Edit tour

Windows Analysis Report
PI_230524.exe

Overview

General Information

Sample name:	PI_230524.exe
Analysis ID:	1447911
MD5:	030c15387f508bd9bc1f38fffd928eef
SHA1:	679ee5f887f33d2c78e4b0ca4471fe9e9d39e7a2
SHA256:	1445ff0436a861d28cd25bd638f2e018fb0c8229afee0b6f40d5fcf1a855c2a0
Tags:	exe
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

PI_230524.exe (PID: 4240 cmdline: "C:\Users\user\Desktop\PI_230524.exe" MD5: 030C15387F508BD9BC1F38FFFD928EEF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: PI_230524.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: PI_230524.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765
Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_004062F0 FindFirstFileA,FindClose,	0_2_004062F0
Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_004057B5 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057B5

Source: PI_230524.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PI_230524.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PI_230524.exe, 00000000.00000003.1471681218.0000000000A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Errors

Source: C:\Users\user\Desktop\PI_230524.exe

Code function: 0_2_00405252 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405252

Source: C:\Users\user\Desktop\PI_230524.exe

Code function: 0_2_00403248 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403248

Source: PI_230524.exe, 00000000.00000000.1470807486.00000000007CC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesemirelief.exeP vs PI_230524.exe
Source: PI_230524.exe	Binary or memory string: OriginalFilenamesemirelief.exeP vs PI_230524.exe

Source: PI_230524.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\PI_230524.exe

0_2_00403248

Source: C:\Users\user\Desktop\PI_230524.exe

Code function: 0_2_0040450D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040450D

Source: C:\Users\user\Desktop\PI_230524.exe

Code function: 0_2_00402138 CoCreateInstance,MultiByteToWideChar,

0_2_00402138

Source: C:\Users\user\Desktop\PI_230524.exe

File created: C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp

Jump to behavior

Source: PI_230524.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI_230524.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PI_230524.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PI_230524.exe

File read: C:\Users\user\Desktop\PI_230524.exe

Jump to behavior

Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_230524.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\PI_230524.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: PI_230524.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PI_230524.exe

Static PE information: real checksum: 0x878b3 should be: 0x8fe0e

Source: C:\Users\user\Desktop\PI_230524.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\PI_230524.exe

API coverage: 9.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765
Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_004062F0 FindFirstFileA,FindClose,	0_2_004062F0
Source: C:\Users\user\Desktop\PI_230524.exe	Code function: 0_2_004057B5 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057B5

Source: C:\Users\user\Desktop\PI_230524.exe

API call chain: ExitProcess graph end node

graph_0-2950

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PI_230524.exe

0_2_00403248

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Clipboard Data	Data Obfuscation	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Errors	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Errors	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Errors	PI_230524.exe, 00000000.00000003.1471681218.0000000000A2D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	PI_230524.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	PI_230524.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447911
Start date and time:	2024-05-27 12:18:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PI_230524.exe
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.972388023488223
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PI_230524.exe
File size:	544'752 bytes
MD5:	030c15387f508bd9bc1f38fffd928eef
SHA1:	679ee5f887f33d2c78e4b0ca4471fe9e9d39e7a2
SHA256:	1445ff0436a861d28cd25bd638f2e018fb0c8229afee0b6f40d5fcf1a855c2a0
SHA512:	a42a543f3cf68c9e420c498bf0e7cc101ea5828ce51ada90398c357d2fc02651183fe59696d806fb0f3a112fdcf9c10ae0facc52f4cd060ab1a78df48e418e60
SSDEEP:	6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbz:8K6+L761MymflCYX+EixjlGC
TLSH:	DFC4D0A3F120588FFC602BF04C1D96347674BE4A91B80F3A658177EB727F862A1476E5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........r.../...............+.......Rich............PE..L......].................b....9.....H2............@

File Icon


Icon Hash:	199bb3bf5f4d0d07

Static PE Info

General

Entrypoint:	0x403248
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4D5 [Mon Dec 16 00:50:29 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e9c0657252137ac61c1eeeba4c021000

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080A0h]
call dword ptr [0040809Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A2F4Ch], eax
je 00007F53150B2103h
push ebx
call 00007F53150B51EBh
cmp eax, ebx
je 00007F53150B20F9h
push 00000C00h
call eax
mov esi, 00408298h
push esi
call 00007F53150B5167h
push esi
call dword ptr [00408098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F53150B20DDh
push 0000000Ah
call 00007F53150B51BFh
push 00000008h
call 00007F53150B51B8h
push 00000006h
mov dword ptr [007A2F44h], eax
call 00007F53150B51ACh
cmp eax, ebx
je 00007F53150B2101h
push 0000001Eh
call eax
test eax, eax
je 00007F53150B20F9h
or byte ptr [007A2F4Fh], 00000040h
push ebp
call dword ptr [00408040h]
push ebx
call dword ptr [00408284h]
mov dword ptr [007A3018h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079E508h
call dword ptr [00408178h]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b3000	0x28608	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x84578	0xa78	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x60d8	0x6200	e59663060e65803bb6474d2af98f8aa9	False	0.6750637755102041	data	6.467400856752681	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x123e	0x1400	7969015d02b2f673463f43156b28cdb4	False	0.428515625	data	5.032652926909017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x399058	0x400	2d383339e780dfc9691f30584bbd0766	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a4000	0xf000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b3000	0x28608	0x28800	ede5a8755ab4c8277abbf0838590eb8a	False	0.21144989390432098	data	3.2566612538812296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b3388	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.1756624866911156
RT_ICON	0x3c3bb0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.2090866092074837
RT_ICON	0x3cd058	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.2295286506469501
RT_ICON	0x3d24e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.22461029759093057
RT_ICON	0x3d6708	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.27323651452282155
RT_ICON	0x3d8cb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.299718574108818
RT_ICON	0x3d9d58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.375
RT_ICON	0x3da6e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.44680851063829785
RT_DIALOG	0x3dab48	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3dac90	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x3dadb0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3daed0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3daf98	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3daff8	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x3db070	0x258	data	English	United States	0.49833333333333335
RT_MANIFEST	0x3db2c8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileTime, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, MultiByteToWideChar, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetForegroundWindow, ShowWindow, SetWindowLongA, SendMessageTimeoutA, FindWindowExA, IsWindow, AppendMenuA, TrackPopupMenu, CreatePopupMenu, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:19:33
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PI_230524.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PI_230524.exe"
Imagebase:	0x400000
File size:	544'752 bytes
MD5 hash:	030C15387F508BD9BC1F38FFFD928EEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.9%
Total number of Nodes:	1258
Total number of Limit Nodes:	15

