: 004030E6

Strings

Identity, xrefs: 00403005
%s\Accounts, xrefs: 0040303E
Software\IncrediMail\Identities, xrefs: 00402FAD

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$Close$EnumOpensprintf
String ID: %s\Accounts$Identity$Software\IncrediMail\Identities
API String ID: 3672803090-3168940695
Opcode ID: addba139fb98e70511efbef10407b33c160fff4cc1ef44c40a88e0207086654e
Instruction ID: 768b3681e431995c61ece500f3f0ca2292d3b8ebaed2eb0df27a6a0be2325633
Opcode Fuzzy Hash: addba139fb98e70511efbef10407b33c160fff4cc1ef44c40a88e0207086654e
Instruction Fuzzy Hash: 27316FB680020DBFDB21EB51CC81EEE7B7CAF14344F0041B6B908A1151E7799F989F65

Function 00407BCE Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00407BE4
memset.MSVCRT ref: 00407C08
GetMenuItemInfoA.USER32(?), ref: 00407C3E
memset.MSVCRT ref: 00407C6B
strchr.MSVCRT ref: 00407C77
strcat.MSVCRT(?,?,?,?,?,00000001,?), ref: 00407CD2
ModifyMenuA.USER32(?,?,00000400,?,?), ref: 00407CEE

Strings

6, xrefs: 00407C2E
0, xrefs: 00407C23

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Menu$Itemmemset$CountInfoModifystrcatstrchr
String ID: 0$6
API String ID: 1757351179-3849865405
Opcode ID: 73707a8628dff62054be0cff24737c74d30dd99fa2063f5b1cd38ec135dfdae5
Instruction ID: b54eda8ed3125ae11668051ec90bd02c66b6cc1d7fa6bc8d4742b266666783d1
Opcode Fuzzy Hash: 73707a8628dff62054be0cff24737c74d30dd99fa2063f5b1cd38ec135dfdae5
Instruction Fuzzy Hash: 01319E7280C384AFD7209F55D84099BBBE9FF88354F14893EF59492250D379EA44CB6B

Function 0040EFF9 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

UuidFromStringA.RPCRT4(220D5CD0-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040F016
UuidFromStringA.RPCRT4(220D5CC1-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040F02A
UuidFromStringA.RPCRT4(417E2D75-84BD-11D0-84BB-00C04FD43F8F,?), ref: 0040F037
memcpy.MSVCRT ref: 0040F075
CoTaskMemFree.OLE32(00000000,00000000), ref: 0040F084

Strings

220D5CD1-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040F01E
417E2D75-84BD-11D0-84BB-00C04FD43F8F, xrefs: 0040F032
220D5CC1-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040F025
220D5CD0-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040F011

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FromStringUuid$FreeTaskmemcpy
String ID: 220D5CC1-853A-11D0-84BC-00C04FD43F8F$220D5CD0-853A-11D0-84BC-00C04FD43F8F$220D5CD1-853A-11D0-84BC-00C04FD43F8F$417E2D75-84BD-11D0-84BB-00C04FD43F8F
API String ID: 1640410171-2022683286
Opcode ID: 306f86b72c68b079481adfe80e36191d94f41cc5e7972a1d9b17c61a3779c37b
Instruction ID: b02d4c6ee9d97a63d35e72255114f680a0148db4ebcc5a4c1265e43ba903851c
Opcode Fuzzy Hash: 306f86b72c68b079481adfe80e36191d94f41cc5e7972a1d9b17c61a3779c37b
Instruction Fuzzy Hash: 8C115B7251012EAACB21EEA4DD40EFB37ECAB48354F050537FD41E3241EA74E9598BA9

Function 00404841 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(comctl32.dll,76F90A60,?,00000000,?,?,?,0040BBA9,76F90A60), ref: 00404860
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404872
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040BBA9,76F90A60), ref: 00404886
#17.COMCTL32(?,00000000,?,?,?,0040BBA9,76F90A60), ref: 00404894
MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004048B1

Strings

Error, xrefs: 004048A6
InitCommonControlsEx, xrefs: 0040486C
comctl32.dll, xrefs: 00404849
Error: Cannot load the common control classes., xrefs: 004048AB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 940705af2692cc549680cf39e92a457a0a1a918f96250f5e84b40193c3ae60b2
Instruction ID: fc2202cf77027b42572104eeb985269ec1b891a521d9ed4889cd7b549b4d3d81
Opcode Fuzzy Hash: 940705af2692cc549680cf39e92a457a0a1a918f96250f5e84b40193c3ae60b2
Instruction Fuzzy Hash: E001D6767906527BD7116FA09C4ABAF7EECDB85B4BB008435F602F1180EA78DE02825C

Function 0040E507 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(nss3.dll,76F91620,?,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E516
GetModuleHandleA.KERNEL32(sqlite3.dll,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E51F
GetModuleHandleA.KERNEL32(mozsqlite3.dll,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E528
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E537
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E53E
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E545

Strings

mozsqlite3.dll, xrefs: 0040E521
sqlite3.dll, xrefs: 0040E518
nss3.dll, xrefs: 0040E511

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeHandleLibraryModule
String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
API String ID: 662261464-3550686275
Opcode ID: fe51f0db63daddba42dea8e840232ed32905c986888f9edcd6f5ba4196e89d7d
Instruction ID: d135409c02d172e6769d1cedb18aaef1940c31153c91c0802dc404148c0ad013
Opcode Fuzzy Hash: fe51f0db63daddba42dea8e840232ed32905c986888f9edcd6f5ba4196e89d7d
Instruction Fuzzy Hash: 31E048E6B4133D7689106AF65C44DBBAE5CC885AE63150877AD0473284EEA99D0186F8

Function 0040E7E3 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0040E7FB
strcpy.MSVCRT(?,-00000001), ref: 0040E809

Part of subcall function 00406A01: strlen.MSVCRT ref: 00406A13
Part of subcall function 00406A01: strlen.MSVCRT ref: 00406A1B
Part of subcall function 00406A01: _memicmp.MSVCRT ref: 00406A39

strcpy.MSVCRT(?,00000000,00000000,?,00000000,00000104,00000104), ref: 0040E859
strcat.MSVCRT(?,0000000B,?,00000000,00000000,?,00000000,00000104,00000104), ref: 0040E864
memset.MSVCRT ref: 0040E840

Part of subcall function 0040632F: GetWindowsDirectoryA.KERNEL32(00418550,00000104,?,0040E899,00000000,?,00000000,00000104,00000104), ref: 00406344
Part of subcall function 0040632F: strcpy.MSVCRT(00000000,00418550,?,0040E899,00000000,?,00000000,00000104,00000104), ref: 00406354

memset.MSVCRT ref: 0040E888
memcpy.MSVCRT ref: 0040E8A3
strcat.MSVCRT(?,?,?,00000000,00000002,00000000,?,00000000,00000104,00000104), ref: 0040E8AE

Strings

\systemroot, xrefs: 0040E816

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$memsetstrcatstrlen$DirectoryWindows_memicmpmemcpystrchr
String ID: \systemroot
API String ID: 1680921474-1821301763
Opcode ID: 02667478e699fd8b6f8ab7646ffc34296b77eb49769005efd8499c912f113c78
Instruction ID: 059b6355fafdf26fa7c647f60efba09ddadb95c968e3db809f61c631ea6cdf1b
Opcode Fuzzy Hash: 02667478e699fd8b6f8ab7646ffc34296b77eb49769005efd8499c912f113c78
Instruction Fuzzy Hash: D321DA725082446DF764B2628D82FEB66EC5B19344F10446FF685E10C1EAFC99D4862A

Function 00405BEE Relevance: 15.1, APIs: 10, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00405C05
GetWindow.USER32(?,00000005), ref: 00405C1D
GetWindow.USER32(00000000), ref: 00405C20

Part of subcall function 00401601: GetWindowRect.USER32(?,?), ref: 00401610
Part of subcall function 00401601: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040162B

GetWindow.USER32(00000000,00000002), ref: 00405C2C
GetDlgItem.USER32(?,000003ED), ref: 00405C43
GetDlgItem.USER32(?,00000000), ref: 00405C55
GetDlgItem.USER32(?,00000000), ref: 00405C67
GetDlgItem.USER32(?,00000000), ref: 00405C79
GetDlgItem.USER32(?,000003ED), ref: 00405C87
SetFocus.USER32(00000000), ref: 00405C8A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ItemWindow$Rect$ClientFocusPoints
String ID:
API String ID: 2187283481-0
Opcode ID: 969ea17bacca8ef9e6374e910937896070187056b77a04c01a0c72c457c00c9d
Instruction ID: 70b7e768433fb03072553d07e5bd29f06e019e0bb4b5ab736e3f65cd75bfe615
Opcode Fuzzy Hash: 969ea17bacca8ef9e6374e910937896070187056b77a04c01a0c72c457c00c9d
Instruction Fuzzy Hash: 09118271500304ABDB216F31CC89E5BBFADEF81715F05883AB444AB1A1CB7DD8018B28

Function 00401A0F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 195stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00401A1B
abs.MSVCRT ref: 00401B1B
abs.MSVCRT ref: 00401B52
log.MSVCRT ref: 00401C01
log.MSVCRT ref: 00401C13
free.MSVCRT(?), ref: 00401C34
free.MSVCRT(?), ref: 00401C48

Strings

, xrefs: 00401A49

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: free$strlen
String ID:
API String ID: 667451143-3916222277
Opcode ID: 7a809be14f52c1f887290bc30d232d0c6e85be01131ef0d930cbf3d7057dc0fb
Instruction ID: 0a6132ce2dc9cc3df9a7f1a3dcc42749ccde8b25e91b24a7214be5fd0ed86434
Opcode Fuzzy Hash: 7a809be14f52c1f887290bc30d232d0c6e85be01131ef0d930cbf3d7057dc0fb
Instruction Fuzzy Hash: A7619A30409781DFDB209F25848006BBBF1FB89315F909D7FF5D5A22A1E739A846CB0A

Function 004077C5 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00404651: LoadLibraryA.KERNEL32(advapi32.dll,?,0040DC5F,80000001,76DBEC10), ref: 0040465E
Part of subcall function 00404651: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00404677
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredFree), ref: 00404683
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 0040468F
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040469B
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004046A7

wcslen.MSVCRT ref: 0040782F
wcsncmp.MSVCRT(?,?,?), ref: 00407873
memset.MSVCRT ref: 00407907
memcpy.MSVCRT ref: 0040792B
wcschr.MSVCRT ref: 0040797F
LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 004079A9

Part of subcall function 004047FB: FreeLibrary.KERNELBASE(?,?), ref: 00404810

Strings

J, xrefs: 004078AD
Microsoft_WinInet, xrefs: 00407823

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$FreeLibrary$LoadLocalmemcpymemsetwcschrwcslenwcsncmp
String ID: J$Microsoft_WinInet
API String ID: 2413121283-260894208
Opcode ID: 529401139110fed122d62a817e927cb3e1e20bce95576607e3b03d187f40e0ba
Instruction ID: 0e9b9eaeb9102773f5efe30ff018f7355b1463afce593653dd7f5536c2c1a2ca
Opcode Fuzzy Hash: 529401139110fed122d62a817e927cb3e1e20bce95576607e3b03d187f40e0ba
Instruction Fuzzy Hash: 5E51E3B1A083469FD710DF65C880A9BB7E8BF89304F00492EF999D3250E778E955CB97

Function 004055A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 126windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004055C0
SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 004055D9
SendMessageA.USER32(?,00001036,00000000,00000026), ref: 004055E6
SendMessageA.USER32(?,0000101C,00000000,00000000), ref: 004055F2
memset.MSVCRT ref: 0040565C
SendMessageA.USER32(?,00001019,?,?), ref: 0040568D
SetFocus.USER32(?), ref: 00405712

Strings

O4A, xrefs: 00405602

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSend$FocusItemmemset
String ID: O4A
API String ID: 4281309102-1047957790
Opcode ID: f40dfee95efd54d32f2af3622bff62bd61e387c9aa4c7d82b7cdafa9f0be41ac
Instruction ID: 7cc6a8daf3229b7d8e0d7717536759f0385f0427a9067e31b35bb84d252c6e93
Opcode Fuzzy Hash: f40dfee95efd54d32f2af3622bff62bd61e387c9aa4c7d82b7cdafa9f0be41ac
Instruction Fuzzy Hash: 3D414BB5D00109BFDB209F98DC85DAEBBB9EF04358F00846AE914B7291D7759E50CF94

Function 0040DB04 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Password.NET Messenger Service,00000000,00000000,?,?,80000001,76DBEC10), ref: 0040DB33
RegQueryValueExA.ADVAPI32(?,User.NET Messenger Service,00000000,00000000,?,?), ref: 0040DC08