Executed Functions

Function 00403248 Relevance: 82.6, APIs: 32, Strings: 15, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040326D
GetVersion.KERNEL32 ref: 00403273
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032A6
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004032E2
OleInitialize.OLE32(00000000), ref: 004032E9
SHGetFileInfoA.SHELL32(0079E508,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403305
GetCommandLineA.KERNEL32(007A2740,NSIS Error,?,00000006,00000008,0000000A), ref: 0040331A
CharNextA.USER32(00000000,007A9000,00000020,007A9000,00000000,?,00000006,00000008,0000000A), ref: 00403356
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403453
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403464
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403470
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403484
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040348C
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040349D
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004034A5
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp,?,00000006,00000008,0000000A), ref: 004034B9

Part of subcall function 00406385: GetModuleHandleA.KERNEL32(?,?,?,004032BB,0000000A), ref: 00406397
Part of subcall function 00406385: GetProcAddress.KERNEL32(00000000,?), ref: 004063B2

Part of subcall function 0040380A: lstrlenA.KERNEL32(007A1EE0,?,?,?,007A1EE0,00000000,007A9400,C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp,0079F548,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079F548,00000000,00000002,774D3410), ref: 004038FA
Part of subcall function 0040380A: lstrcmpiA.KERNEL32(?,.exe), ref: 0040390D
Part of subcall function 0040380A: GetFileAttributesA.KERNEL32(007A1EE0), ref: 00403918
Part of subcall function 0040380A: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,007A9400), ref: 00403961
Part of subcall function 0040380A: RegisterClassA.USER32(007A26E0), ref: 0040399E

Part of subcall function 00403730: FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403567,?,?,00000006,00000008,0000000A), ref: 0040373B

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 00403567
ExitProcess.KERNEL32 ref: 00403588
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 004036A5
OpenProcessToken.ADVAPI32(00000000), ref: 004036AC
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036C4
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004036E3
ExitWindowsEx.USER32(00000002,80040002), ref: 00403707
ExitProcess.KERNEL32 ref: 0040372A

Part of subcall function 00405709: MessageBoxIndirectA.USER32(0040A218), ref: 00405764

Strings

TMP, xrefs: 004034A0
", xrefs: 0040337B
SeShutdownPrivilege, xrefs: 004036BE
NSIS Error, xrefs: 0040330B
TEMP, xrefs: 00403498
C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp, xrefs: 004034B4
\Temp, xrefs: 0040346A
`KNw, xrefs: 00403491
UXTHEME, xrefs: 0040329A, 0040329F, 004032A5
Error launching installer, xrefs: 0040351F
~nsu, xrefs: 00403593
C:\Users\user\Desktop\PI_230524.exe, xrefs: 00403645
Low, xrefs: 00403486
C:\Users\user\AppData\Local\Temp\, xrefs: 00403448, 0040344D, 00403463, 0040346F, 0040347E, 0040348B, 00403497, 0040349F, 00403598, 004035A9, 004035B4, 004035C0, 004035CD, 004035DC, 0040368B
.tmp, xrefs: 004035AF

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentPathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesChangeCharClassCloseCommandCurrentDeleteDirectoryErrorFindHandleImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextNotificationOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$.tmp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp$C:\Users\user\Desktop\PI_230524.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`KNw$~nsu
API String ID: 3490464366-2666391173
Opcode ID: f737f156c0f066e0fbbf5cd976734ba5127bb16941bff7a59df7ef59bde2d3c1
Instruction ID: 4b1384cee9ffc8e7d3909f75f513e580ba658b4e0f6039b9d7a5280b54d142a8
Opcode Fuzzy Hash: f737f156c0f066e0fbbf5cd976734ba5127bb16941bff7a59df7ef59bde2d3c1
Instruction Fuzzy Hash: B3C1E870104741AAD7216F759D89A2F3FA8AB86306F05453FF581B61E2CB7C8A15CB2E

Function 00406317 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040632E
wsprintfA.USER32 ref: 00406367
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040637B

Strings

UXTHEME, xrefs: 00406320
%s%s.dll, xrefs: 00406361
\, xrefs: 0040633F

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction ID: 3c3b4468b6e1923fcac8586f88cca04ee8b9faba7420f287fa6fd57e775497b1
Opcode Fuzzy Hash: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction Fuzzy Hash: B2F0FC70500609ABDB14ABA4DD0DFEB765CAB08304F14057AA987E10C1D678E4358B98

Function 00405BB5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BC9
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405BE3

Strings

nsa, xrefs: 00405BC0
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BB8

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-386316673
Opcode ID: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction ID: d190f65444f006a88ba75eae1d2615f44ee573feb2fe82d01cd284afd59f947a
Opcode Fuzzy Hash: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction Fuzzy Hash: C1F082363042086BDB109F56DD04B9B7BA9DFA1750F10803BFA489A280D6B4E9558758

Function 00406385 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032BB,0000000A), ref: 00406397
GetProcAddress.KERNEL32(00000000,?), ref: 004063B2

Part of subcall function 00406317: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040632E
Part of subcall function 00406317: wsprintfA.USER32 ref: 00406367
Part of subcall function 00406317: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040637B

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction ID: 1c2fb029b914f91a359858a8292288339c30c15ea481b8388e8a6490942e710a
Opcode Fuzzy Hash: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction Fuzzy Hash: C3E086326042105BD62156709E0493B62ACDF84700306083EFE47F2240D73CDC31A6A9

Function 00405B86 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\PI_230524.exe,80000000,00000003), ref: 00405B8A
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BAC

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction ID: 6905ba7dec075751c4c8bdaf1e97cd52a4ed4154a0977e2bcfee25d1bc4df630
Opcode Fuzzy Hash: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction Fuzzy Hash: F5D09E31254201EFEF098F20DE16F2EBBA2EB94B00F11952CB682944E1DA715819AB19

Function 00405657 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,0040323B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 0040565D
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040566B

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction ID: c315ded7713b9b4a851445b4695441f34a70141ed77257200a8001455a195bbd
Opcode Fuzzy Hash: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction Fuzzy Hash: 33C08C30200501DBD6000B308F08F073A51AB80780F01883E608AE00B0CA318055CD2E

Function 00405BFE Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031FD,00000000,00000000,0040304A,000000FF,00000004,00000000,00000000,00000000), ref: 00405C12

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction ID: 15bd5d27262360345a0b198e16330f5e3575b7202d491c56c7af192eda573772
Opcode Fuzzy Hash: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction Fuzzy Hash: C8E0EC3261876AABEF109E55AC00AEB7BACEB05760F004836FD15E3190D631E9619BA4

Function 00405709 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxIndirectA.USER32(0040A218), ref: 00405764

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: 62c5b0eb7c63afc99d73ac8db942d0bb6353485fd66c6514a541e2944687cd86
Instruction ID: 3dc84172ab1948e17b292d16fa2bdefbde75fb7420590b4168975b9309a56cb2
Opcode Fuzzy Hash: 62c5b0eb7c63afc99d73ac8db942d0bb6353485fd66c6514a541e2944687cd86
Instruction Fuzzy Hash: E0F0DF75540700DFC354CF68EA48B1A3AE0B38A314F10857EE045A73B0CBBA8995CF0E

Function 00403730 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403567,?,?,00000006,00000008,0000000A), ref: 0040373B

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0f01ab086a8a45582f9983883c33c268901e9aba51cbceae3897448642b4cfaa
Instruction ID: f7df85554eedfda0b565b912bd668886130a74f5d308d628cb715b7cb4b626cd
Opcode Fuzzy Hash: 0f01ab086a8a45582f9983883c33c268901e9aba51cbceae3897448642b4cfaa
Instruction Fuzzy Hash: B6C022B0000300B2C0202F348E8F9043A545B81733B504334B0B4F20F0E73C024A851F

Function 00403200 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 0040320E

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction ID: 81fdcbbc46e9ac73494c3809a02cbb86869920566b24394b282a4516d046c7b0
Opcode Fuzzy Hash: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction Fuzzy Hash: 32B01231140300BFDA214F00DF09F057B21AB90700F10C034B384780F086711075EB0D

Non-executed Functions

Function 00405252 Relevance: 54.3, APIs: 36, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004052B1
GetDlgItem.USER32(?,000003EE), ref: 004052C0
GetClientRect.USER32(?,?), ref: 004052FD
GetSystemMetrics.USER32(00000002), ref: 00405304
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405325
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405336
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405349
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405357
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040536A
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040538C
ShowWindow.USER32(?,00000008), ref: 004053A0
GetDlgItem.USER32(?,000003EC), ref: 004053C1
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053D1
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053EA
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F6
GetDlgItem.USER32(?,000003F8), ref: 004052CF

Part of subcall function 004040B0: SendMessageA.USER32(00000028,?,00000001,00403EE0), ref: 004040BE

GetDlgItem.USER32(?,000003EC), ref: 00405412
CreateThread.KERNEL32(00000000,00000000,Function_000051E6,00000000), ref: 00405420
CloseHandle.KERNEL32(00000000), ref: 00405427
ShowWindow.USER32(00000000), ref: 0040544A
ShowWindow.USER32(?,00000008), ref: 00405451
ShowWindow.USER32(00000008), ref: 00405497
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054CB
CreatePopupMenu.USER32 ref: 004054DC
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054F1
GetWindowRect.USER32(?,000000FF), ref: 00405511
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040552A
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405566
OpenClipboard.USER32(00000000), ref: 00405576
EmptyClipboard.USER32 ref: 0040557C
GlobalAlloc.KERNEL32(00000042,?), ref: 00405585
GlobalLock.KERNEL32(00000000), ref: 0040558F
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004055A3
GlobalUnlock.KERNEL32(00000000), ref: 004055BC
SetClipboardData.USER32(00000001,00000000), ref: 004055C7
CloseClipboard.USER32 ref: 004055CD

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 0cf01cadeabcebf2b135dee13ce5d82c0f79d672f591187209f107e5b1009d3a
Instruction ID: e249d6b51738ec221da1a53d9ec42c2df55930041f70e6241115b0d1b6ef0d10
Opcode Fuzzy Hash: 0cf01cadeabcebf2b135dee13ce5d82c0f79d672f591187209f107e5b1009d3a
Instruction Fuzzy Hash: D0A15AB1900608BFDF119F64DD85EAF7BB9FB48344F10802AFA41B61A1CB794E519F68

Function 0040450D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040455C
SetWindowTextA.USER32(00000000,?), ref: 00404586
SHBrowseForFolderA.SHELL32(?,0079E920,?), ref: 00404637
CoTaskMemFree.OLE32(00000000), ref: 00404642
lstrcmpiA.KERNEL32(007A1EE0,0079F548), ref: 00404674
lstrcatA.KERNEL32(?,007A1EE0), ref: 00404680
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404692

Part of subcall function 004056ED: GetDlgItemTextA.USER32(?,?,00000400,004046C9), ref: 00405700

Part of subcall function 00406257: CharNextA.USER32(?,*?|<>/":,00000000,007A9000,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062AF
Part of subcall function 00406257: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062BC
Part of subcall function 00406257: CharNextA.USER32(?,007A9000,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062C1
Part of subcall function 00406257: CharPrevA.USER32(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062D1

GetDiskFreeSpaceA.KERNEL32(0079E518,?,?,0000040F,?,0079E518,0079E518,?,00000001,0079E518,?,?,000003FB,?), ref: 00404750
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040476B

Part of subcall function 004048C4: lstrlenA.KERNEL32(0079F548,0079F548,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047DF,000000DF,00000000,00000400,?), ref: 00404962
Part of subcall function 004048C4: wsprintfA.USER32 ref: 0040496A
Part of subcall function 004048C4: SetDlgItemTextA.USER32(?,0079F548), ref: 0040497D

Strings

A, xrefs: 00404630

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 2729945231cc1eabc37d96e3fbba1326c20a72cf2850507f8829a344f1910413
Instruction ID: c53a8e09cffb511e2e8442f8e0ee4109053d5ca2156788ad792cf5210b9728ca
Opcode Fuzzy Hash: 2729945231cc1eabc37d96e3fbba1326c20a72cf2850507f8829a344f1910413
Instruction Fuzzy Hash: F4A17FB1900209ABDB11AFA5CD45AAFB7B8EF85314F14843BF601B62D1D77C8A418F69

Function 004057B5 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057DE
lstrcatA.KERNEL32(007A0550,\*.*,007A0550,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405826
lstrcatA.KERNEL32(?,0040A014,?,007A0550,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405847
lstrlenA.KERNEL32(?,?,0040A014,?,007A0550,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040584D
FindFirstFileA.KERNEL32(007A0550,?,?,?,0040A014,?,007A0550,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040585E
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040590B
FindClose.KERNEL32(00000000), ref: 0040591C