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

memcpy.MSVCRT ref: 0040DBA4
LocalFree.KERNEL32(?,?,00000000,?), ref: 0040DBB6
RegCloseKey.ADVAPI32(?), ref: 0040DC2A

Strings

User.NET Messenger Service, xrefs: 0040DBFE
Password.NET Messenger Service, xrefs: 0040DB21
, xrefs: 0040DB4B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: QueryValue$AddressCloseFreeLibraryLoadLocalProcmemcpystrcpy
String ID: $Password.NET Messenger Service$User.NET Messenger Service
API String ID: 3289975857-105384665
Opcode ID: eb632091883fd6e530ae975b2f8be387ac57602a28e3de930a5c8a5ebe1e7b21
Instruction ID: 0f5ec9c9176e8b350c57746001926e44edf78976103d06fec131b918f38f0bed
Opcode Fuzzy Hash: eb632091883fd6e530ae975b2f8be387ac57602a28e3de930a5c8a5ebe1e7b21
Instruction Fuzzy Hash: 02315871D01219AFCB21DFA1CC44BDEBBB8AF49314F1040B6E505B7290D6789B88DB98

Function 00405E50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52stringlibrarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,00405F6F,?,?), ref: 00405E75
FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,?,00000000,?,?,00405F6F,?,?), ref: 00405E93
strlen.MSVCRT ref: 00405EA0
strcpy.MSVCRT(?,?,?,?,00405F6F,?,?), ref: 00405EB0
LocalFree.KERNEL32(?,?,?,00405F6F,?,?), ref: 00405EBA
strcpy.MSVCRT(?,Unknown Error,?,?,00405F6F,?,?), ref: 00405ECA

Strings

Unknown Error, xrefs: 00405EC2
netmsg.dll, xrefs: 00405E70

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$FormatFreeLibraryLoadLocalMessagestrlen
String ID: Unknown Error$netmsg.dll
API String ID: 3198317522-572158859
Opcode ID: 5f56a8b7da271a810a769b22d2f728ab30919581b98e2cd5870482cf17005fbc
Instruction ID: ee7e3b4bfe4f381a5a8dca6b6b4a58a66687d49b648cda9812902ba604a22f70
Opcode Fuzzy Hash: 5f56a8b7da271a810a769b22d2f728ab30919581b98e2cd5870482cf17005fbc
Instruction Fuzzy Hash: DC01D432604214BEEB245B61DC46EDF7E68EB09796B20403AF602B41D0DA759F40DADC

Function 0040831F Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406155: GetFileAttributesA.KERNELBASE(?,00408328,?,004083DE,00000000,?,00000000,00000104,?), ref: 00406159

strcpy.MSVCRT(004181B8,00000000,00000000,00000000,004083DE,00000000,?,00000000,00000104,?), ref: 00408339
strcpy.MSVCRT(004182C0,general,004181B8,00000000,00000000,00000000,004083DE,00000000,?,00000000,00000104,?), ref: 00408349
GetPrivateProfileIntA.KERNEL32(004182C0,rtl,00000000,004181B8), ref: 0040835A

Part of subcall function 00407F2B: GetPrivateProfileStringA.KERNEL32(004182C0,?,0041344F,00418308,?,004181B8), ref: 00407F46

Strings

general, xrefs: 0040833E
TranslatorName, xrefs: 0040837E
TranslatorURL, xrefs: 00408392
rtl, xrefs: 00408354
charset, xrefs: 00408368

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PrivateProfilestrcpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 185930432-2039793938
Opcode ID: 096529db9ad1171b6712faedd0256edc65327acc83deb5f5860257c904a951f2
Instruction ID: 927989a77509199662194d441518c64dc34f1856eccff2a3d84bf87df20cc289
Opcode Fuzzy Hash: 096529db9ad1171b6712faedd0256edc65327acc83deb5f5860257c904a951f2
Instruction Fuzzy Hash: 00F0C232EC421539C62036615C07FEA3A148BE2F10F08447FBD04B61C2EA7D49D1815E

Function 004088C6 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086E8
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086F6
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408707
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 0040871E
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408727

??2@YAPAXI@Z.MSVCRT ref: 004088FD
??2@YAPAXI@Z.MSVCRT ref: 00408919
memcpy.MSVCRT ref: 00408941
memcpy.MSVCRT ref: 0040895E
??2@YAPAXI@Z.MSVCRT ref: 004089E7
??2@YAPAXI@Z.MSVCRT ref: 004089F1
??2@YAPAXI@Z.MSVCRT ref: 00408A29

Part of subcall function 00407A69: LoadStringA.USER32(00000000,0000000D,00000FFF,?), ref: 00407B32
Part of subcall function 00407A69: memcpy.MSVCRT ref: 00407B71

Part of subcall function 00407A69: strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,76F90A60), ref: 00407AE4
Part of subcall function 00407A69: strlen.MSVCRT ref: 00407B02

Strings

xA, xrefs: 0040892A, 00408937
d, xrefs: 00408A08

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@??3@$memcpy$LoadStringstrcpystrlen
String ID: d$xA
API String ID: 3781940870-3129348561
Opcode ID: a9e448af71377d593719d1af80ff4ac58293a826cf4ccc803acad48c6db5bab3
Instruction ID: 74bd4705b90376de5a47ec474c9ee228b959cea471a61b54eb6c1cdd4b9bc2c0
Opcode Fuzzy Hash: a9e448af71377d593719d1af80ff4ac58293a826cf4ccc803acad48c6db5bab3
Instruction Fuzzy Hash: 62515C71A01704AFD724DF39C58179ABBE4EF48354F10852EE59ADB381DB74A941CF44

Function 00403127 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 100stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004030F9: GetPrivateProfileStringA.KERNEL32(00000000,?,0041344F,?,?,?), ref: 0040311D

strchr.MSVCRT ref: 0040323C

Strings

1, xrefs: 0040316A
UsesIMAP, xrefs: 00403149
RealName, xrefs: 004031BB
PopServer, xrefs: 00403189
ReturnAddress, xrefs: 004031D4
SavePasswordText, xrefs: 004031EC
LoginName, xrefs: 004031A5
PopAccount, xrefs: 00403227

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PrivateProfileStringstrchr
String ID: 1$LoginName$PopAccount$PopServer$RealName$ReturnAddress$SavePasswordText$UsesIMAP
API String ID: 1348940319-1729847305
Opcode ID: 4f3761682ac34aea950079ee6e15d32a83a9ea860df6d03b5968914b8edab4df
Instruction ID: 730259ebfdc93430ac8a7640b0a1394381beeb8186f258e339b1e1584fb818e0
Opcode Fuzzy Hash: 4f3761682ac34aea950079ee6e15d32a83a9ea860df6d03b5968914b8edab4df
Instruction Fuzzy Hash: FF31917150420ABEEF219F60CC06FD97F6CAF10359F10806AF558761D2CBB9AB949B54

Function 0040F70E Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0040F73E
memcpy.MSVCRT ref: 0040F764
memcpy.MSVCRT ref: 0040F77C

Strings

&, xrefs: 0040F75E
°, xrefs: 0040F751
<, xrefs: 0040F71F
<br>, xrefs: 0040F776
>, xrefs: 0040F72B
", xrefs: 0040F738

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 91506a718b00cdec2e45e1457c491db783313ed82e55890756c6f05279fb0cf7
Instruction ID: b4a8218c7fa3979214449631b2efcde822773b41d0541f29ded2a506b887ed0e
Opcode Fuzzy Hash: 91506a718b00cdec2e45e1457c491db783313ed82e55890756c6f05279fb0cf7
Instruction Fuzzy Hash: FF01DFB2EC465025DA7100092C86FE70A494BFAB11FB50137F98533AC4E0AD0CCF829F

Function 0040DEC3 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00406282: GetVersionExA.KERNEL32(00418118,0000001A,0040F4E8,00000104), ref: 0040629C

memset.MSVCRT ref: 0040DF75
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,?,?), ref: 0040DF8C
_strnicmp.MSVCRT ref: 0040DFA6
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,?,?,?,?,?), ref: 0040DFD2
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?,?,?,?), ref: 0040DFF2

Strings

WindowsLive:name=*, xrefs: 0040DEEA, 0040DF21
windowslive:name=, xrefs: 0040DFA0

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Version_strnicmpmemset
String ID: WindowsLive:name=*$windowslive:name=
API String ID: 945165440-3589380929
Opcode ID: 30eab080ff57603f0c83065378de1aa9d50d3c7817c6219040755b9d083dbe28
Instruction ID: faca0abe0adb4f8b424a3cc142a11908341e250f8e36283e96c9ece6c5c035f0
Opcode Fuzzy Hash: 30eab080ff57603f0c83065378de1aa9d50d3c7817c6219040755b9d083dbe28
Instruction Fuzzy Hash: 14419FB1508345AFC320DF15D8848ABBBECEB84344F00493EF999A2291D734ED48CB66

Function 00411133 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00411146
??2@YAPAXI@Z.MSVCRT ref: 0041114F
WideCharToMultiByte.KERNEL32(00000000,00000000,004112D5,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,004112D5,?,00000000,0041141B), ref: 00411168

Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104C3
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104E1
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104FC
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 00410525
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 00410549

strlen.MSVCRT ref: 004111AB

Part of subcall function 0041061F: ??3@YAXPAX@Z.MSVCRT ref: 0041062A
Part of subcall function 0041061F: ??2@YAPAXI@Z.MSVCRT ref: 00410639

memcpy.MSVCRT ref: 004111C5
??3@YAXPAX@Z.MSVCRT ref: 00411258

Strings

<UA, xrefs: 0041117F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$??3@$ByteCharMultiWidememcpystrlenwcslen
String ID: <UA
API String ID: 577244452-338107889
Opcode ID: f2f762125e1423e49e6bcb13a5991785930390a1f9f2de13f6984d67d91fd659
Instruction ID: 068040a7654b3252a10ead66c722fc8ae16d1693d490f738ed846916017eff7d
Opcode Fuzzy Hash: f2f762125e1423e49e6bcb13a5991785930390a1f9f2de13f6984d67d91fd659
Instruction Fuzzy Hash: 21314472D04219ABCF21EF65C8809DDBBB5AF49314F0481AAE608A3251CB396FD5CF59

Function 00408155 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040817B
GetDlgCtrlID.USER32(?), ref: 00408186
GetWindowTextA.USER32(?,?,00001000), ref: 00408199
memset.MSVCRT ref: 004081BF
GetClassNameA.USER32(?,?,000000FF), ref: 004081D2
_stricmp.MSVCRT(?,sysdatetimepick32), ref: 004081E4

Part of subcall function 0040802D: _itoa.MSVCRT ref: 0040804E

Strings

sysdatetimepick32, xrefs: 004081DE

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$ClassCtrlNameTextWindow_itoa_stricmp
String ID: sysdatetimepick32
API String ID: 896699463-4169760276
Opcode ID: a7e83458ae8ab176729b938156b1736a97d8aa9ca8d765e96f30c653e7aaea31
Instruction ID: 8ec491919e3a594e32bcc0b3aeb202d37a515ee6f0006301200e52d8450d0196
Opcode Fuzzy Hash: a7e83458ae8ab176729b938156b1736a97d8aa9ca8d765e96f30c653e7aaea31
Instruction Fuzzy Hash: 2311EC7280511C7EE7119B54DD41EEB7BACEF19355F0400BBFA44E2152EA789FC48B68

Function 0040571F Relevance: 12.2, APIs: 8, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004057C7
GetDlgItem.USER32(?,000003E9), ref: 004057DA
GetDlgItem.USER32(?,000003E9), ref: 004057EF
GetDlgItem.USER32(?,000003E9), ref: 00405807
EndDialog.USER32(?,00000002), ref: 00405823
EndDialog.USER32(?,00000001), ref: 00405836

Part of subcall function 004054D0: GetDlgItem.USER32(?,000003E9), ref: 004054DE
Part of subcall function 004054D0: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 004054F3
Part of subcall function 004054D0: SendMessageA.USER32(?,00001032,00000000,00000000), ref: 0040550F

SendDlgItemMessageA.USER32(?,000003ED,000000C5,00000003,00000000), ref: 0040584E
SetDlgItemInt.USER32(?,000003ED,?,00000000), ref: 0040595A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Item$DialogMessageSend
String ID:
API String ID: 2485852401-0
Opcode ID: f7827bcec6ef5800e0abba1fd027fbe4bcd8fe50388742f33dd21846a4c000d1
Instruction ID: 327bdf07108b1d48d13abdf232bd1ccce71b7be96730af3de4981d1ea2c32abc
Opcode Fuzzy Hash: f7827bcec6ef5800e0abba1fd027fbe4bcd8fe50388742f33dd21846a4c000d1
Instruction Fuzzy Hash: 6561C031600A05AFDB25BF25C886A2BB3A5FF40725F00C23EF915A72D1D778A960CF49