Strings

\*.*, xrefs: 00405820
C:\Users\user\AppData\Local\Temp\, xrefs: 004057C2

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3720340875
Opcode ID: 1a15b25e8bfe87e1af104103bdf3e99bfca013edf893b05c38c06cdbf565d018
Instruction ID: eea8dcc9899e8fe382e67b4d85d328ba4a3fbbae0ab86688a1659871ceec6938
Opcode Fuzzy Hash: 1a15b25e8bfe87e1af104103bdf3e99bfca013edf893b05c38c06cdbf565d018
Instruction Fuzzy Hash: 4051E171800A08FADF226B618C45FAF7A78DF42728F14807BF841B51D2D73C4992DE69

Function 00402138 Relevance: 3.1, APIs: 2, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408410,?,00000001,00408400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ce8467096b07ca22e23759a4895ee2c1e39a00ffcdf52229bf2ef5a9744d8bac
Instruction ID: b20e6ddc0005349e031541e3270fed9150ef90c2934288fc693311ea7f84ec63
Opcode Fuzzy Hash: ce8467096b07ca22e23759a4895ee2c1e39a00ffcdf52229bf2ef5a9744d8bac
Instruction Fuzzy Hash: 1F511871A00209AFCF00DFE4C988A9D7BB5FF48314F2085AAF515EB2D1DB799941CB54

Function 004062F0 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(774D3410,007A0D98,007A0950,00405AB6,007A0950,007A0950,00000000,007A0950,007A0950,774D3410,?,C:\Users\user\AppData\Local\Temp\,004057D5,?,774D3410,C:\Users\user\AppData\Local\Temp\), ref: 004062FB
FindClose.KERNEL32(00000000), ref: 00406307

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6492e11af6876ec85f54452a190d9404ba6d94e49271ee4e7d15c167f534e484
Instruction ID: 3919553d01c23f7351ed85dbc682ed8077fcf54d37e588a2b2de2e61cdf0a9ad
Opcode Fuzzy Hash: 6492e11af6876ec85f54452a190d9404ba6d94e49271ee4e7d15c167f534e484
Instruction Fuzzy Hash: 14D012325451205BC75017786E0C88B7A589F963717214B36F9AAF61E0CB748C238AD8

Function 00402765 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402774

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 8a4b04becd242fba5d32797a1901637a58f3b6b856015b6a01afc789646fda0b
Instruction ID: 242f43cfa1d4ef5d1935b54718e26804d33959e399511836c9edd6ef5d071c48
Opcode Fuzzy Hash: 8a4b04becd242fba5d32797a1901637a58f3b6b856015b6a01afc789646fda0b
Instruction Fuzzy Hash: 5AF0A0725441009BD701EBB49A49AEEB768AF26324F6041BBE141F21C1D6B889459B6A

Function 00404A80 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404A97
GetDlgItem.USER32(?,00000408), ref: 00404AA4
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AF3
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404B0A
SetWindowLongA.USER32(?,000000FC,00405088), ref: 00404B24
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B36
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B4A
SendMessageA.USER32(?,00001109,00000002), ref: 00404B60
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6C
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B7C
DeleteObject.GDI32(00000110), ref: 00404B81
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAC
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BB8
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C52
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404C82

Part of subcall function 004040B0: SendMessageA.USER32(00000028,?,00000001,00403EE0), ref: 004040BE

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C96
GetWindowLongA.USER32(?,000000F0), ref: 00404CC4
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CD2
ShowWindow.USER32(?,00000005), ref: 00404CE2
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DDD
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E42
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E57
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E7B
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E9B
ImageList_Destroy.COMCTL32(?), ref: 00404EB0
GlobalFree.KERNEL32(?), ref: 00404EC0
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F39
SendMessageA.USER32(?,00001102,?,?), ref: 00404FE2
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FF1
InvalidateRect.USER32(?,00000000,00000001), ref: 00405011
ShowWindow.USER32(?,00000000), ref: 0040505F
GetDlgItem.USER32(?,000003FE), ref: 0040506A
ShowWindow.USER32(00000000), ref: 00405071

Strings

N, xrefs: 00404D1B
, xrefs: 00405049
M, xrefs: 00404C3A

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 11382514075a367b9a534aa2b94e13823d28ce86ee40b18e943e52e9e4fd8364
Instruction ID: a268e52f59abad667f40846b9330857a26eef97fbfd8c04b7b0b2c1eeebe026e
Opcode Fuzzy Hash: 11382514075a367b9a534aa2b94e13823d28ce86ee40b18e943e52e9e4fd8364
Instruction Fuzzy Hash: 56026DB0900209EFEB109FA8DD45AAE7BB5FB84314F10813AF610B62E1D7789D52DF58

Function 00403BA7 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403BE3
ShowWindow.USER32(?), ref: 00403C00
DestroyWindow.USER32 ref: 00403C14
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C30
GetDlgItem.USER32(?,?), ref: 00403C51
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C65
IsWindowEnabled.USER32(00000000), ref: 00403C6C
GetDlgItem.USER32(?,00000001), ref: 00403D1A
GetDlgItem.USER32(?,00000002), ref: 00403D24
SetClassLongA.USER32(?,000000F2,?), ref: 00403D3E
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D8F
GetDlgItem.USER32(?,00000003), ref: 00403E35
ShowWindow.USER32(00000000,?), ref: 00403E56
EnableWindow.USER32(?,?), ref: 00403E68
EnableWindow.USER32(?,?), ref: 00403E83
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E99
EnableMenuItem.USER32(00000000), ref: 00403EA0
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EB8
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403ECB
lstrlenA.KERNEL32(0079F548,?,0079F548,00000000), ref: 00403EF5
SetWindowTextA.USER32(?,0079F548), ref: 00403F04
ShowWindow.USER32(?,0000000A), ref: 00404038

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: e0d780eba1b088fa93d6fd4ed72d6ff884873a26146dcd9c5e819f50ed4c5972
Instruction ID: b507ef7cb9582abf258fe264cbdb2372651992ce94f69c67437d7eaacc5d437d
Opcode Fuzzy Hash: e0d780eba1b088fa93d6fd4ed72d6ff884873a26146dcd9c5e819f50ed4c5972
Instruction Fuzzy Hash: 09C1B0B1500204AFDB216F25EE85E2B7AB9EB8630AF00853EF741B11F1CB3D59529B5D