Function 0040596A Relevance: 12.1, APIs: 8, Instructions: 103windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040597B
??3@YAXPAX@Z.MSVCRT ref: 00405997
??2@YAPAXI@Z.MSVCRT ref: 004059BE
memset.MSVCRT ref: 004059CF
??2@YAPAXI@Z.MSVCRT ref: 004059FE
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 00405A4B
SetFocus.USER32(?,?,?,?), ref: 00405A54
??3@YAXPAX@Z.MSVCRT ref: 00405A62

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: 1c45e02bf6d6e0acd6632af5bc3a0aaa414ad192b3bff06ac025739c61ab6296
Instruction ID: c9d5e52e17e49b2fdf2665c470f327c4663aeb176fcf1135955ad165868745cd
Opcode Fuzzy Hash: 1c45e02bf6d6e0acd6632af5bc3a0aaa414ad192b3bff06ac025739c61ab6296
Instruction Fuzzy Hash: 113183B2600601AFDB249F79D985A2AF7A4FB08354710863FF55AD7290DB78AC50CF58

Function 0040649B Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000011), ref: 004064AC
GetSystemMetrics.USER32(00000010), ref: 004064B2
GetDC.USER32(00000000), ref: 004064C0
GetDeviceCaps.GDI32(00000000,00000008), ref: 004064D2
GetDeviceCaps.GDI32(004012E4,0000000A), ref: 004064DB
ReleaseDC.USER32(00000000,004012E4), ref: 004064E4
GetWindowRect.USER32(004012E4,?), ref: 004064F1
MoveWindow.USER32(004012E4,?,?,?,?,00000001,?,?,?,?,?,?,004012E4,?), ref: 00406536

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CapsDeviceMetricsSystemWindow$MoveRectRelease
String ID:
API String ID: 1999381814-0
Opcode ID: 49d5a035e180b7af43cac72741eab6a6786db33261f0c5654e3a6ca50601d200
Instruction ID: ba7d715333d017d2103329686637bd52cca5eef1020c3fd7483cce7c10731540
Opcode Fuzzy Hash: 49d5a035e180b7af43cac72741eab6a6786db33261f0c5654e3a6ca50601d200
Instruction Fuzzy Hash: 1011A232A00219AFDF109FB8DC09BEF7FB9EB44351F054135EE06E3290DA70A9418A90

Function 0040B21F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 162windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 0040B258
SetFocus.USER32(?,?,?), ref: 0040B2FE
InvalidateRect.USER32(?,00000000,00000000), ref: 0040B3FB

Strings

84A, xrefs: 0040B2D1
(@A, xrefs: 0040B424
pEA, xrefs: 0040B304

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DestroyFocusInvalidateRectWindow
String ID: (@A$84A$pEA
API String ID: 3502187192-3946309182
Opcode ID: fa249e53f08e412b2de4fab2e63f274f7ae9770adcde098fbc7ff8254fc117ce
Instruction ID: b7bc1b810a9c946c48dae79992a2e7083b23304991c1a6466db7751271d6d75f
Opcode Fuzzy Hash: fa249e53f08e412b2de4fab2e63f274f7ae9770adcde098fbc7ff8254fc117ce
Instruction Fuzzy Hash: B75186306047019BCB20BF658845E9AB3E5FF50724F54C53FF8696B2E2C7799A818B8D

Function 0040C70B Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C72C
memset.MSVCRT ref: 0040C740
memset.MSVCRT ref: 0040C754

Part of subcall function 00406A01: strlen.MSVCRT ref: 00406A13
Part of subcall function 00406A01: strlen.MSVCRT ref: 00406A1B
Part of subcall function 00406A01: _memicmp.MSVCRT ref: 00406A39

memcpy.MSVCRT ref: 0040C821
memcpy.MSVCRT ref: 0040C864
memcpy.MSVCRT ref: 0040C881

Strings

user_pref(", xrefs: 0040C78A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpymemset$strlen$_memicmp
String ID: user_pref("
API String ID: 765841271-2487180061
Opcode ID: b6f81e50d3f8e97912bf56328f9eb2e236efc4b8b3b87e64c123cb08f78c772a
Instruction ID: c71e9d7c33fd880144b5893e014edb1d15ca38a86f0d2a268660e68eb467e50f
Opcode Fuzzy Hash: b6f81e50d3f8e97912bf56328f9eb2e236efc4b8b3b87e64c123cb08f78c772a
Instruction Fuzzy Hash: 134168769041199ADB14EB95DCC0EDA77AC9F44314F1083BBE605F7181EA389F49CF68

Function 00407A69 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,76F90A60), ref: 00407AE4

Part of subcall function 00407EF3: _itoa.MSVCRT ref: 00407F14

strlen.MSVCRT ref: 00407B02
LoadStringA.USER32(00000000,0000000D,00000FFF,?), ref: 00407B32
memcpy.MSVCRT ref: 00407B71

Part of subcall function 004079E7: ??2@YAPAXI@Z.MSVCRT ref: 00407A0F
Part of subcall function 004079E7: ??2@YAPAXI@Z.MSVCRT ref: 00407A2D
Part of subcall function 004079E7: ??2@YAPAXI@Z.MSVCRT ref: 00407A4B
Part of subcall function 004079E7: ??2@YAPAXI@Z.MSVCRT ref: 00407A5B

Strings

strings, xrefs: 00407ADA
O4A, xrefs: 00407BB3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$LoadString_itoamemcpystrcpystrlen
String ID: O4A$strings
API String ID: 1748916193-3524047076
Opcode ID: 6e661332ea860a5f04e72777378fa8c32be9495fca781d8f2a47ed500e910e65
Instruction ID: 4e35bd01ad2207757dd6e5c19dba2cefa7e6d732e740aa6e4bc5455c9760af59
Opcode Fuzzy Hash: 6e661332ea860a5f04e72777378fa8c32be9495fca781d8f2a47ed500e910e65
Instruction Fuzzy Hash: BA315771A08101AFD7159B58ED80DA63777E744348750807EEC01A72A2DF39BD81CF5E

Function 004071D6 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004071F7

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

WideCharToMultiByte.KERNEL32(00000000,00000000,?,0040738B,?,000000FD,00000000,00000000,?,00000000,0040738B,?,?,?,?,00000000), ref: 00407292
LocalFree.KERNEL32(?,?,?,?,?,00000000,76DBEB20,?), ref: 004072A2

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

Strings

POP3_host, xrefs: 004072CA
POP3_credentials, xrefs: 00407207
POP3_name, xrefs: 004072AF

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: QueryValue$AddressByteCharFreeLibraryLoadLocalMultiProcWidememcpymemsetstrcpystrlen
String ID: POP3_credentials$POP3_host$POP3_name
API String ID: 604216836-2190619648
Opcode ID: ad9c5c80b0256c337c12dec900ec01b57eb9c2969be2bde46c98a81af137ee1a
Instruction ID: 7a8ee4d7bc4178ad58e78f2f27b608862355488638afca077fa6fa925b8dfb39
Opcode Fuzzy Hash: ad9c5c80b0256c337c12dec900ec01b57eb9c2969be2bde46c98a81af137ee1a
Instruction Fuzzy Hash: D8315075A4025DAFCB11EB69CC81ADE7BBCEB59344F0080B6FA04B3141D6349F598F65

Function 00408065 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 0040807A
memset.MSVCRT ref: 0040809B
GetMenuItemInfoA.USER32 ref: 004080D6
strchr.MSVCRT ref: 004080ED

Strings

6, xrefs: 004080BE
0, xrefs: 004080B6

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ItemMenu$CountInfomemsetstrchr
String ID: 0$6
API String ID: 2300387033-3849865405
Opcode ID: 7ff34ab211d6860bdd45bd88976f81f6822f66e3605e9fe9da3e2852f2fef4ac
Instruction ID: 51172b8e10bed5c2f97a320ed5cd446e6bfcd9d4694fda0f565c00a2b2434e31
Opcode Fuzzy Hash: 7ff34ab211d6860bdd45bd88976f81f6822f66e3605e9fe9da3e2852f2fef4ac
Instruction Fuzzy Hash: 7821D171108384AFC710CF65C981A9BB7E8FF88348F04453EF6C4AA280DB79D955CB5A

Function 004044E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

_stricmp.MSVCRT(?,pop3,?,?,?,?,?), ref: 00404575
_stricmp.MSVCRT(?,imap), ref: 00404593

Strings

pop3, xrefs: 0040456F
smtp, xrefs: 004045AA
imap, xrefs: 0040458D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _stricmp$memcpystrlen
String ID: imap$pop3$smtp
API String ID: 445763297-821077329
Opcode ID: d315b1c60be8e06bf8a74a29e861cd8fd0a859a3471b1e5e64c4e0a482ae2628
Instruction ID: 5d3aebf2a9f6afee3de7fcc7c39c9e230d3229a718a14b09e3d1f3abdf4e177e
Opcode Fuzzy Hash: d315b1c60be8e06bf8a74a29e861cd8fd0a859a3471b1e5e64c4e0a482ae2628
Instruction Fuzzy Hash: 842151B3500318AFD711DB61CD42BDAB7F8AF54304F10056BE649B3181DB787B858B95

Function 004036A6 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040EF77: UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0040EF8E
Part of subcall function 0040EF77: UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 0040EF9B
Part of subcall function 0040EF77: memcpy.MSVCRT ref: 0040EFD7
Part of subcall function 0040EF77: CoTaskMemFree.OLE32(?,?), ref: 0040EFE6

strchr.MSVCRT ref: 004036E0
strcpy.MSVCRT(?,00000001,?,?,?), ref: 00403709
strcpy.MSVCRT(?,?,?,00000001,?,?,?), ref: 00403719
strlen.MSVCRT ref: 00403739
sprintf.MSVCRT ref: 0040375D
strcpy.MSVCRT(?,?), ref: 00403773

Strings

%s@gmail.com, xrefs: 00403757

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcpy$FromStringUuid$FreeTaskmemcpysprintfstrchrstrlen
String ID: %s@gmail.com
API String ID: 2649369358-4097000612
Opcode ID: 80ed345e0ff0ee47aaf383b724b244bfbf67af68538c23d64fe4f8ff209c4e8a
Instruction ID: 644cd556ee9d6f83430fbc5f755ed5fad511d56830514e9de795baf2bfcfc341
Opcode Fuzzy Hash: 80ed345e0ff0ee47aaf383b724b244bfbf67af68538c23d64fe4f8ff209c4e8a
Instruction Fuzzy Hash: 8B21DEF280411D5EDB21DB54CD85FDA77ACBB14308F0401AFF609E2181EAB89BC48B69

Function 0040687C Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040689C
sprintf.MSVCRT ref: 004068C9
strlen.MSVCRT ref: 004068D5
memcpy.MSVCRT ref: 004068EA
strlen.MSVCRT ref: 004068F8
memcpy.MSVCRT ref: 00406908

Strings

%s (%s), xrefs: 004068C3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpystrlen$memsetsprintf
String ID: %s (%s)
API String ID: 3756086014-1363028141
Opcode ID: 930878db99837ba46a6e987faf5d20af4a34b58a77fcbe6d93f567b97a470ebe
Instruction ID: 724a4194cae70d0bf31fff2aa5a30eca349b7c3c60a55174e1cb3006c7faee74
Opcode Fuzzy Hash: 930878db99837ba46a6e987faf5d20af4a34b58a77fcbe6d93f567b97a470ebe
Instruction Fuzzy Hash: 2F1190B2800159AFDB21DF58CD44BDABBACEF45308F00856AFB48EB102D275EA55CB94

Function 0040EF77 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0040EF8E
UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 0040EF9B
memcpy.MSVCRT ref: 0040EFD7
CoTaskMemFree.OLE32(?,?), ref: 0040EFE6

Strings

5e7e8100-9138-11d1-945a-00c04fc308ff, xrefs: 0040EF89
00000000-0000-0000-0000-000000000000, xrefs: 0040EF96

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FromStringUuid$FreeTaskmemcpy
String ID: 00000000-0000-0000-0000-000000000000$5e7e8100-9138-11d1-945a-00c04fc308ff
API String ID: 1640410171-3316789007
Opcode ID: 54a3c10d71348b38328debb2075fb86de4f8d1c0c91b0897777fae0c62ad26f4
Instruction ID: e50974e3e7746184743268e00a497f96c507105008b10ce8b40323224852ed78
Opcode Fuzzy Hash: 54a3c10d71348b38328debb2075fb86de4f8d1c0c91b0897777fae0c62ad26f4
Instruction Fuzzy Hash: A501807691012EBACF11AAA5CD40EEF7BACEF48354F004437FD15E7141E634EA548BA4

Function 00409F9C Relevance: 10.5, APIs: 7, Instructions: 43windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A175: SendMessageA.USER32(?,00001037,00000000,00000000), ref: 0040A190
Part of subcall function 0040A175: SendMessageA.USER32(?,00001036,00000000,00000000), ref: 0040A1AA

ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001,00000001), ref: 00409FC1
ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 00409FD0
LoadIconA.USER32(000000CE), ref: 00409FE7
ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00409FF8
LoadIconA.USER32(000000CF), ref: 0040A005
ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 0040A010
SendMessageA.USER32(?,00001003,00000002,?), ref: 0040A025

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Image$IconList_$MessageSend$LoadReplace$CountCreate
String ID:
API String ID: 3673709545-0
Opcode ID: 5df2c262a5b4ee5b15d680e4827c5e350c8ab2ef2ec60dcd30680ed78b5bc19f
Instruction ID: 4e57101e09f8a627107abf71349708af879b5e1eab1c783dad4143a9e5363d44
Opcode Fuzzy Hash: 5df2c262a5b4ee5b15d680e4827c5e350c8ab2ef2ec60dcd30680ed78b5bc19f
Instruction Fuzzy Hash: 3101EC71280704BFFA316B60DE4BFD67AA6EB48B05F004425F359690E1C7F56D51DB18

Function 00409F9D Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A175: SendMessageA.USER32(?,00001037,00000000,00000000), ref: 0040A190
Part of subcall function 0040A175: SendMessageA.USER32(?,00001036,00000000,00000000), ref: 0040A1AA

ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001,00000001), ref: 00409FC1
ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 00409FD0
LoadIconA.USER32(000000CE), ref: 00409FE7
ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00409FF8
LoadIconA.USER32(000000CF), ref: 0040A005
ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 0040A010
SendMessageA.USER32(?,00001003,00000002,?), ref: 0040A025

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Image$IconList_$MessageSend$LoadReplace$CountCreate
String ID:
API String ID: 3673709545-0
Opcode ID: 93f7bf16144be3831d8fe0abe45ae6939580c4d2b0c37b8b20f1dfc57d53bec6
Instruction ID: 4681c035099bb4a28d1464aa710f9ac1d1cdfab18a2ba86be57a79ad66400e71
Opcode Fuzzy Hash: 93f7bf16144be3831d8fe0abe45ae6939580c4d2b0c37b8b20f1dfc57d53bec6
Instruction Fuzzy Hash: 33018C71280304BFFA226B60EE47FD57BA2AB48B01F008465F348AD0F2CBF129509B08

Function 00407E74 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407E9F
sprintf.MSVCRT ref: 00407EB4

Part of subcall function 00407F4F: memset.MSVCRT ref: 00407F73
Part of subcall function 00407F4F: GetPrivateProfileStringA.KERNEL32(004182C0,0000000A,0041344F,?,00001000,004181B8), ref: 00407F95
Part of subcall function 00407F4F: strcpy.MSVCRT(?,?), ref: 00407FAF

SetWindowTextA.USER32(?,?), ref: 00407EDB
EnumChildWindows.USER32(?,Function_00007E17,00000000), ref: 00407EEB

Strings

caption, xrefs: 00407EC0
dialog_%d, xrefs: 00407EAA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$ChildEnumPrivateProfileStringTextWindowWindowssprintfstrcpy
String ID: caption$dialog_%d
API String ID: 246480800-4161923789
Opcode ID: 6e550837f943315e237d33f8ccb0dbabbd4e98402079b2b4a2b47b3f427e8a7f
Instruction ID: c346797357670b32f643cbd36cfbc212eb539bb93902627947de0ac2d0f12ab5
Opcode Fuzzy Hash: 6e550837f943315e237d33f8ccb0dbabbd4e98402079b2b4a2b47b3f427e8a7f
Instruction Fuzzy Hash: DBF0BB3058424D7EDB129750DD06FD97A68AB18746F0400EAFB44E10D1DBF8AAD0875E

Function 0040E8C6 Relevance: 9.1, APIs: 6, Instructions: 142stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,0040E3BD,00000000,00000000), ref: 0040E8FD
memset.MSVCRT ref: 0040E95A
memset.MSVCRT ref: 0040E96C

Part of subcall function 0040E7E3: strcpy.MSVCRT(?,-00000001), ref: 0040E809

memset.MSVCRT ref: 0040EA53
strcpy.MSVCRT(?,?,?,00000000,00000118), ref: 0040EA78
CloseHandle.KERNEL32(00000000,0040E3BD,?), ref: 0040EAC2

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$strcpy$CloseHandleOpenProcess
String ID:
API String ID: 3799309942-0
Opcode ID: d6c67b7d57a34b5381901d3c53457be756757403445260d001e2bbe54def35e2
Instruction ID: 2a82ac7989168376751b009825c1859dcdea9a7a89aff0dc4cc4404167d83f81
Opcode Fuzzy Hash: d6c67b7d57a34b5381901d3c53457be756757403445260d001e2bbe54def35e2
Instruction Fuzzy Hash: 79512EB1A00218AFDB10DF95CD85ADEBBB8FB48304F1445AAF505A2281DB749F90CF69

Function 004094DC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 106stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

strcat.MSVCRT(?, ), ref: 004095A1
sprintf.MSVCRT ref: 004095C3

Strings

<td bgcolor=#%s nowrap>%s, xrefs: 004094E7
 , xrefs: 0040959B
<td bgcolor=#%s>%s, xrefs: 004094F3
<tr>, xrefs: 00409501

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWritesprintfstrcatstrlen
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 3813295786-4153097237
Opcode ID: 08929488c0db453afa1456f90ad20cd14aeeb908293d423d0ab32d1dc2333b83
Instruction ID: d2e4fb28aa3b1966a3fc448ecfbbe776d9831430555dea6067297da34f065eca
Opcode Fuzzy Hash: 08929488c0db453afa1456f90ad20cd14aeeb908293d423d0ab32d1dc2333b83
Instruction Fuzzy Hash: 4F318F32900209AFDF15DF95C8869DE7BB5FF44314F1041AAFD10AB1E2D776A951CB84

Function 0040AC6E Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AC8E

Part of subcall function 00407A69: LoadStringA.USER32(00000000,0000000D,00000FFF,?), ref: 00407B32
Part of subcall function 00407A69: memcpy.MSVCRT ref: 00407B71

Part of subcall function 00407A69: strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,76F90A60), ref: 00407AE4
Part of subcall function 00407A69: strlen.MSVCRT ref: 00407B02

Part of subcall function 0040687C: memset.MSVCRT ref: 0040689C
Part of subcall function 0040687C: sprintf.MSVCRT ref: 004068C9
Part of subcall function 0040687C: strlen.MSVCRT ref: 004068D5
Part of subcall function 0040687C: memcpy.MSVCRT ref: 004068EA
Part of subcall function 0040687C: strlen.MSVCRT ref: 004068F8
Part of subcall function 0040687C: memcpy.MSVCRT ref: 00406908

Part of subcall function 004066AF: GetSaveFileNameA.COMDLG32(?), ref: 004066FE
Part of subcall function 004066AF: strcpy.MSVCRT(?,?), ref: 00406715

Strings

txt, xrefs: 0040AD3E, 0040AD41
*.csv, xrefs: 0040AD09
<DA, xrefs: 0040ACFD
*.htm;*.html, xrefs: 0040ACD4
*.txt, xrefs: 0040ACA7

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpystrlen$memsetstrcpy$FileLoadNameSaveStringsprintf
String ID: *.csv$*.htm;*.html$*.txt$<DA$txt
API String ID: 4021364944-2752249159
Opcode ID: 1ceb36e2604b9e9553284c6e0b24bc998c578e1058e1945574a68be56ec71ef9
Instruction ID: b1b2e5a0efe066de17158a8bc8fa7ff9efe1d0f31d50f94681ee96e1b845f603
Opcode Fuzzy Hash: 1ceb36e2604b9e9553284c6e0b24bc998c578e1058e1945574a68be56ec71ef9
Instruction Fuzzy Hash: B82101B1E042199ED700EFE6D8817DEBBB4AB08704F10417FE509B7282D7382B458F5A

Function 00403A67 Relevance: 9.1, APIs: 6, Instructions: 56filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403A8C
memset.MSVCRT ref: 00403AA5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF), ref: 00403ABC
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00403ADB
strlen.MSVCRT ref: 00403AED
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00403AFE

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidememset$FileWritestrlen
String ID:
API String ID: 1786725549-0
Opcode ID: 3f400ef8c2c76e934e80ec81a0c92b5e5fe334d0f7b850a86132a32295095dc5
Instruction ID: 60d5cd2968a458345304ed859c80f0f17d47a7f7ae6e16c58bf0b652b2e175c6
Opcode Fuzzy Hash: 3f400ef8c2c76e934e80ec81a0c92b5e5fe334d0f7b850a86132a32295095dc5
Instruction Fuzzy Hash: B8116DB650012CBEFB009B94DD85DEBB7ADEF08354F0041A2B719E2091D6759F54CB78

Function 004065B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004065D3
sprintf.MSVCRT ref: 004065F4
strcat.MSVCRT(?,004140AC), ref: 00406606
strcat.MSVCRT(?,004140B8,00000000), ref: 00406623
strcat.MSVCRT(?,00000000), ref: 00406632

Strings

%2.2X, xrefs: 004065EE

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strcat$memsetsprintf
String ID: %2.2X
API String ID: 582077193-791839006
Opcode ID: f97dc6c3a2e75b9a245aecc583dcd71bc50743b83a8a0946cd7d9d5c2e4ca989
Instruction ID: 9a6b28ef774d6e53ee32a9c0eecf57d77903bda120735f9d6ade06843e2f5b66
Opcode Fuzzy Hash: f97dc6c3a2e75b9a245aecc583dcd71bc50743b83a8a0946cd7d9d5c2e4ca989
Instruction Fuzzy Hash: 03014C32A042152AD73266569C02BEB3B9C9B58708F10817FF944E51C2EAFCD6D4879D

Function 00410596 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004105A4
??3@YAXPAX@Z.MSVCRT ref: 004105BF
??3@YAXPAX@Z.MSVCRT ref: 004105D5
??3@YAXPAX@Z.MSVCRT ref: 004105EB
??3@YAXPAX@Z.MSVCRT ref: 00410601
??3@YAXPAX@Z.MSVCRT ref: 00410617

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 607c23ff0e486e070c5426f82ff3d7a24f97f784535b6e080ccd99acf642cc13
Instruction ID: 21774ca54697e01c1adc3851c2de10052fd52e5bfec277bf8b6dbebc5e22beff
Opcode Fuzzy Hash: 607c23ff0e486e070c5426f82ff3d7a24f97f784535b6e080ccd99acf642cc13
Instruction Fuzzy Hash: 55014872906D316BC5357A3559017DBA3947F05B19B06020FFA09B73424BAC7CE0C9DD

Function 004016E5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004016F4
GetSystemMetrics.USER32(00000015), ref: 00401702
GetSystemMetrics.USER32(00000014), ref: 0040170E
BeginPaint.USER32(?,?), ref: 00401728
DrawFrameControl.USER32(00000000,?,00000003,00000008), ref: 00401737
EndPaint.USER32(?,?), ref: 00401744

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 2260b63d1688647689794fdb84e8332651a2a8fc8b06cd3bb88943ade092d718
Instruction ID: 87b9e555b8a68b0804226e1a7d1b9f87043edf3c617a3ea881a1d9d020f86292
Opcode Fuzzy Hash: 2260b63d1688647689794fdb84e8332651a2a8fc8b06cd3bb88943ade092d718
Instruction Fuzzy Hash: 0D01FB72900218BFDF04DFA8DC499FE7BBDFB45702F004469EE11AA194DAB1AA08CB54

Function 00411A0F Relevance: 8.9, APIs: 7, Instructions: 147stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411A30
memset.MSVCRT ref: 00411A49
memset.MSVCRT ref: 00411A5D

Part of subcall function 00411533: strlen.MSVCRT ref: 00411540

strlen.MSVCRT ref: 00411A79
memcpy.MSVCRT ref: 00411A9E
memcpy.MSVCRT ref: 00411AB4

Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BEDF

Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF0B
Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF21
Part of subcall function 0040BEEC: memcpy.MSVCRT ref: 0040BF58
Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF62

memcpy.MSVCRT ref: 00411AF4

Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BE91
Part of subcall function 0040BE4E: memcpy.MSVCRT ref: 0040BEBB