Function 0040380A Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406385: GetModuleHandleA.KERNEL32(?,?,?,004032BB,0000000A), ref: 00406397
Part of subcall function 00406385: GetProcAddress.KERNEL32(00000000,?), ref: 004063B2

lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp,0079F548,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079F548,00000000,00000002,774D3410,C:\Users\user\AppData\Local\Temp\,007A9000,00000000), ref: 00403885
lstrlenA.KERNEL32(007A1EE0,?,?,?,007A1EE0,00000000,007A9400,C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp,0079F548,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079F548,00000000,00000002,774D3410), ref: 004038FA
lstrcmpiA.KERNEL32(?,.exe), ref: 0040390D
GetFileAttributesA.KERNEL32(007A1EE0), ref: 00403918
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,007A9400), ref: 00403961

Part of subcall function 00405F4B: wsprintfA.USER32 ref: 00405F58

RegisterClassA.USER32(007A26E0), ref: 0040399E
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039B6
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004039EB
ShowWindow.USER32(00000005,00000000), ref: 00403A21
GetClassInfoA.USER32(00000000,RichEdit20A,007A26E0), ref: 00403A4D
GetClassInfoA.USER32(00000000,RichEdit,007A26E0), ref: 00403A5A
RegisterClassA.USER32(007A26E0), ref: 00403A63
DialogBoxParamA.USER32(?,00000000,00403BA7,00000000), ref: 00403A82

Strings

.DEFAULT\Control Panel\International, xrefs: 00403870
&z, xrefs: 00403970
Control Panel\Desktop\ResourceLocale, xrefs: 0040383E
.exe, xrefs: 00403907
RichEdit20A, xrefs: 00403A45, 00403A4B
_Nb, xrefs: 0040397D, 004039E5
RichEd32, xrefs: 00403A35
RichEd20, xrefs: 00403A27
C:\Users\user\AppData\Local\Temp\, xrefs: 0040380F
RichEdit, xrefs: 00403A54
C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp, xrefs: 0040382A, 00403880

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsr7BEF.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$&z
API String ID: 1975747703-1577551956
Opcode ID: 6a61cbbd4cf0e9c1d01e5c8b3980943b7258060f4ff29637f7b3df1c92db6b4f
Instruction ID: 79248491ef2bc55f5e0c4717b820805706146ebb855d4f379394f0877404e8f0
Opcode Fuzzy Hash: 6a61cbbd4cf0e9c1d01e5c8b3980943b7258060f4ff29637f7b3df1c92db6b4f
Instruction Fuzzy Hash: 6C61C6B0240640BED610AF659D45F3B3A6CD785749F10813FF985B62E2DB7D9D028B2D

Function 004041E6 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404271
GetDlgItem.USER32(00000000,000003E8), ref: 00404285
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042A3
GetSysColor.USER32(?), ref: 004042B4
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042C3
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042D2
lstrlenA.KERNEL32(?), ref: 004042D5
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004042E4
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004042F9
GetDlgItem.USER32(?,0000040A), ref: 0040435B
SendMessageA.USER32(00000000), ref: 0040435E
GetDlgItem.USER32(?,000003E8), ref: 00404389
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043C9
LoadCursorA.USER32(00000000,00007F02), ref: 004043D8
SetCursor.USER32(00000000), ref: 004043E1
LoadCursorA.USER32(00000000,00007F00), ref: 004043F7
SetCursor.USER32(00000000), ref: 004043FA
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404426
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040443A

Strings

N, xrefs: 00404377

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: 614c9b85214c3d5e686e74a77366cc7cd529f3e87e761fa153b01f37f43dbd0e
Instruction ID: a3db5b80d5f6c8d56f7a184239f37e003a0a90a84a660de175ffc46cbe068f47
Opcode Fuzzy Hash: 614c9b85214c3d5e686e74a77366cc7cd529f3e87e761fa153b01f37f43dbd0e
Instruction Fuzzy Hash: D361B5B1A40204BFEF109F60DD45F6A7B69FB84704F10802AFB05BA1D1C7B8A951CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,007A2740,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 05824d38ae5bde523e5173ae22b7a6f865c3ebb6508bc10e30638da455cbe7df
Instruction ID: 1ef7ef1d3183d2fe833be2fdc16277d02f602c466de40d92ea6efb336f18bcfe
Opcode Fuzzy Hash: 05824d38ae5bde523e5173ae22b7a6f865c3ebb6508bc10e30638da455cbe7df
Instruction Fuzzy Hash: 53417C71400249AFCB058FA5DE459BF7BB9FF45314F00802EF9A1AA1A0C778DA55DFA4

Function 00402DC4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\PI_230524.exe,00000400), ref: 00402DF1

Part of subcall function 00405B86: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\PI_230524.exe,80000000,00000003), ref: 00405B8A
Part of subcall function 00405B86: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BAC

GetFileSize.KERNEL32(00000000,00000000,007AB000,00000000,007A9C00,007A9C00,C:\Users\user\Desktop\PI_230524.exe,C:\Users\user\Desktop\PI_230524.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNEL32(00000040,00000020), ref: 00402F73

Strings

Error launching installer, xrefs: 00402E14
Null, xrefs: 00402EBB
soft, xrefs: 00402EB2
C:\Users\user\Desktop\PI_230524.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
Inst, xrefs: 00402EA9
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\PI_230524.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-691260160
Opcode ID: 9736e98eac310f7701a3f26dbce612acab20a0efd3b563572a6f480415ef6cfa
Instruction ID: 59d678f17646e0847602a4e6c91a81595dbc35b8f9b1ca6258d7792959114811
Opcode Fuzzy Hash: 9736e98eac310f7701a3f26dbce612acab20a0efd3b563572a6f480415ef6cfa
Instruction Fuzzy Hash: 0F510971900216AFDB109F64CE89B9E7BB8EB55355F10403BF904B62C1C7BC9E81AB5D

Function 00405C5C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405DED,?,?), ref: 00405C8D
GetShortPathNameA.KERNEL32(?,007A12D8,00000400), ref: 00405C96

Part of subcall function 00405AEB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D46,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AFB
Part of subcall function 00405AEB: lstrlenA.KERNEL32(00000000,?,00000000,00405D46,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B2D

GetShortPathNameA.KERNEL32(?,007A16D8,00000400), ref: 00405CB3
wsprintfA.USER32 ref: 00405CD1
GetFileSize.KERNEL32(00000000,00000000,007A16D8,C0000000,00000004,007A16D8,?,?,?,?,?), ref: 00405D0C
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D1B
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D53
SetFilePointer.KERNEL32(0040A3B8,00000000,00000000,00000000,00000000,007A0ED8,00000000,-0000000A,0040A3B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405DA9
GlobalFree.KERNEL32(00000000), ref: 00405DBA
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DC1