Part of subcall function 0040BEEC: memset.MSVCRT ref: 0040BF33

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpymemset$strlen
String ID:
API String ID: 2142929671-0
Opcode ID: 89ceb3d21e91c6af02e864f567a05f0a8fa48fa73525340af3882809b2e08623
Instruction ID: 6f2ed515a41b06c6c22f205846f23ff7f18478afa58802cd03ca93c0f6d1378b
Opcode Fuzzy Hash: 89ceb3d21e91c6af02e864f567a05f0a8fa48fa73525340af3882809b2e08623
Instruction Fuzzy Hash: 29512B7290015DAACB14DF55CC81AEEB7A9FF04308F5441BAE609E7151EB34AA89CF98

Function 0040B4DE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B548
SendMessageA.USER32(00000000,00000423,00000000,00000000), ref: 0040B58C
GetMenuStringA.USER32(?,00000103,?,0000004F,00000000), ref: 0040B5A6
PostMessageA.USER32(?,00000402,00000000,00000000), ref: 0040B649

Strings

84A, xrefs: 0040B553

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$MenuPostSendStringmemset
String ID: 84A
API String ID: 3798638045-1875439563
Opcode ID: d3a55612aad303442b70cf6981c395df1170026015e9bbabf54ddfea19c8819b
Instruction ID: f81f675eeec9d049c2f837a36ed854dba7505ce636643832e7163bdc5c509590
Opcode Fuzzy Hash: d3a55612aad303442b70cf6981c395df1170026015e9bbabf54ddfea19c8819b
Instruction Fuzzy Hash: F141E130600611EFCB259F24CC85AA6BBA4FF04325F1486B6E958AB2C5C378DD91CBDD

Function 0040DC39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 00404651: LoadLibraryA.KERNEL32(advapi32.dll,?,0040DC5F,80000001,76DBEC10), ref: 0040465E
Part of subcall function 00404651: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00404677
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredFree), ref: 00404683
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 0040468F
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040469B
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004046A7

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,76DBEC10), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040DD05
strlen.MSVCRT ref: 0040DD15
strcpy.MSVCRT(?,?), ref: 0040DD26
LocalFree.KERNEL32(?), ref: 0040DD33

Strings

Passport.Net\*, xrefs: 0040DC7B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadstrcpy$ByteCharFreeLocalMultiWidestrlen
String ID: Passport.Net\*
API String ID: 3335197805-3671122194
Opcode ID: d42203313a812c175362967ded223f6fc05771b77deb048e9d9358547b9af39c
Instruction ID: efac9c12738a0d8289842d1efaad299d98c72222a78c1cf1bd4cf7de0e5ce36b
Opcode Fuzzy Hash: d42203313a812c175362967ded223f6fc05771b77deb048e9d9358547b9af39c
Instruction Fuzzy Hash: 47313AB6E00109ABDB10EF96DD45DEE7BB8EF85304F10007AE605F7291D7389A45CB68

Function 00403278 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00403127: strchr.MSVCRT ref: 0040323C

memset.MSVCRT ref: 004032CC
GetPrivateProfileSectionA.KERNEL32(Personalities,?,000003FE,?), ref: 004032E6
strchr.MSVCRT ref: 0040331B

Part of subcall function 004023C6: _mbsicmp.MSVCRT ref: 004023FE

strlen.MSVCRT ref: 0040335D

Part of subcall function 004023C6: _mbscmp.MSVCRT ref: 004023DA

Strings

Personalities, xrefs: 004032E1

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strchr$PrivateProfileSection_mbscmp_mbsicmpmemsetstrlen
String ID: Personalities
API String ID: 2103853322-4287407858
Opcode ID: fec04840c498abd3992574a7e604aaddea038dd89c6a73b46c7ff5499d0b65e7
Instruction ID: a1e53a31d12307489e3dcdfde72dead8da93f466afb76ebe56892d48a8bd1a3f
Opcode Fuzzy Hash: fec04840c498abd3992574a7e604aaddea038dd89c6a73b46c7ff5499d0b65e7
Instruction Fuzzy Hash: 2A21D676A041096EDB10AF699D81ADE7F6C9F00309F1440BBEA04F3181DB789B86866D

Function 0040A6C6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 0040A6E7
qsort.MSVCRT ref: 0040A790
SetCursor.USER32(/nosort,?,0040BCA6), ref: 0040A79E

Strings

/nosort, xrefs: 0040A744
/sort, xrefs: 0040A6E2

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Cursor_mbsicmpqsort
String ID: /nosort$/sort
API String ID: 882979914-1578091866
Opcode ID: b62834dc514b00cfd30f714a9fad692c6252d4fd7e33ed5c13f61842356538e2
Instruction ID: d235f9a75b77abe912022d820ae93ced97f95949ab3107a8ace45c524b087071
Opcode Fuzzy Hash: b62834dc514b00cfd30f714a9fad692c6252d4fd7e33ed5c13f61842356538e2
Instruction Fuzzy Hash: 5421C170704602EFC719EF75C884A95B7A9FF48314B10413EF529A7291DB39AC218B8A

Function 00411622 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411644

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,000003FF), ref: 004116B0

Strings

EOptions string, xrefs: 00411683
Software\Yahoo\Pager, xrefs: 0041164D
Yahoo! User ID, xrefs: 00411668

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValuememset
String ID: EOptions string$Software\Yahoo\Pager$Yahoo! User ID
API String ID: 1830152886-1703613266
Opcode ID: 3ec72928c88313449a069dffbaf2e341cc248c5522c4285b6e7c3985674fc6c1
Instruction ID: 516cda371f3396bdfc4173c93ac40c9cbeab8f1746814b3412c432ea0c8be721
Opcode Fuzzy Hash: 3ec72928c88313449a069dffbaf2e341cc248c5522c4285b6e7c3985674fc6c1
Instruction Fuzzy Hash: 8401C4B5A00018FBDB109A15CD01FDE7A6D9B90354F040072FF08F2221F2358F599A98

Function 00405F4B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 00405F5B
sprintf.MSVCRT ref: 00405F83
MessageBoxA.USER32(00000000,?,Error,00000030), ref: 00405F9C

Strings

Error %d: %s, xrefs: 00405F7D
Error, xrefs: 00405F8D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastMessagesprintf
String ID: Error$Error %d: %s
API String ID: 1670431679-1552265934
Opcode ID: 4911e26903d4482cbd9d642036671f993fd1af17c5afcfd040224a18a71cc317
Instruction ID: f1cbc3d381c34e383a1f44b31e9a73e3da945176662b790f0432ac9700464d50
Opcode Fuzzy Hash: 4911e26903d4482cbd9d642036671f993fd1af17c5afcfd040224a18a71cc317
Instruction Fuzzy Hash: 90F0A77680010977CB10AB64CC06FDB77BCAB44704F140076BB45E2140EA74DB458EA8

Function 0040F6A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shlwapi.dll,000003ED,753D8FB0,00405C4B,00000000), ref: 0040F6B1
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040F6BF
FreeLibrary.KERNEL32(00000000), ref: 0040F6D7

Strings

SHAutoComplete, xrefs: 0040F6B9
shlwapi.dll, xrefs: 0040F6AA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 145871493-1506664499
Opcode ID: 1745662a808ecc52a60ee12c912701a8b94b5af88e17989fb7bf14a85f6732ea
Instruction ID: ed3b1cda8c3177e5f4c950405da88c53b72577223da9c459121c2a3053d1176f
Opcode Fuzzy Hash: 1745662a808ecc52a60ee12c912701a8b94b5af88e17989fb7bf14a85f6732ea
Instruction Fuzzy Hash: 5AD02B313002106BDA305F21BC09EEF3DEDEFC47937018032F800D2164DB258D0281AC

Function 00409808 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

memset.MSVCRT ref: 0040983E

Part of subcall function 0040F70E: memcpy.MSVCRT ref: 0040F77C

Part of subcall function 0040918B: strcpy.MSVCRT(00000000,?,00409874,?,?,?), ref: 00409190
Part of subcall function 0040918B: _strlwr.MSVCRT ref: 004091D3

sprintf.MSVCRT ref: 00409883

Strings

<%s>%s</%s>, xrefs: 0040987B
</item>, xrefs: 0040989D
<item>, xrefs: 00409812

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite_strlwrmemcpymemsetsprintfstrcpystrlen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 3200591283-2769808009
Opcode ID: ef506932c8d52d72789fba1ffefffec390692f9936b3c03bbb8efc2406efdbf0
Instruction ID: 22b2cf82475c3b06c8668363684e5b6771b4bc8edfe41877af386eb7fddec59d
Opcode Fuzzy Hash: ef506932c8d52d72789fba1ffefffec390692f9936b3c03bbb8efc2406efdbf0
Instruction Fuzzy Hash: 4B11A331600616BFDB11AF15CC42E967B64FF0831CF10017AF909666A2D77ABDA4DF98

Function 00411270 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00405ED5: CreateFileA.KERNEL32(0041133F,80000000,00000001,00000000,00000003,00000000,00000000,0041127B,0041141B,?,0041133F,?,?,*.oeaccount,0041141B,?), ref: 00405EE7

GetFileSize.KERNEL32(00000000,00000000,?,00000000,?,0041133F,?,?,*.oeaccount,0041141B,?,00000104), ref: 0041128A
??2@YAPAXI@Z.MSVCRT ref: 0041129C
SetFilePointer.KERNEL32(0041141B,00000002,00000000,00000000,?,?,0041133F,?,?,*.oeaccount,0041141B,?,00000104), ref: 004112AB

Part of subcall function 00406725: ReadFile.KERNEL32(?,0041141B,?,00000000,00000000,?,?,004112BE,0041141B,00000000,-00000002,?,0041133F,?,?,*.oeaccount), ref: 0040673C

Part of subcall function 00411133: wcslen.MSVCRT ref: 00411146
Part of subcall function 00411133: ??2@YAPAXI@Z.MSVCRT ref: 0041114F
Part of subcall function 00411133: WideCharToMultiByte.KERNEL32(00000000,00000000,004112D5,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,004112D5,?,00000000,0041141B), ref: 00411168
Part of subcall function 00411133: strlen.MSVCRT ref: 004111AB
Part of subcall function 00411133: memcpy.MSVCRT ref: 004111C5
Part of subcall function 00411133: ??3@YAXPAX@Z.MSVCRT ref: 00411258

??3@YAXPAX@Z.MSVCRT ref: 004112D6
CloseHandle.KERNEL32(0041141B,?,0041133F,?,?,*.oeaccount,0041141B,?,00000104), ref: 004112E0

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$??2@??3@$ByteCharCloseCreateHandleMultiPointerReadSizeWidememcpystrlenwcslen
String ID:
API String ID: 1886237854-0
Opcode ID: a9cfe04fa5bdd51d8bf4059786eaa6f11c0805747c75d5ba186b56019847d930
Instruction ID: e21230228d1277bb6eddc604f6d9b170c83676d8100b74bfcef0317b0316c018
Opcode Fuzzy Hash: a9cfe04fa5bdd51d8bf4059786eaa6f11c0805747c75d5ba186b56019847d930
Instruction Fuzzy Hash: BA01B532404248BEDB106F75EC4DDDBBFACEF59368710816BF958C62A0DA358D54CB68

Function 00407D63 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407D75
GetWindowRect.USER32(?,?), ref: 00407D82
GetClientRect.USER32(00000000,?), ref: 00407D8D
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00407D9D
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00407DB9

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 37609a960450173bf69824f7e52b241be5bc0a1fab6fa9040fc85c24cae36fff
Instruction ID: 038819a919944698b8d7aadaf115a7119d50e81e4b6eee93b7f6b8021a4f8f43
Opcode Fuzzy Hash: 37609a960450173bf69824f7e52b241be5bc0a1fab6fa9040fc85c24cae36fff
Instruction Fuzzy Hash: F7015A32801129BBDB11AFA59C49EFFBFBCEF46751F04812AFD05A2140D738A605CBA5

Function 004099DA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004099FD
memset.MSVCRT ref: 00409A13

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

Part of subcall function 0040918B: strcpy.MSVCRT(00000000,?,00409874,?,?,?), ref: 00409190
Part of subcall function 0040918B: _strlwr.MSVCRT ref: 004091D3

sprintf.MSVCRT ref: 00409A4A

Strings

<%s>, xrefs: 00409A44
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00409A18

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$FileWrite_strlwrsprintfstrcpystrlen
String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3202206310-1998499579
Opcode ID: 8832b5a78768cb6b45b9e86c8935bb2a9e75a3943d9c8cceaada708264de42f7
Instruction ID: e71924cd66665c82b0e0cf5586ba0e292e849e53f6e9b6834f4978a1b65f22f6
Opcode Fuzzy Hash: 8832b5a78768cb6b45b9e86c8935bb2a9e75a3943d9c8cceaada708264de42f7
Instruction Fuzzy Hash: B601A7B2A001296AD720A655DC45FDB7A6C9F54704F0400FAB609F7182D7B8AA94CBA9

Function 004086DC Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004086E8
??3@YAXPAX@Z.MSVCRT ref: 004086F6
??3@YAXPAX@Z.MSVCRT ref: 00408707
??3@YAXPAX@Z.MSVCRT ref: 0040871E
??3@YAXPAX@Z.MSVCRT ref: 00408727

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 918acd96936b96677d6dbe6e32eca864f76218b4922cdd818d5aaac1fd27dc8a
Instruction ID: 072aa514f388f074079b8f328b082be18a1f899df3a3abdece790e68ac814aea
Opcode Fuzzy Hash: 918acd96936b96677d6dbe6e32eca864f76218b4922cdd818d5aaac1fd27dc8a
Instruction Fuzzy Hash: 97F0F4725057115FDB309FB99EC055BBBD5BB08714760093FF28AD3641CB79A890C618

Function 00408742 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086E8
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086F6
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408707
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 0040871E
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408727

??3@YAXPAX@Z.MSVCRT ref: 0040875D
??3@YAXPAX@Z.MSVCRT ref: 00408770
??3@YAXPAX@Z.MSVCRT ref: 00408783
??3@YAXPAX@Z.MSVCRT ref: 00408796
free.MSVCRT(00000000), ref: 004087AA

Part of subcall function 00406B8A: free.MSVCRT(00000000,00406F4C,00000000,?,?), ref: 00406B91

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: 5868bb771c4ecc0bf5a1b6b5d500adaf89535c259bb090c2cea9b7557de00de1
Instruction ID: 36c0512d224ac042a94a08cc7a852a1772878ff9935cd33c5980a4446e7632c9
Opcode Fuzzy Hash: 5868bb771c4ecc0bf5a1b6b5d500adaf89535c259bb090c2cea9b7557de00de1
Instruction Fuzzy Hash: 8CF0A4729025306F89313B325A01A4EB7A47D5472932A026FF90ABB3858F7D6C60C5DD

Function 0040EE8B Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 004062DB: memset.MSVCRT ref: 004062FB
Part of subcall function 004062DB: GetClassNameA.USER32(?,00000000,000000FF), ref: 0040630E
Part of subcall function 004062DB: _stricmp.MSVCRT(00000000,edit), ref: 00406320

SetBkMode.GDI32(?,00000001), ref: 0040EEB2
GetSysColor.USER32(00000005), ref: 0040EEBA
SetBkColor.GDI32(?,00000000), ref: 0040EEC4
SetTextColor.GDI32(?,00C00000), ref: 0040EED2
GetSysColorBrush.USER32(00000005), ref: 0040EEDA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Color$BrushClassModeNameText_stricmpmemset
String ID:
API String ID: 1869857563-0
Opcode ID: fb94485f195de14578bb11bb35a76f110ea5450a675464f060a1de1235fa7123
Instruction ID: 03c420b3e6d9e2244e0390b53f734bb3cf914c92d54749bbcb6c05866cd8fc50
Opcode Fuzzy Hash: fb94485f195de14578bb11bb35a76f110ea5450a675464f060a1de1235fa7123
Instruction Fuzzy Hash: 5BF08131140109BBDF116FA6EC09B9E3F69EF08712F10843AFA19641F1CB759A209B58

Function 00405CF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(0000000B), ref: 00405D11

Part of subcall function 00401645: GetDlgItem.USER32(?,?), ref: 00401655
Part of subcall function 00401645: GetClientRect.USER32(?,?), ref: 00401667
Part of subcall function 00401645: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 004016D1

EndDeferWindowPos.USER32(?), ref: 00405DE2
InvalidateRect.USER32(?,?,00000001), ref: 00405DED

Strings

$, xrefs: 00405DF9

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: a57de8c45b3456a0d8c08563bdb03b3f45c34c184d4faa9fce82ec50ca54258b
Instruction ID: 9c87de9d9a27f98487306a7e65f23cb02f8420b0a21639e15617240473fc85a4
Opcode Fuzzy Hash: a57de8c45b3456a0d8c08563bdb03b3f45c34c184d4faa9fce82ec50ca54258b
Instruction Fuzzy Hash: CC314C30641254BBCB216F678C4DD8F7E7DEF86BA8F104479B406752A2D6758E00DAA8

Function 0040BAB7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00401E4A: memset.MSVCRT ref: 00401E6C
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401E85
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401E93
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401ED9
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401EE7

_stricmp.MSVCRT(/stext,0041344F,?,00000000,00000000,?,?,?,0040BCA6), ref: 0040BB0B

Strings

O4A, xrefs: 0040BB56
O4A, xrefs: 0040BB00
/stext, xrefs: 0040BB06

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen$_stricmpmemset
String ID: /stext$O4A$O4A
API String ID: 3575250601-3624624124
Opcode ID: 7f0e710687395444cd0f3a313f6498683b374fdeb7e5e26100ad8a4f5dd32849
Instruction ID: f8692cde8425b7317fc14f1eb66aa5838d4e8645dd66f9f31b24f8adae3a6e9d
Opcode Fuzzy Hash: 7f0e710687395444cd0f3a313f6498683b374fdeb7e5e26100ad8a4f5dd32849
Instruction Fuzzy Hash: 20213E707141119FC368AF29C8D1A66B3A8FB04318B15827FE41AA7692C779EC518BCD

Function 00407306 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00407341

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,000000FF,?,?,?), ref: 0040738F
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,000000FF,?,?,?), ref: 004073AC

Strings

Software\Google\Google Desktop\Mailboxes, xrefs: 00407319

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Close$EnumOpenmemset
String ID: Software\Google\Google Desktop\Mailboxes
API String ID: 2255314230-2212045309
Opcode ID: 9ab75551773aed32ac14d672ca6fc6d16b8ba2b7fe8e99e73c669c0c868d9bd0
Instruction ID: e64120c2db1572d8afbfe90730df88552d052729858ffd3f9c459fe70d1883dc
Opcode Fuzzy Hash: 9ab75551773aed32ac14d672ca6fc6d16b8ba2b7fe8e99e73c669c0c868d9bd0
Instruction Fuzzy Hash: FE114F72808345BBD720EA52DC02EAB7BECEB84344F04493EBD94D1191E735DA1CDAA7

Function 0040AECD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AEED
SetFocus.USER32(?,?), ref: 0040AF75

Part of subcall function 0040AEB7: PostMessageA.USER32(?,00000415,00000000,00000000), ref: 0040AEC6

Strings

@@A, xrefs: 0040AF3A
l, xrefs: 0040AF1D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FocusMessagePostmemset
String ID: @@A$l
API String ID: 3436799508-3245464651
Opcode ID: caeb76f4659ab955c907a99837df0e7903f88894a94faa412a12e2d9c7c3a8b3
Instruction ID: b134d5c547a061a2024b59ce6a2071751047cb74c3ab3f5c012b8dbc43773ba7
Opcode Fuzzy Hash: caeb76f4659ab955c907a99837df0e7903f88894a94faa412a12e2d9c7c3a8b3
Instruction Fuzzy Hash: E511A5719001588BDF21DB15CD457CB7BA9AF40308F0800F5A94C7B282C7B55A89CFA5

Function 004085AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004085C4
SendMessageA.USER32(?,00001019,00000000,?), ref: 004085F2

Strings

\LA, xrefs: 004085B2
", xrefs: 004085EB

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSendmemset
String ID: "$\LA
API String ID: 568519121-1791104459
Opcode ID: 26f90e38fa5412fa5d9144848af1d9542bec1eb57a3646f7dcddd4dc696a0724
Instruction ID: 63acc278c780c6314b896fe9ea96fe6fcbd724764764ef8c6808a121558323c0
Opcode Fuzzy Hash: 26f90e38fa5412fa5d9144848af1d9542bec1eb57a3646f7dcddd4dc696a0724
Instruction Fuzzy Hash: 6401D635900204AFDB20DF45CA81AABB7F8FF84749F11842EE891A7241E7359E95CB79

Function 00406647 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35stringCOMMON

Download Yara Rule

APIs

GetOpenFileNameA.COMDLG32(?), ref: 00406691
strcpy.MSVCRT(?,?), ref: 0040669F

Strings

<@A, xrefs: 0040668A
L, xrefs: 0040666B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileNameOpenstrcpy
String ID: <@A$L
API String ID: 812585365-3325948237
Opcode ID: 0e8797fdf618d39e3eb3ab1232a77db25cc5d7ab3626c4b171bcbec14203ab80
Instruction ID: 37832acc40b05216fd1420d9404962ea4abb69311e967ef4bad7b399ffdc39fa
Opcode Fuzzy Hash: 0e8797fdf618d39e3eb3ab1232a77db25cc5d7ab3626c4b171bcbec14203ab80
Instruction Fuzzy Hash: 9001BDB1D102189FCF50DFA9D9456CEBFF8BB08348F00812AE519E6240EBB885458F98

Function 00401000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040619B: memset.MSVCRT ref: 004061A5
Part of subcall function 0040619B: strcpy.MSVCRT(?,00000000,?,00000000,0000003C,00000000,?,00406273,Arial,0000000E,00000000), ref: 004061E5

CreateFontIndirectA.GDI32(?), ref: 0040101F
SendDlgItemMessageA.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040103E
SendDlgItemMessageA.USER32(?,000003EE,00000030,?,00000000), ref: 0040105B

Strings

MS Sans Serif, xrefs: 0040100B

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetstrcpy
String ID: MS Sans Serif
API String ID: 4251605573-168460110
Opcode ID: 7584cd5e44123684fe29065303b056f6d65f03dbfdfa9ec3df9736e2aa6a92dd
Instruction ID: 87dec32cde48cbcf1a13d2850fc5ac8412a7d38377e852ebd334ba5dd6d4256f
Opcode Fuzzy Hash: 7584cd5e44123684fe29065303b056f6d65f03dbfdfa9ec3df9736e2aa6a92dd
Instruction Fuzzy Hash: 0DF0A771B4030877EB216BA0EC4BF8A7BACAB41F01F148535FA51B51E1D6F5B644CB48

Function 004062DB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004062FB
GetClassNameA.USER32(?,00000000,000000FF), ref: 0040630E
_stricmp.MSVCRT(00000000,edit), ref: 00406320

Strings

edit, xrefs: 0040631A

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ClassName_stricmpmemset
String ID: edit
API String ID: 3665161774-2167791130
Opcode ID: 6e637e9eddf622f627d70554f5007a36f01acadd3667ac6aea8fad4d2d9c4dd7
Instruction ID: f5117061f2ecbf32e0f2d844d8c4f3ebb38ffa703039f8d1d2413de036cb48d9
Opcode Fuzzy Hash: 6e637e9eddf622f627d70554f5007a36f01acadd3667ac6aea8fad4d2d9c4dd7
Instruction Fuzzy Hash: 6BE09B72C4412A7EDB21A664EC01FE63BAC9F19705F0001B6B945E1081E6A497C48AA4

Function 0040F41D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shell32.dll,0040BBB8,76F90A60,?,00000000), ref: 0040F42B
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040F440

Strings

SHGetSpecialFolderPathA, xrefs: 0040F43A
shell32.dll, xrefs: 0040F426

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathA$shell32.dll
API String ID: 2574300362-543337301
Opcode ID: ebee045d17af5392e55c599677de8e54218ff7482c30a47864962e580415edd2
Instruction ID: f6b0fe8b92f076911ecc5568a6e4330759afce426f86003319557fe493e3cfe8
Opcode Fuzzy Hash: ebee045d17af5392e55c599677de8e54218ff7482c30a47864962e580415edd2
Instruction Fuzzy Hash: 59D092B0642202ABD7208F21AC097827AAAE798706F01C53AA800E12A4FF7895448A5D

Function 004104AE Relevance: 6.3, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00406578: memset.MSVCRT ref: 00406586

??2@YAPAXI@Z.MSVCRT ref: 004104C3
??2@YAPAXI@Z.MSVCRT ref: 004104E1
??2@YAPAXI@Z.MSVCRT ref: 004104FC
??2@YAPAXI@Z.MSVCRT ref: 00410525
??2@YAPAXI@Z.MSVCRT ref: 00410549