Part of subcall function 00405B86: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\PI_230524.exe,80000000,00000003), ref: 00405B8A
Part of subcall function 00405B86: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BAC

Strings

[Rename], xrefs: 00405D3B, 00405D4D
%s=%s, xrefs: 00405CC7

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: d25c713501a9bf653a1fcacbbfc2014aaa95160241b761f08358092e952fb18f
Instruction ID: 4ef5f1c50d251b73862b961a89edc9b2cc60572935cd21a4370a6936b8511f12
Opcode Fuzzy Hash: d25c713501a9bf653a1fcacbbfc2014aaa95160241b761f08358092e952fb18f
Instruction Fuzzy Hash: 5231F231201B15ABD2206B659D4DF6B3A6CDF86754F14053FFA01F62D2EA3CE8058EAD

Function 0040600F Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(007A1EE0,00000400), ref: 0040613A
GetWindowsDirectoryA.KERNEL32(007A1EE0,00000400,?,0079ED28,00000000,0040514C,0079ED28,00000000), ref: 0040614D
SHGetSpecialFolderLocation.SHELL32(0040514C,774D23A0,?,0079ED28,00000000,0040514C,0079ED28,00000000), ref: 00406189
SHGetPathFromIDListA.SHELL32(774D23A0,007A1EE0), ref: 00406197
CoTaskMemFree.OLE32(774D23A0), ref: 004061A3
lstrcatA.KERNEL32(007A1EE0,\Microsoft\Internet Explorer\Quick Launch), ref: 004061C7
lstrlenA.KERNEL32(007A1EE0,?,0079ED28,00000000,0040514C,0079ED28,00000000,00000000,?,774D23A0), ref: 00406219

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406109
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061C1

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: 355b90f3f401d120c3d4b6cf139cfaaf503aaee0dfbae073ec691654466f74a4
Instruction ID: d98bd44868bde6ace230f91b8fcf6596fc401970515ead307cdfb18f28ae641c
Opcode Fuzzy Hash: 355b90f3f401d120c3d4b6cf139cfaaf503aaee0dfbae073ec691654466f74a4
Instruction Fuzzy Hash: EE61F471904111AEDF11AF68CC84B7E3BA49B56314F16817FE903BA2D2C73C49A2CB4E

Function 00405114 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000,?), ref: 0040514D
lstrlenA.KERNEL32(00403133,0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000), ref: 0040515D
lstrcatA.KERNEL32(0079ED28,00403133,00403133,0079ED28,00000000,?,774D23A0), ref: 00405170
SetWindowTextA.USER32(0079ED28,0079ED28), ref: 00405182
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A8
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051C2
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051D0

Strings

(y, xrefs: 00405134

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: (y
API String ID: 2531174081-255812342
Opcode ID: 95f89131369c21242812949e714cdf1864596966d358f4f3b94d925066a10f3f
Instruction ID: bffe320471bb4ed621b5b80758aa42b14eae6e2fc0b22327473978c148379bdd
Opcode Fuzzy Hash: 95f89131369c21242812949e714cdf1864596966d358f4f3b94d925066a10f3f
Instruction Fuzzy Hash: 06219D71D00518BBDF119FA9CD80ADEBFB9EF05358F10807AF904B6291C6388E418FA8

Function 004040E2 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004040FF
GetSysColor.USER32(00000000), ref: 0040413D
SetTextColor.GDI32(?,00000000), ref: 00404149
SetBkMode.GDI32(?,?), ref: 00404155
GetSysColor.USER32(?), ref: 00404168
SetBkColor.GDI32(?,?), ref: 00404178
DeleteObject.GDI32(?), ref: 00404192
CreateBrushIndirect.GDI32(?), ref: 0040419C

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction ID: 7e7a0635a9a9ad053635d0a61e184563e53fd5caf941e55c08cb8fd0a55be6c0
Opcode Fuzzy Hash: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction Fuzzy Hash: 312195715007049BD7309F68DD0CB5BBBF4AF91710B048A2EEA96A62E4C738D894CB54

Function 00406257 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,007A9000,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062AF
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062BC
CharNextA.USER32(?,007A9000,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062C1
CharPrevA.USER32(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,00403223,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 004062D1

Strings

*?|<>/":, xrefs: 0040629F
C:\Users\user\AppData\Local\Temp\, xrefs: 00406258

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2950451457
Opcode ID: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction ID: c458f316ef597d28f2da60d7b579c442bef5f501f0b3efb69703b1c7b5c33328
Opcode Fuzzy Hash: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction Fuzzy Hash: 2211E25180479129FB3226280C44FB77F984B9B770F1901BFD4C6722C2C67C5CA6826D

Function 004049CE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049E9
GetMessagePos.USER32 ref: 004049F1
ScreenToClient.USER32(?,?), ref: 00404A0B
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A1D
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A43

Strings

f, xrefs: 00404A1F

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction ID: eb4189dc51e804bfd071b7650a20f4023a9ce92a25ebde304762d3f5d63b5794
Opcode Fuzzy Hash: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction Fuzzy Hash: A7019271E40218BADB00DB94DD81FFEBBBCAF55711F10012BBA00B61C0C7B455018F94

Function 00402CDD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402CF8
MulDiv.KERNEL32(00084574,00000064,?), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402D55

Strings

verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: d2fd7c2642e66b568f2ec6ad1d9ac2acf8620bf8fd7d34c9c6364c2149bd0d5f
Instruction ID: 93681796157c975abd13c8aaf7f83402805495348c169d35143c581ed88c076c
Opcode Fuzzy Hash: d2fd7c2642e66b568f2ec6ad1d9ac2acf8620bf8fd7d34c9c6364c2149bd0d5f
Instruction Fuzzy Hash: 3001FF71640209BBEF109F60DE4AFEE3769EB04345F00803AFA16B51D0DBB999568F59

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403062
GetTickCount.KERNEL32 ref: 004030E6
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 0040310F
wsprintfA.USER32 ref: 0040311F

Strings

... %d%%, xrefs: 00403119

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: fef8aa081522ed2de8415660b51b7b4f98d739dbc9ed57078d116e38b9f19439
Instruction ID: 7192b2bd781d1e73c4002c8dab31bcfd9076020614228c7b813c8c88a4a42f55
Opcode Fuzzy Hash: fef8aa081522ed2de8415660b51b7b4f98d739dbc9ed57078d116e38b9f19439
Instruction Fuzzy Hash: 63517931901209ABCB10DF65DA44A9F7BBCEF18766F14413BE810BB2D0C7799B41CBA9