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: ed240992573ec86b58d2d50a2916693bc920e5de01bcfd4d726ef5af0379dd19
Instruction ID: e5f264b8724d3d475e9e13978f0762699e8b6218914c988ba7d238899ccfa6da
Opcode Fuzzy Hash: ed240992573ec86b58d2d50a2916693bc920e5de01bcfd4d726ef5af0379dd19
Instruction Fuzzy Hash: 2431E8B0A007009FD750DF3A99856A6FBE5EF84305B25886FD25ACB262D7B8D481CF19

Function 0040BEEC Relevance: 6.3, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BF0B
memset.MSVCRT ref: 0040BF21
memset.MSVCRT ref: 0040BF33
memcpy.MSVCRT ref: 0040BF58
memset.MSVCRT ref: 0040BF62

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: f09e4137cee235a1b9d7fd27eaadac0c52e283a178c2e8a252c289c30bf46ad1
Instruction ID: 1bd4811e219587db2c743c544c50c2778389369fcaa1acc1f1d0acac3f9f4604
Opcode Fuzzy Hash: f09e4137cee235a1b9d7fd27eaadac0c52e283a178c2e8a252c289c30bf46ad1
Instruction Fuzzy Hash: D90128B1650B002BD235AB35CD03F6B77A4EB54B14F000B1EF642E66D3D7A8A14489AD

Function 0040242B Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000,?,?,00000400,00000001), ref: 004024EB
memset.MSVCRT ref: 004024B4

Part of subcall function 0040EFF9: UuidFromStringA.RPCRT4(220D5CD0-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040F016
Part of subcall function 0040EFF9: UuidFromStringA.RPCRT4(417E2D75-84BD-11D0-84BB-00C04FD43F8F,?), ref: 0040F037
Part of subcall function 0040EFF9: memcpy.MSVCRT ref: 0040F075
Part of subcall function 0040EFF9: CoTaskMemFree.OLE32(00000000,00000000), ref: 0040F084

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000002,?,0000007F,00000000,00000000,00000002,00000000,?), ref: 004025A3
LocalFree.KERNEL32(?), ref: 004025AD

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharFreeFromMultiStringUuidWide$LocalQueryTaskValuememcpymemset
String ID:
API String ID: 3503910906-0
Opcode ID: 311549387020673e673ad7ade458deddd79687b60b573298398fe302b42a0f0d
Instruction ID: cfc3eb1076764f39a441947bf0103a86c194fcc0ae6958193510771120a15821
Opcode Fuzzy Hash: 311549387020673e673ad7ade458deddd79687b60b573298398fe302b42a0f0d
Instruction Fuzzy Hash: 0341A3B1408385BFDB11DE608D44AAB7BDCAB88304F044A7EF588A21C1D679DA44CB5A

Function 0040A283 Relevance: 6.1, APIs: 4, Instructions: 114stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00408A97: ??2@YAPAXI@Z.MSVCRT ref: 00408AB8
Part of subcall function 00408A97: ??3@YAXPAX@Z.MSVCRT ref: 00408B7F

strlen.MSVCRT ref: 0040A2A9
atoi.MSVCRT ref: 0040A2B7
_mbsicmp.MSVCRT ref: 0040A30A
_mbsicmp.MSVCRT ref: 0040A31D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _mbsicmp$??2@??3@atoistrlen
String ID:
API String ID: 4107816708-0
Opcode ID: fcbe6108af864edb97e3be4016439bdb3d8805d59c5b364e212079bc31d54683
Instruction ID: a4071902e71568577f89ec7532499d814672e4af5b69a40392892895b6c6556c
Opcode Fuzzy Hash: fcbe6108af864edb97e3be4016439bdb3d8805d59c5b364e212079bc31d54683
Instruction Fuzzy Hash: 2F414C35900304ABCB11DFA9C580A9ABBF4FB48308F1085BEEC45EB382D775DA51CB59

Function 0040933E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00409380
strchr.MSVCRT ref: 0040938E

Part of subcall function 00406C0E: strlen.MSVCRT ref: 00406C2A
Part of subcall function 00406C0E: memcpy.MSVCRT ref: 00406C47

Strings

", xrefs: 004093CA
O4A, xrefs: 00409411

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strchr$memcpystrlen
String ID: "$O4A
API String ID: 647414859-2470771484
Opcode ID: 9589ded8c9737ad3f073cf670c5b07d51d805ffd3e6e170b8e9921023cefc6bc
Instruction ID: 2a898d4ed32f5f6efaaf06cea6bb2d3476af0f116e7825a2212580dac0848608
Opcode Fuzzy Hash: 9589ded8c9737ad3f073cf670c5b07d51d805ffd3e6e170b8e9921023cefc6bc
Instruction Fuzzy Hash: 27316431908204AFDF14EF65D8419DEBBB8EF59328B20416BEC51F71D2D778AA428E58

Function 00411533 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00411540

Strings

>, xrefs: 0041157B
>, xrefs: 004115A1
>, xrefs: 00411566

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen
String ID: >$>$>
API String ID: 39653677-3911187716
Opcode ID: 7edb754ddf4429fd3ce2b30709e1edacb08f523e3e7d14c7b467b5b93d7c181c
Instruction ID: 10e230c6dca09e0a93cf8d60ed085072b0d540c64d6ff1ff1f1df815401d523a
Opcode Fuzzy Hash: 7edb754ddf4429fd3ce2b30709e1edacb08f523e3e7d14c7b467b5b93d7c181c
Instruction Fuzzy Hash: 6331E4718492C5AFCB118B6C80417EEFFA24F62304F08869AC2D546353C26DA5CAC39A

Function 0040BE4E Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0040BE91
memcpy.MSVCRT ref: 0040BEBB
memcpy.MSVCRT ref: 0040BEDF

Strings

@, xrefs: 0040BECD

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpy
String ID: @
API String ID: 3510742995-2766056989
Opcode ID: 49a5a345e8207f48ba7b20f9c3d546e09529423d2927eee968959314de42fdf5
Instruction ID: eb902c52722b89a171555a0eccdb346c2cc9b7794a0320b873d5afd3574b0f46
Opcode Fuzzy Hash: 49a5a345e8207f48ba7b20f9c3d546e09529423d2927eee968959314de42fdf5
Instruction Fuzzy Hash: 201138B29007096BCB288E25C8809EB77A9EF54344700063FFE0696691E7759E95C7DC

Function 004070D9 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040710E
memset.MSVCRT ref: 0040711F
memcpy.MSVCRT ref: 0040712B
??3@YAXPAX@Z.MSVCRT ref: 00407138

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 85edfb7e8b992a0ff1249ff66e53eb09c48dce348a16b7b1dc77ea68a0c6e46b
Instruction ID: 17b98b22fb48c4f462205fa6a58e9a56533f9d3233289d57114c66ebe089a08a
Opcode Fuzzy Hash: 85edfb7e8b992a0ff1249ff66e53eb09c48dce348a16b7b1dc77ea68a0c6e46b
Instruction Fuzzy Hash: A6113D716046019FD328DF2DC981A27F7E6FF98304B20892EE59AC7385DA75E841CB55

Function 00406CFF Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00411C87,?,00000000,00411C55,00000000,?,0040D972), ref: 00406D1E

Part of subcall function 00406B54: free.MSVCRT(76F90A60,00000000,76F90A60,00406EF2,00000000,?,?), ref: 00406B63

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000), ref: 00406D5C

Strings

O4A, xrefs: 00406D6B
O4A, xrefs: 00406D4D

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$free
String ID: O4A$O4A
API String ID: 1329815435-993042121
Opcode ID: 1ed867b22c69faf8c5b3106cc14bc2b24ab2cc1111c25bf338c9f6b2849c2373
Instruction ID: 1b09f40ed87e73aeb79b4c84c04f27446391d6c1afa5035e0ae74dd7795ddf2a
Opcode Fuzzy Hash: 1ed867b22c69faf8c5b3106cc14bc2b24ab2cc1111c25bf338c9f6b2849c2373
Instruction Fuzzy Hash: 09115EB1B0011A6FDB01EFA9CD80ABF76FCEB08718B114137B915F7291E6749E148BA5

Function 0040F61F Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0040F62F
SHBrowseForFolderA.SHELL32(?), ref: 0040F661
SHGetPathFromIDListA.SHELL32(00000000,?), ref: 0040F675
strcpy.MSVCRT(?,?), ref: 0040F688

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: BrowseFolderFromListMallocPathstrcpy
String ID:
API String ID: 409945605-0
Opcode ID: 46f915da22a8394e3ccfb75a6a67a5d073b6093023bbcacd313ffdd2da9d0fc7
Instruction ID: b2d480601b656eadb7f9024a04999e6b50b11c93cc119ce3783244db306e4add
Opcode Fuzzy Hash: 46f915da22a8394e3ccfb75a6a67a5d073b6093023bbcacd313ffdd2da9d0fc7
Instruction Fuzzy Hash: 5811F7B5900208AFCB10DFA9D9889EEBBF8FB49315F10447AE905E7250D739DA46CF64

Function 00411C05 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00405ED5: CreateFileA.KERNEL32(0041133F,80000000,00000001,00000000,00000003,00000000,00000000,0041127B,0041141B,?,0041133F,?,?,*.oeaccount,0041141B,?), ref: 00405EE7

GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040D064,00000000,0040D972,?,?,00000104,00000000,?,0040D972,?,00000000), ref: 00411C1E
??2@YAPAXI@Z.MSVCRT ref: 00411C2A

Part of subcall function 00406725: ReadFile.KERNEL32(?,0041141B,?,00000000,00000000,?,?,004112BE,0041141B,00000000,-00000002,?,0041133F,?,?,*.oeaccount), ref: 0040673C

CloseHandle.KERNEL32(0040D972,00000000,?,0040D972,?,00000000,?,?,?,?,?,?), ref: 00411C58
??3@YAXPAX@Z.MSVCRT ref: 00411C63

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$??2@??3@CloseCreateHandleReadSize
String ID:
API String ID: 1968906679-0
Opcode ID: 81dc463ec2356049af3ece681b76481b2013d83dc9d852187db2e126e8957335
Instruction ID: 7eee50cd159b1862f9f77aaf36d5f43b0d65e01e2e9cd2c6863135ac6fea6ec1
Opcode Fuzzy Hash: 81dc463ec2356049af3ece681b76481b2013d83dc9d852187db2e126e8957335
Instruction Fuzzy Hash: 7801A231004104AAD711AF35DC09FDB3FA99F46374F15C12AF5188B2A1EB7A8650C7A9

Function 0040A5A1 Relevance: 6.0, APIs: 4, Instructions: 45stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00407A69: LoadStringA.USER32(00000000,0000000D,00000FFF,?), ref: 00407B32
Part of subcall function 00407A69: memcpy.MSVCRT ref: 00407B71

sprintf.MSVCRT ref: 0040A5C7
SendMessageA.USER32(?,00000401,00000000,?), ref: 0040A62A

Part of subcall function 00407A69: strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,76F90A60), ref: 00407AE4
Part of subcall function 00407A69: strlen.MSVCRT ref: 00407B02

sprintf.MSVCRT ref: 0040A5F1
strcat.MSVCRT(?,?,?,00000000,00000000), ref: 0040A604

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: sprintf$LoadMessageSendStringmemcpystrcatstrcpystrlen
String ID:
API String ID: 919693953-0
Opcode ID: 958ab865ac69a3c4c3d9128656c309624dbea8e97793038db77fe03c7bb4008b
Instruction ID: 49acf1ec04927684f0e14b468f671fa247d4e43980f6f5764d7eadf86f6a0ac4
Opcode Fuzzy Hash: 958ab865ac69a3c4c3d9128656c309624dbea8e97793038db77fe03c7bb4008b
Instruction Fuzzy Hash: 8A01DBB190030467D720F7B4CD86FDB73ACAB04304F04046FB755F61C2DAB9E6948A69

Function 0040FA2B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FA4D
strlen.MSVCRT ref: 0040FA55
strlen.MSVCRT ref: 0040FA62

Part of subcall function 004062B7: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062BF
Part of subcall function 004062B7: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062CE

Strings

sqlite3.dll, xrefs: 0040FA5A, 0040FA5F, 0040FA72

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen$memsetstrcatstrcpy
String ID: sqlite3.dll
API String ID: 1581230619-1155512374
Opcode ID: 16108ddf4f13ffc1d1035336796fcbbad104ce4c6981e8ccb6bc320039be4e03
Instruction ID: 4f80a8773c1d4988f6668b9143c1107d12609c3bb00905d80200812c675c4c4f
Opcode Fuzzy Hash: 16108ddf4f13ffc1d1035336796fcbbad104ce4c6981e8ccb6bc320039be4e03
Instruction Fuzzy Hash: F6F0427250C1186EDB20E769DC45FC977AC8F60318F1000B7F589E60C2DAF8D6C58668

Function 00409A67 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409A8A
memset.MSVCRT ref: 00409AA0

Part of subcall function 0040918B: strcpy.MSVCRT(00000000,?,00409874,?,?,?), ref: 00409190
Part of subcall function 0040918B: _strlwr.MSVCRT ref: 004091D3

sprintf.MSVCRT ref: 00409ACA

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,76F90A60,00000000,?,?,00409460,00000001,00413B1C,76F90A60), ref: 00405F21

Strings

</%s>, xrefs: 00409AC4

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memset$FileWrite_strlwrsprintfstrcpystrlen
String ID: </%s>
API String ID: 3202206310-259020660
Opcode ID: 637a9c7a3fbe891b17e74324215966cd4ae9ffaeb73701361f90968b62e1fe90
Instruction ID: 3d0bab8d804eeed29aac85efced1b4409724b73b0f4afa6070eee5aab36d753a
Opcode Fuzzy Hash: 637a9c7a3fbe891b17e74324215966cd4ae9ffaeb73701361f90968b62e1fe90
Instruction Fuzzy Hash: A801F9729001296BD720A259CC45FDB7B6C9F54304F0400FAB60DF3142D6B49A94CBA5

Function 004123F2 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004123FC
??3@YAXPAX@Z.MSVCRT ref: 0041240C
??3@YAXPAX@Z.MSVCRT ref: 0041241C
??3@YAXPAX@Z.MSVCRT ref: 0041242C

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: bbf8de8405f53124a46ce5bf03d70c3b21be83380051b215e87da0a01535b9bd
Instruction ID: d787685a6615fa8e7b12f25043f2ee1a52758ce9b2ab1ab1a3353857822e9c29
Opcode Fuzzy Hash: bbf8de8405f53124a46ce5bf03d70c3b21be83380051b215e87da0a01535b9bd
Instruction Fuzzy Hash: 8FE012703003206A8E30EB7ABF41AC327CDAA18351394C02EF609D2282DEA8DCE0C42C

Function 004021E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_ultoa.MSVCRT ref: 00402245
sprintf.MSVCRT ref: 004022B9

Strings

%s %s %s, xrefs: 004022B3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _ultoasprintf
String ID: %s %s %s
API String ID: 432394123-3850900253
Opcode ID: ad10a0a60f11ae5ad813c548426d3cbfbdd2c873bbe0414cf6ac4599a9575019
Instruction ID: 4550bc8a79151648f87db51bd02682248f93ba3dc48fc4e36bbc9480066499b4
Opcode Fuzzy Hash: ad10a0a60f11ae5ad813c548426d3cbfbdd2c873bbe0414cf6ac4599a9575019
Instruction Fuzzy Hash: F741F731904B16C7CA34956487CCBEBA298E702304F6504BFDC5AF72D0D2FCAE46866B

Function 0040851B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101A,00000000,?), ref: 00408597

Strings

\LA, xrefs: 00408527
", xrefs: 00408581

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: "$\LA
API String ID: 3850602802-1791104459
Opcode ID: 6730269ec323a4575099126faff27654677e2dead0fd5bf6d10708e601ad3506
Instruction ID: ec77e5a748e9a6ff816ea2aa2a284b6bdb41b89871e7a2a93e67b2087f5a6bee
Opcode Fuzzy Hash: 6730269ec323a4575099126faff27654677e2dead0fd5bf6d10708e601ad3506
Instruction Fuzzy Hash: 52115171A00115AEDB149F9ACEC04BEB7F5FB98305B50843FD1D6E7680DB789982CB58

Function 0040D9D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

*.*, xrefs: 0040DA01
prefs.js, xrefs: 0040DA44

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strlen$FileFindFirst
String ID: *.*$prefs.js
API String ID: 2516927864-1592826420
Opcode ID: 6a000196e6438ec39e637ca0eb5d4ae5762e5a1622c1bb359a3e97ee416ced3e
Instruction ID: 0a1894bf97bc7f37e7ea977f35cd1e9cdc16bb9bd7797736beedadfbd1967f85
Opcode Fuzzy Hash: 6a000196e6438ec39e637ca0eb5d4ae5762e5a1622c1bb359a3e97ee416ced3e
Instruction Fuzzy Hash: 1811947250C3465ED720EAA58C01ADB7BD89F55314F14863FF898E21C2D738D61DCB9A

Function 004066AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

GetSaveFileNameA.COMDLG32(?), ref: 004066FE
strcpy.MSVCRT(?,?), ref: 00406715

Strings

L, xrefs: 004066E3

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileNameSavestrcpy
String ID: L
API String ID: 1182090483-2909332022
Opcode ID: 2aa07690fce79c473fa63c108ae99b2fccd51bdc1973966a0ba636b15db491df
Instruction ID: d41a0f3581961b0f058ab7b38d8a0fc10f69f88ca1386dcb34cd33e007bc3755
Opcode Fuzzy Hash: 2aa07690fce79c473fa63c108ae99b2fccd51bdc1973966a0ba636b15db491df
Instruction Fuzzy Hash: D301E9B1D102099FDF10DFA9D8847AEBBF4BF08319F10442AE915E6340DB749955CF54

Function 00407D23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000), ref: 00407D2B
sprintf.MSVCRT ref: 00407D4E

Part of subcall function 00407BCE: GetMenuItemCount.USER32(?), ref: 00407BE4
Part of subcall function 00407BCE: memset.MSVCRT ref: 00407C08
Part of subcall function 00407BCE: GetMenuItemInfoA.USER32(?), ref: 00407C3E
Part of subcall function 00407BCE: memset.MSVCRT ref: 00407C6B
Part of subcall function 00407BCE: strchr.MSVCRT ref: 00407C77
Part of subcall function 00407BCE: strcat.MSVCRT(?,?,?,?,?,00000001,?), ref: 00407CD2
Part of subcall function 00407BCE: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 00407CEE

Strings

menu_%d, xrefs: 00407D44

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Menu$Itemmemset$CountInfoLoadModifysprintfstrcatstrchr
String ID: menu_%d
API String ID: 3671758413-2417748251
Opcode ID: 49ac11d1195a608e742f3e6ca3ff2f5e26bbcd1b47ce44f2e641ce1c3c472826
Instruction ID: 2770b7a066d609e077f5412e4a2b93c9a9718e974603bd13de201155b170d4e3
Opcode Fuzzy Hash: 49ac11d1195a608e742f3e6ca3ff2f5e26bbcd1b47ce44f2e641ce1c3c472826
Instruction Fuzzy Hash: 25D0C271A4911036CB2133366C0AFDB3C288BD2719F28406EF000650C1CABCA182827E

Function 004084B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040616A: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,004084B8,00000000,004083D6,?,00000000,00000104,?), ref: 00406175

strrchr.MSVCRT ref: 004084BB
strcat.MSVCRT(00000000,_lng.ini,00000000,00000104,?), ref: 004084D0

Strings

_lng.ini, xrefs: 004084CA

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileModuleNamestrcatstrrchr
String ID: _lng.ini
API String ID: 3097366151-1948609170
Opcode ID: 2d253c9011988194c7ab29affedf6fb1a5ea8153034ac82cdf8f1fb697810a88
Instruction ID: 42c27a01d44ad3a484ea9941e8a753782f6a4a1a49f0a0828630b4f1254f47e7
Opcode Fuzzy Hash: 2d253c9011988194c7ab29affedf6fb1a5ea8153034ac82cdf8f1fb697810a88
Instruction Fuzzy Hash: 98C0126924565024D12621215E03B8A09494F26319F24416BF501781C3EE9C46E1806E

Function 00406552 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00418388,open,?,0041344F,0041344F,00000005), ref: 00406568

Strings

O4A, xrefs: 00406554
open, xrefs: 0040655F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: O4A$open
API String ID: 587946157-3166864092
Opcode ID: 9e6802b33b5cac27b58214f79fa19b5d011751a3236ad9fa1aa3ed0329bb7868
Instruction ID: 449ca028383310d53200be1944a6bd751f504fbe34d0cfd866494f64672fa994
Opcode Fuzzy Hash: 9e6802b33b5cac27b58214f79fa19b5d011751a3236ad9fa1aa3ed0329bb7868
Instruction Fuzzy Hash: C5C012B12902027AEA114E30EC09F6A7A98DB84F02F104429B601E80E0DB5188885A1E

Function 00407570 Relevance: 5.1, APIs: 4, Instructions: 104stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0040757F
memset.MSVCRT ref: 004075B7
memcpy.MSVCRT ref: 00407674
LocalFree.KERNEL32(00000000,?,?,?,?,76DBEB20,?,00000000), ref: 0040769F

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLocalmemcpymemsetstrlen
String ID:
API String ID: 3110682361-0
Opcode ID: 4a01b5491f9ecde230b25e47fc41df6e3a48aedd09d870957f2f4d0e5019b56d
Instruction ID: a7b320da169f7f969887caa54c031871a44602910a4795043d90d4c59a740d9e
Opcode Fuzzy Hash: 4a01b5491f9ecde230b25e47fc41df6e3a48aedd09d870957f2f4d0e5019b56d
Instruction Fuzzy Hash: B0312972D0011D9BDB10DB68CC81BDEBBB8EF45318F1006B6E545B3281DA79AE858B95

Function 00408638 Relevance: 5.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00406578: memset.MSVCRT ref: 00406586

??2@YAPAXI@Z.MSVCRT ref: 0040864D
??2@YAPAXI@Z.MSVCRT ref: 00408676
??2@YAPAXI@Z.MSVCRT ref: 00408697
??2@YAPAXI@Z.MSVCRT ref: 004086B8

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: eb03ff296926441e48f35a82af38a44947cfbfa61d2a0b9abfff05ba54c8add2
Instruction ID: a93534bcf4590af08eae181cf0f7bc47295f2e33990000f3cf4a50e67893865e
Opcode Fuzzy Hash: eb03ff296926441e48f35a82af38a44947cfbfa61d2a0b9abfff05ba54c8add2
Instruction Fuzzy Hash: 8421E7B0A003008ED7519F2A9645A55FBE4FF9431072AC9AFD259CB3B2DBF9C880DB14

Function 00406AA3 Relevance: 5.1, APIs: 4, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00406AAF
free.MSVCRT(?,00000001,?,00000000,?,?,00406F39,?,00000000,?,?), ref: 00406ACF

Part of subcall function 00406104: malloc.MSVCRT ref: 00406120
Part of subcall function 00406104: memcpy.MSVCRT ref: 00406138
Part of subcall function 00406104: free.MSVCRT(00000000,00000000,76F90A60,00406B78,00000001,?,00000000,76F90A60,00406EF2,00000000,?,?), ref: 00406141

free.MSVCRT(?,00000001,?,00000000,?,?,00406F39,?,00000000,?,?), ref: 00406AF2
memcpy.MSVCRT ref: 00406B12

Memory Dump Source

Source File: 00000000.00000002.2791520693.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2791507099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791537341.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791549829.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2791561829.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: free$memcpy$mallocstrlen
String ID:
API String ID: 3669619086-0
Opcode ID: fe556f8fd747337398a4671f90261db5b892e00cab488469f465dd59fda81595
Instruction ID: b9d8f5a2f56f362531d37561c783707772d91941aea6ec8fb4057fc73eb697f3
Opcode Fuzzy Hash: fe556f8fd747337398a4671f90261db5b892e00cab488469f465dd59fda81595
Instruction Fuzzy Hash: A7119D72200600EFD730EF18D88199AB7F5EF48324B108A2EF556A7692C7B5FD25CB54

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exePID: 5320, Parent PID: 3504

Windows Analysis Report
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

Function 004073B6 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143
stringCOMMON

Function 00403C17 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 184
librarystringloaderCOMMON

Function 00401E4A Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261
stringregistryCOMMON

Function 0040BB8D Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 169
COMMON

Function 0040A88E Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 285
windowregistrystringCOMMON

Function 0040A02E Relevance: 25.6, APIs: 17, Instructions: 108
windowCOMMON

Function 0040E057 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 101
registryCOMMON

Function 0040B656 Relevance: 18.1, APIs: 12, Instructions: 142
windowCOMMON

Function 0041211A Relevance: 18.1, APIs: 12, Instructions: 128
COMMON

Function 004113C4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97
stringCOMMON

Function 0040B91E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71
stringwindowCOMMON

Function 0040378B Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 86
stringCOMMON

Function 0040A7B2 Relevance: 12.1, APIs: 8, Instructions: 76
COMMON

Function 0040B84C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64
registryCOMMON

Function 004034A5 Relevance: 10.5, APIs: 4, Strings: 3, Instructions: 47
stringCOMMON