Function 0040206A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405114: lstrlenA.KERNEL32(0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000,?), ref: 0040514D
Part of subcall function 00405114: lstrlenA.KERNEL32(00403133,0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000), ref: 0040515D
Part of subcall function 00405114: lstrcatA.KERNEL32(0079ED28,00403133,00403133,0079ED28,00000000,?,774D23A0), ref: 00405170
Part of subcall function 00405114: SetWindowTextA.USER32(0079ED28,0079ED28), ref: 00405182
Part of subcall function 00405114: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A8
Part of subcall function 00405114: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051C2
Part of subcall function 00405114: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051D0

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Strings

/z, xrefs: 004020DF

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: /z
API String ID: 2987980305-1190999251
Opcode ID: 76eb37b8e6d31aad23f9fdd74334b5d935c47e479e1adefb058bb3ac25a7cd42
Instruction ID: e61536644f3bf68f7d9d9aba667bc4080f9c9cd2ba15b67bd91c869db9746c0c
Opcode Fuzzy Hash: 76eb37b8e6d31aad23f9fdd74334b5d935c47e479e1adefb058bb3ac25a7cd42
Instruction Fuzzy Hash: 6521C671900214ABCF11BFA4CF89AAE7AB4AF45318F20413BF601B62D1D6FD4982965E

Function 004055DA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040561D
GetLastError.KERNEL32 ref: 00405631
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405646
GetLastError.KERNEL32 ref: 00405650

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405600

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-2145255484
Opcode ID: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction ID: 74ab278e8dc0014e3bb1a2534afc1f4e11ab1799ac02ec3fccaeb9b03a53458b
Opcode Fuzzy Hash: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction Fuzzy Hash: 42011A71C00619EADF009FA1D944BEFBBB8EF14354F00843AD549B6290D77996498FA9

Function 00401759 Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,0040A3E8,007A9800,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,0040A3E8,0040A3E8,00000000,00000000,0040A3E8,007A9800,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405FED: lstrcpynA.KERNEL32(?,?,00000400,0040331A,007A2740,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FFA

Part of subcall function 00405114: lstrlenA.KERNEL32(0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000,?), ref: 0040514D
Part of subcall function 00405114: lstrlenA.KERNEL32(00403133,0079ED28,00000000,?,774D23A0,?,?,?,?,?,?,?,?,?,00403133,00000000), ref: 0040515D
Part of subcall function 00405114: lstrcatA.KERNEL32(0079ED28,00403133,00403133,0079ED28,00000000,?,774D23A0), ref: 00405170
Part of subcall function 00405114: SetWindowTextA.USER32(0079ED28,0079ED28), ref: 00405182
Part of subcall function 00405114: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A8
Part of subcall function 00405114: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051C2
Part of subcall function 00405114: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051D0

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 360689f11c82bba77c7f80d843b2564d1a58c4de77dc1253bfc3ecda3e8a2caf
Instruction ID: 0c6c4ee3c8c955c352dd186891d8ef18ee81d47802e2f4eda18a4991a1bfe0dc
Opcode Fuzzy Hash: 360689f11c82bba77c7f80d843b2564d1a58c4de77dc1253bfc3ecda3e8a2caf
Instruction Fuzzy Hash: D841B471900515BACB10BBB5CD46D9F36B9DF45328B20823FF522F20E2D67C8A519A6E

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D58
GetClientRect.USER32(?,?), ref: 00401D9F
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 13921e806d45149a6dc022ce21c4869d67d4c742d7821b5643b5022a6b36d2ad
Instruction ID: 73b34c0ea56e2209ca6b10ab4d69fe2665be34d6bb8fccc5b8c3de89ec824b9e
Opcode Fuzzy Hash: 13921e806d45149a6dc022ce21c4869d67d4c742d7821b5643b5022a6b36d2ad
Instruction Fuzzy Hash: E8216672D00109AFDB05DF98DE44AEE7BB5FB48300F10407AF945F62A1CB789941CB58

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32(?,00000000), ref: 00401E35
CreateFontIndirectA.GDI32(0040B7E8), ref: 00401E84

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 05f1e8dbd8d2bd980b19a9bf60f2e06b7196c972b172c4b5c644a34e8c2871d7
Instruction ID: 7256709fe02f9cd86de6692cc41f874bddf10922414536e302f1c0253df40f98
Opcode Fuzzy Hash: 05f1e8dbd8d2bd980b19a9bf60f2e06b7196c972b172c4b5c644a34e8c2871d7
Instruction Fuzzy Hash: 3901B571900342AFE7019BB1AE49B997FB4EB55304F104439F251BB1E3CBB800059B6D

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 56024d7b795917ac40a938a9424bf93a2c17818310143ec6cf2dad3ecb35a3ea
Instruction ID: 70c5dabd3ba5e8ff49a6b9f2e1e1e4e729e8b40939c30b800ff2ff7c816f6e1a
Opcode Fuzzy Hash: 56024d7b795917ac40a938a9424bf93a2c17818310143ec6cf2dad3ecb35a3ea
Instruction Fuzzy Hash: 91216BB1944208BEEF06AFA4DD8AAAD7FB5EB44304F10447EF501B61D1C7B88640DB18

Function 004048C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079F548,0079F548,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047DF,000000DF,00000000,00000400,?), ref: 00404962
wsprintfA.USER32 ref: 0040496A
SetDlgItemTextA.USER32(?,0079F548), ref: 0040497D

Strings

%u.%u%s%s, xrefs: 0040494C

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 6d2eeb472e20695eb05127d64b2e12331241c20ef3687a8bfd662f06559d6acd
Instruction ID: 7420f511cdb836142555688b3451de143ce73197971a19baf3312835e895797a
Opcode Fuzzy Hash: 6d2eeb472e20695eb05127d64b2e12331241c20ef3687a8bfd662f06559d6acd
Instruction Fuzzy Hash: 0411DA736441283BEB10657D9C45EAF3298DB86374F260237FA26F31D1E979CC2251E8

Function 00405A73 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405FED: lstrcpynA.KERNEL32(?,?,00000400,0040331A,007A2740,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FFA

Part of subcall function 00405A1E: CharNextA.USER32(?,?,007A0950,?,00405A8A,007A0950,007A0950,774D3410,?,C:\Users\user\AppData\Local\Temp\,004057D5,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A2C
Part of subcall function 00405A1E: CharNextA.USER32(00000000), ref: 00405A31
Part of subcall function 00405A1E: CharNextA.USER32(00000000), ref: 00405A45

lstrlenA.KERNEL32(007A0950,00000000,007A0950,007A0950,774D3410,?,C:\Users\user\AppData\Local\Temp\,004057D5,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AC6
GetFileAttributesA.KERNEL32(007A0950,007A0950,007A0950,007A0950,007A0950,007A0950,00000000,007A0950,007A0950,774D3410,?,C:\Users\user\AppData\Local\Temp\,004057D5,?,774D3410,C:\Users\user\AppData\Local\Temp\), ref: 00405AD6

Strings

Pz, xrefs: 00405A79
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A73

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$Pz
API String ID: 3248276644-1715874187
Opcode ID: 6e5c033a035c27754d6853607a5acda36fe127f80b162ed81d790e353b870010
Instruction ID: 48b42070403af27e20b1f5acdd7358d009e8e21f6fdf4bd1af3726bdd8170272
Opcode Fuzzy Hash: 6e5c033a035c27754d6853607a5acda36fe127f80b162ed81d790e353b870010
Instruction Fuzzy Hash: 2AF0A421215D6216D622323A1C89A9F1A58CEC7364709073FF866B12D3EA3C89439DAE

Function 00405985 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403235,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 0040598B
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403235,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040345A,?,00000006,00000008,0000000A), ref: 00405994
lstrcatA.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 004059A5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405985

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-2145255484
Opcode ID: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction ID: 19b991fbecd43d68fcf8fbe3975c191da3a7c8eaa4a3e5077e024cb3b188d11e
Opcode Fuzzy Hash: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction Fuzzy Hash: 8DD0A7A21059306AE20266159C09DDB19088F12315B060027F101B2191C63C0D1187FE

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: f81053263e66775c86f22c9e7281053eb29660a1472c423ac1bc7bfee237aa75
Instruction ID: 0ef75652e5200b2c3979a726b87f5b44e9bd6decc27dd8d038d5566faf8c77c7
Opcode Fuzzy Hash: f81053263e66775c86f22c9e7281053eb29660a1472c423ac1bc7bfee237aa75
Instruction Fuzzy Hash: CC119A32504109FBEF129F90CF09B9E7B6DEB14380F204032BD45B61E0E7B59E11ABA8

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 937823a9ca513d21e0cf2f2d626aeb3dfaa269d40a84f5f8bcfb97d910e847a5
Instruction ID: 59a190b5ca5e41810c33fe67e91fb44ed42669482eb3396a028566c2b75ef85f
Opcode Fuzzy Hash: 937823a9ca513d21e0cf2f2d626aeb3dfaa269d40a84f5f8bcfb97d910e847a5
Instruction Fuzzy Hash: 8DF05831941620EBC610AB24BE4CA8E7B74BB04B12711897BF449B11F4CB7C4C828B9C

Function 00405088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B7
CallWindowProcA.USER32(?,?,?,?), ref: 00405108

Part of subcall function 004040C7: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 004040D9

Strings

, xrefs: 00405098

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: aa27df10419a993b06254c4634be6a0ab58901204a819692472b88ae61f90a6b
Instruction ID: b4a086d39c893e0b6e30c02e44c042f184afa5b73794f50f798247e01a256ddd
Opcode Fuzzy Hash: aa27df10419a993b06254c4634be6a0ab58901204a819692472b88ae61f90a6b
Instruction Fuzzy Hash: 5C018471200609EFDF204F11DD84A6F3665EB84314F208037F605B65D1CB7A8C52AFAD

Function 0040568C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A0D50,Error launching installer), ref: 004056B5
CloseHandle.KERNEL32(?), ref: 004056C2

Strings

Error launching installer, xrefs: 0040569F

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: f0a19a88b4191ad482a62bb3ee09ede63fcf5498891b486954be21cba29d19c8
Instruction ID: 2140ebbf1eee4cb4891f52a8ff1fd75339fa61df53f1a1a9c1e04f6e33d43294
Opcode Fuzzy Hash: f0a19a88b4191ad482a62bb3ee09ede63fcf5498891b486954be21cba29d19c8
Instruction Fuzzy Hash: 40E0BFF5610209BFEB009FA4DE05F7B7BBDEB40704F404925BD10F2160D774A8148A78

Function 00403775 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,774D3410,00000000,C:\Users\user\AppData\Local\Temp\,0040374D,00403567,?,?,00000006,00000008,0000000A), ref: 0040378F
GlobalFree.KERNEL32(?), ref: 00403796

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403775

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-2145255484
Opcode ID: d916e2e12d8e8e0e05938552f8e86e2cfc1f8e413d7ca81264c0c58d55c0495e
Instruction ID: 7399a24566e835d4bf74ae8faf6f599a32d3c581d2ea115a227339331e7fa0df
Opcode Fuzzy Hash: d916e2e12d8e8e0e05938552f8e86e2cfc1f8e413d7ca81264c0c58d55c0495e
Instruction Fuzzy Hash: 1BE0C273401120ABC6216F15ED0871A777C6F46B27F02C12BF8407B26087781C434FC8

Function 00405AEB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D46,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AFB
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B13
CharNextA.USER32(00000000,?,00000000,00405D46,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B24
lstrlenA.KERNEL32(00000000,?,00000000,00405D46,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B2D

Memory Dump Source

Source File: 00000000.00000002.1518807457.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1518786651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518828256.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.000000000078A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1518857436.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007B6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1519070319.00000000007CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_230524.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction ID: c1544da0d971e4a519e78892e838bc28cfb462c10397de1a7bf1af1224e2ff03
Opcode Fuzzy Hash: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction Fuzzy Hash: 9CF06232105418BFC712DFA5DD40D9EBBB8DF56250B2540BAE840F7251D674FE019BA9

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PI_230524.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PI_230524.exePID: 4240, Parent PID: 3968

General

Chronological Activities

Disassembly

Analysis Process: PI_230524.exePID: 4240, Parent PID: 3968COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
PI_230524.exe

Function 00403248 Relevance: 82.6, APIs: 32, Strings: 15, Instructions: 366
stringcomfileCOMMON

Function 00406317 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405BB5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Function 00406385 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405B86 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405657 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 00405BFE Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 00405709 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Function 00403730 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 00403200 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 00405252 Relevance: 54.3, APIs: 36, Instructions: 282
windowclipboardmemoryCOMMON

Function 00404A80 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Function 00403BA7 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON