Edit tour

Windows Analysis Report
PI_20052024.exe

Overview

General Information

Sample name:	PI_20052024.exe
Analysis ID:	1447912
MD5:	1184a592120050bb97393bf479962ee7
SHA1:	e603527c59975f807615e5e578662b9140896fa3
SHA256:	b2455ad91129772b38a764f79b25861dd16fe5140871a73f6908676ef54df951
Tags:	exe
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

PI_20052024.exe (PID: 1248 cmdline: "C:\Users\user\Desktop\PI_20052024.exe" MD5: 1184A592120050BB97393BF479962EE7)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: PI_20052024.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: PI_20052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_00406435 FindFirstFileA,FindClose,	0_2_00406435
Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_00405889 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405889
Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1

Source: PI_20052024.exe, 00000000.00000002.1498884560.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.ne
Source: PI_20052024.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PI_20052024.exe, 00000000.00000003.1454163323.00000000004BF000.00000004.00000020.00020000.00000000.sdmp, PI_20052024.exe, 00000000.00000002.1498884560.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error(
Source: PI_20052024.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\PI_20052024.exe

Code function: 0_2_00405326 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405326

Source: C:\Users\user\Desktop\PI_20052024.exe

Code function: 0_2_00403312 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403312

Source: C:\Users\user\Desktop\PI_20052024.exe

Code function: 0_2_004067BE

0_2_004067BE

Source: PI_20052024.exe, 00000000.00000000.1453442898.000000000043B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekvldet altsaxofonisters.exeDVarFileInfo$ vs PI_20052024.exe
Source: PI_20052024.exe	Binary or memory string: OriginalFilenamekvldet altsaxofonisters.exeDVarFileInfo$ vs PI_20052024.exe

Source: PI_20052024.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean4.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\PI_20052024.exe

0_2_00403312

Source: C:\Users\user\Desktop\PI_20052024.exe

Code function: 0_2_004045D7 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004045D7

Source: C:\Users\user\Desktop\PI_20052024.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Source: C:\Users\user\Desktop\PI_20052024.exe

File created: C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp

Jump to behavior

Source: PI_20052024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI_20052024.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PI_20052024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PI_20052024.exe

File read: C:\Users\user\Desktop\PI_20052024.exe

Jump to behavior

Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI_20052024.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\PI_20052024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: PI_20052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PI_20052024.exe

Static PE information: real checksum: 0x9af8f should be: 0x6fdac

Source: C:\Users\user\Desktop\PI_20052024.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\PI_20052024.exe

API coverage: 8.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_00406435 FindFirstFileA,FindClose,	0_2_00406435
Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_00405889 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405889
Source: C:\Users\user\Desktop\PI_20052024.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1

Source: PI_20052024.exe, 00000000.00000003.1454163323.00000000004BF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\PI_20052024.exe

API call chain: ExitProcess graph end node

graph_0-3160

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PI_20052024.exe

0_2_00403312

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://nsis.sf.ne	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error(	0%	Avira URL Cloud	safe
http://nsis.sf.ne	0%	Virustotal		Browse
http://nsis.sf.net/NSIS_Error(	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	PI_20052024.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	PI_20052024.exe	false	URL Reputation: safe	unknown
http://nsis.sf.ne	PI_20052024.exe, 00000000.00000002.1498884560.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error(	PI_20052024.exe, 00000000.00000003.1454163323.00000000004BF000.00000004.00000020.00020000.00000000.sdmp, PI_20052024.exe, 00000000.00000002.1498884560.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447912
Start date and time:	2024-05-27 12:18:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PI_20052024.exe
Detection:	CLEAN
Classification:	clean4.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.77450270027035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PI_20052024.exe
File size:	439'128 bytes
MD5:	1184a592120050bb97393bf479962ee7
SHA1:	e603527c59975f807615e5e578662b9140896fa3
SHA256:	b2455ad91129772b38a764f79b25861dd16fe5140871a73f6908676ef54df951
SHA512:	a414027ee708c303f114b46bad800d9430125e73ac2ce75b6e83199258de96c6d5ebaa680aa4afc7d37f08b1de786685de3f1d0f2dda95b3b9378a3304cecfe6
SSDEEP:	6144:bqjIG7MM+Z7qyul3ywab6eXPU0KdDBKKVPVRPKy1FqiTExXR+Z:mH7MMIqb9BaBUbdD4aPHb2XR+Z
TLSH:	AF94C0827941D832F6152A350EF2EEFDFB76BC9059409B073274762D297BB019E09ACD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG..sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................b...........3............@

File Icon


Icon Hash:	0d0617331d492713

Static PE Info

General

Entrypoint:	0x403312
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D6A7 [Sat Aug 1 02:42:47 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ced282d9b261d1462772017fe2f6972b

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080B8h]
call dword ptr [004080BCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042472Ch], eax
je 00007F00355B6C43h
push ebx
call 00007F00355B9DA6h
cmp eax, ebx
je 00007F00355B6C39h
push 00000C00h
call eax
mov esi, 004082A0h
push esi
call 00007F00355B9D22h
push esi
call dword ptr [004080CCh]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F00355B6C1Dh
push 0000000Bh
call 00007F00355B9D7Ah
push 00000009h
call 00007F00355B9D73h
push 00000007h
mov dword ptr [00424724h], eax
call 00007F00355B9D67h
cmp eax, ebx
je 00007F00355B6C41h
push 0000001Eh
call eax
test eax, eax
je 00007F00355B6C39h
or byte ptr [0042472Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408288h]
mov dword ptr [004247F8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041FCE8h
call dword ptr [0040816Ch]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8438	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x2e5d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8d7e0	0xa20
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x29c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x60d5	0x6200	83acff9b8bf5b52f9975f8acdcabf744	False	0.6630660076530612	data	6.4176717642026535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1274	0x1400	b8e42f3d3b81b0e2a4080ab31bc2d1f4	False	0.4337890625	data	5.061067348371254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a838	0x600	599a2f85a30bf72bff5e1c2e854c43ee	False	0.4361979166666667	data	3.9951628803851107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x16000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0x2e5d8	0x2e600	f94a8f4d68adfb572485b77d5f8b98c5	False	0.4019962938005391	data	4.5079430833024645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b4a8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.35749142316337396
RT_ICON	0x4bcd0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.4036945553920538
RT_ICON	0x55178	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 16384	English	United States	0.2957529749692245
RT_ICON	0x59da0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.4624468587623996
RT_ICON	0x5dfc8	0x2ca8	Device independent bitmap graphic, 96 x 192 x 8, image size 9216	English	United States	0.3624037788663401
RT_ICON	0x60c70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5025933609958506
RT_ICON	0x63218	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096	English	United States	0.48007757404795487
RT_ICON	0x64840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.5675422138836773
RT_ICON	0x658e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.5732942430703625
RT_ICON	0x66790	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.6135245901639345
RT_ICON	0x67118	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.6859205776173285
RT_ICON	0x679c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576	English	United States	0.7361751152073732
RT_ICON	0x68088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.7760115606936416
RT_ICON	0x685f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.6125886524822695
RT_DIALOG	0x68a58	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x68ba0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x68ca0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x68dc0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x68e88	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x68ee8	0xca	data	English	United States	0.5841584158415841
RT_VERSION	0x68fb8	0x2e0	data	English	United States	0.5054347826086957
RT_MANIFEST	0x69298	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
SHELL32.dll	SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
ole32.dll	IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:19:36
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\PI_20052024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PI_20052024.exe"
Imagebase:	0x400000
File size:	439'128 bytes
MD5 hash:	1184A592120050BB97393BF479962EE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.6%
Total number of Nodes:	1319
Total number of Limit Nodes:	15

Executed Functions

Function 00403312 Relevance: 86.1, APIs: 32, Strings: 17, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403337
GetVersion.KERNEL32 ref: 0040333D
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403370
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 004033AC
OleInitialize.OLE32(00000000), ref: 004033B3
SHGetFileInfoA.SHELL32(0041FCE8,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 004033CF
GetCommandLineA.KERNEL32(00423F20,NSIS Error,?,00000007,00000009,0000000B), ref: 004033E4
CharNextA.USER32(00000000,"C:\Users\user\Desktop\PI_20052024.exe",00000020,"C:\Users\user\Desktop\PI_20052024.exe",00000000,?,00000007,00000009,0000000B), ref: 00403420
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 0040351D
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040352E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040353A
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040354E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403556
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403567
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040356F
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp,?,00000007,00000009,0000000B), ref: 00403583

Part of subcall function 004064CA: GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
Part of subcall function 004064CA: GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

Part of subcall function 004038D4: lstrlenA.KERNEL32(004236C0,?,?,?,004236C0,00000000,0042A400,C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp,00420D28,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D28,00000000,00000002,756F3410), ref: 004039C4
Part of subcall function 004038D4: lstrcmpiA.KERNEL32(?,.exe), ref: 004039D7
Part of subcall function 004038D4: GetFileAttributesA.KERNEL32(004236C0), ref: 004039E2
Part of subcall function 004038D4: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,0042A400), ref: 00403A2B
Part of subcall function 004038D4: RegisterClassA.USER32(00423EC0), ref: 00403A68

Part of subcall function 004037FA: FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403631,?,?,00000007,00000009,0000000B), ref: 00403805

OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 00403631
ExitProcess.KERNEL32 ref: 00403652
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 0040376F
OpenProcessToken.ADVAPI32(00000000), ref: 00403776
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040378E
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004037AD
ExitWindowsEx.USER32(00000002,80040002), ref: 004037D1
ExitProcess.KERNEL32 ref: 004037F4

Part of subcall function 004057DD: MessageBoxIndirectA.USER32(0040A218), ref: 00405838

Strings

NSIS Error, xrefs: 004033D5
TEMP, xrefs: 00403562
`Kpu, xrefs: 0040355B
Error launching installer, xrefs: 004035E9
C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp, xrefs: 0040357E
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 004033EA, 004033F0, 004035A7
UXTHEME, xrefs: 00403364, 00403369, 0040336F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403512, 00403517, 0040352D, 00403539, 00403548, 00403555, 00403561, 00403569, 00403662, 00403673, 0040367E, 0040368A, 00403697, 004036A6, 00403755
", xrefs: 00403445
C:\Users\user\Desktop\PI_20052024.exe, xrefs: 0040370F
~nsu, xrefs: 0040365D
TMP, xrefs: 0040356A
C:\Users\user\Desktop, xrefs: 00403684, 00403689, 004036B5
SeShutdownPrivilege, xrefs: 00403788
Low, xrefs: 00403550
.tmp, xrefs: 00403679
\Temp, xrefs: 00403534

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentPathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesChangeCharClassCloseCommandCurrentDeleteDirectoryErrorFindHandleImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextNotificationOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\PI_20052024.exe"$.tmp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\PI_20052024.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kpu$~nsu
API String ID: 3490464366-4026475936
Opcode ID: f310e33f6c486066557963ca062f20637adb2c2bd7ff8924bd19685712fd966f
Instruction ID: fed38e33bd1ad5050a1aac335cdd74565c3a3e786a0889b069c8e2b205acfbdc
Opcode Fuzzy Hash: f310e33f6c486066557963ca062f20637adb2c2bd7ff8924bd19685712fd966f
Instruction Fuzzy Hash: 7CC108702047406AD721AF759D49A2F3EACEF85306F45443FF581B62D2CB7C8A598B2E

Function 0040645C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406473
wsprintfA.USER32 ref: 004064AC
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064C0

Strings

UXTHEME, xrefs: 00406465
%s%s.dll, xrefs: 004064A6
\, xrefs: 00406484

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction ID: 6b99be200e9776e1d1f000c3a85ac26a44316f32ef7d7cf08124b5af377bafc3
Opcode Fuzzy Hash: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction Fuzzy Hash: C2F0FC305502096BDB15DB64DD0DFEB375CEB08304F1400BAA986E10C1EA78E5258B6D

Function 00405C89 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C9D
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000007,00000009,0000000B), ref: 00405CB7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C8C
nsa, xrefs: 00405C94
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 00405C89

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PI_20052024.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3711466119
Opcode ID: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction ID: eb5fe80d68cc8fd1173ec18eddb4fdb1002e2dce10a9d595da193ea2316e06a4
Opcode Fuzzy Hash: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction Fuzzy Hash: BCF08236308308ABEB118F56ED04B9B7FACDF91750F10803BFA44DB280D6B499558798

Function 004064CA Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

Part of subcall function 0040645C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406473
Part of subcall function 0040645C: wsprintfA.USER32 ref: 004064AC
Part of subcall function 0040645C: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004064C0

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction ID: b1d6ada99e6651afe610309d4c68ede8e1123b1e5f34d771ce11ce336b0a7369
Opcode Fuzzy Hash: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction Fuzzy Hash: 1AE086326042116BD21067705E0893B72A89E84700302443EF946F2144DB39EC35A76D

Function 00405C5A Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00405C5E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405C80

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction ID: ee59d6d0e1d409ab4f08bbdf592326cff3c7222ef74ae4255e7f212f1854b30f
Opcode Fuzzy Hash: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction Fuzzy Hash: F5D09E31654201AFEF0D8F20DE16F2E7AA2EB84B00F11952CB782941E1DA715819AB19

Function 0040572B Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403305,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00405731
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 0040573F

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction ID: fe143fb7e2c59eb3603aebef79fe73c29c1fae3f16fa91b3bf8fea648d0a9a1d
Opcode Fuzzy Hash: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction Fuzzy Hash: 61C04C30604505EFD7515B209E09B177A94AB50781F15443DA146E10A0DF388455ED2D

Function 00405CD2 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004032C7,00000000,00000000,00403124,000000FF,00000004,00000000,00000000,00000000), ref: 00405CE6

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction ID: 0f3a91911b7368544d0479776f9460b67210371169305fae4b72b28e49471388
Opcode Fuzzy Hash: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction Fuzzy Hash: 56E0EC3221835EEBEF109E559C04EEB7B6CEB05360F044437FD5AE2150D671E861ABA4

Function 004057DD Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxIndirectA.USER32(0040A218), ref: 00405838

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: 0cab00be260b89d7d1c612eddf7da4e0fd649a2712073fb6eb20caf0e7def1e0
Instruction ID: 5311cca1f2ba290f7242e971641faf4dc96c1e65d14f3eed96e680751d9d4e07
Opcode Fuzzy Hash: 0cab00be260b89d7d1c612eddf7da4e0fd649a2712073fb6eb20caf0e7def1e0
Instruction Fuzzy Hash: 12F0F2366003009BC764DF18FA4871637E0E799359F41867EE584A23B4DB7A88A2CF4E

Function 004037FA Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(FFFFFFFF,00403631,?,?,00000007,00000009,0000000B), ref: 00403805

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1f7b26d8e1698b4bcdc364653e9983ac0a1eb5e2198a2e3d9e60c48d07f54e68
Instruction ID: 98d9bb83651dfd28c3db404e9d03a9a506ef6e5e58b1f070815515e233c4bbd3
Opcode Fuzzy Hash: 1f7b26d8e1698b4bcdc364653e9983ac0a1eb5e2198a2e3d9e60c48d07f54e68
Instruction Fuzzy Hash: B2C01231500B0856C1247F749E4F5253A98AB44775BA0C775F0F8F10F1C73C4A69559D

Non-executed Functions

Function 00405326 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405385
GetDlgItem.USER32(?,000003EE), ref: 00405394
GetClientRect.USER32(?,?), ref: 004053D1
GetSystemMetrics.USER32(00000002), ref: 004053D8
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004053F9
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040540A
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040541D
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040542B
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040543E
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405460
ShowWindow.USER32(?,00000008), ref: 00405474
GetDlgItem.USER32(?,000003EC), ref: 00405495
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004054A5
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004054BE
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004054CA
GetDlgItem.USER32(?,000003F8), ref: 004053A3

Part of subcall function 0040417A: SendMessageA.USER32(00000028,?,00000001,00403FAA), ref: 00404188

GetDlgItem.USER32(?,000003EC), ref: 004054E6
CreateThread.KERNEL32(00000000,00000000,Function_000052BA,00000000), ref: 004054F4
CloseHandle.KERNEL32(00000000), ref: 004054FB
ShowWindow.USER32(00000000), ref: 0040551E
ShowWindow.USER32(?,00000008), ref: 00405525
ShowWindow.USER32(00000008), ref: 0040556B
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040559F
CreatePopupMenu.USER32 ref: 004055B0
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004055C5
GetWindowRect.USER32(?,000000FF), ref: 004055E5
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055FE
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040563A
OpenClipboard.USER32(00000000), ref: 0040564A
EmptyClipboard.USER32 ref: 00405650
GlobalAlloc.KERNEL32(00000042,?), ref: 00405659
GlobalLock.KERNEL32(00000000), ref: 00405663
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405677
GlobalUnlock.KERNEL32(00000000), ref: 00405690
SetClipboardData.USER32(00000001,00000000), ref: 0040569B
CloseClipboard.USER32 ref: 004056A1

Strings

(B, xrefs: 00405616

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (B
API String ID: 590372296-3831730363
Opcode ID: 49997f41eb2f9c722dfb0406d167bbe14a0a63cc83ca584289ce1d984f626ed1
Instruction ID: fe21aa704c045a880c187f0605a512594e5ece0db8e286b19571ae5c45aa8885
Opcode Fuzzy Hash: 49997f41eb2f9c722dfb0406d167bbe14a0a63cc83ca584289ce1d984f626ed1
Instruction Fuzzy Hash: 23A15B71900608BFDB119FA4DE89EAE7B79FB48355F00403AFA41BA1A0C7794E51DF58

Function 004045D7 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404626
SetWindowTextA.USER32(00000000,?), ref: 00404650
SHBrowseForFolderA.SHELL32(?,00420100,?), ref: 00404701
CoTaskMemFree.OLE32(00000000), ref: 0040470C
lstrcmpiA.KERNEL32(004236C0,00420D28), ref: 0040473E
lstrcatA.KERNEL32(?,004236C0), ref: 0040474A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040475C

Part of subcall function 004057C1: GetDlgItemTextA.USER32(?,?,00000400,00404793), ref: 004057D4

Part of subcall function 0040639C: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PI_20052024.exe",756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 004063F4
Part of subcall function 0040639C: CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406401
Part of subcall function 0040639C: CharNextA.USER32(?,"C:\Users\user\Desktop\PI_20052024.exe",756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00406406
Part of subcall function 0040639C: CharPrevA.USER32(?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00406416

GetDiskFreeSpaceA.KERNEL32(0041FCF8,?,?,0000040F,?,0041FCF8,0041FCF8,?,00000001,0041FCF8,?,?,000003FB,?), ref: 0040481A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404835

Part of subcall function 0040498E: lstrlenA.KERNEL32(00420D28,00420D28,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048A9,000000DF,00000000,00000400,?), ref: 00404A2C
Part of subcall function 0040498E: wsprintfA.USER32 ref: 00404A34
Part of subcall function 0040498E: SetDlgItemTextA.USER32(?,00420D28), ref: 00404A47

Strings

A, xrefs: 004046FA
(B, xrefs: 004046D4

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (B$A
API String ID: 2624150263-1188332043
Opcode ID: 355fae2fdc5b81749f0646e346823bb3f61dec23bbe7f7c311cc870142e1b552
Instruction ID: 23887ea06715a98946f15fa8ab5ee03a9679ba0c83a6df36e4e3dfda0b9dc378
Opcode Fuzzy Hash: 355fae2fdc5b81749f0646e346823bb3f61dec23bbe7f7c311cc870142e1b552
Instruction Fuzzy Hash: C9A183B1900209ABDB11EFA5CD85AAFB7B8EF85314F10843BF601B72D1D77C89418B69

Function 00405889 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B2
lstrcatA.KERNEL32(00421D30,\*.*,00421D30,?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058FA
lstrcatA.KERNEL32(?,0040A014,?,00421D30,?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040591B
lstrlenA.KERNEL32(?,?,0040A014,?,00421D30,?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405921
FindFirstFileA.KERNEL32(00421D30,?,?,?,0040A014,?,00421D30,?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405932
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004059DF
FindClose.KERNEL32(00000000), ref: 004059F0

Strings

\*.*, xrefs: 004058F4
C:\Users\user\AppData\Local\Temp\, xrefs: 00405896
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 00405889

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PI_20052024.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-873889405
Opcode ID: 36dc79f5f72bdae1f12502bd591f5556571401b5369f5233b8bf9165604da4d7
Instruction ID: 41c2b5987dba1b2e33ef8c3f02a16f7fa1ffbccb66a0b3bb43d54024ecdcecbe
Opcode Fuzzy Hash: 36dc79f5f72bdae1f12502bd591f5556571401b5369f5233b8bf9165604da4d7
Instruction Fuzzy Hash: 6251D070900A04EACB21AB618C89BBF7B78EF42724F54427BF851B51D1D73C4982DF6A

Function 004067BE Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634db48916f7a97cd593a88a8f27a2a6a53995630c6979533469a6cf2a501d9c
Instruction ID: b77f02bc2ee5da486f1689b8d44b34109ba54b696cf3d27aba4845a127c97f42
Opcode Fuzzy Hash: 634db48916f7a97cd593a88a8f27a2a6a53995630c6979533469a6cf2a501d9c
Instruction Fuzzy Hash: CEF17671D00269CBCF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7385A86CF44

Function 00406435 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(756F3410,00422578,00422130,00405B8A,00422130,00422130,00000000,00422130,00422130,756F3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,756F3410,C:\Users\user\AppData\Local\Temp\), ref: 00406440
FindClose.KERNEL32(00000000), ref: 0040644C

Strings

x%B, xrefs: 00406436

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: x%B
API String ID: 2295610775-3582070945
Opcode ID: f29c590cbb4ae7880d615934e2c411517b6bf54f8089bedae6efd123f54e346e
Instruction ID: 161293881315f5638f8ce2083a4c9c3eaa4ca925c072cbf9d6c71a91d4c8f3d6
Opcode Fuzzy Hash: f29c590cbb4ae7880d615934e2c411517b6bf54f8089bedae6efd123f54e346e
Instruction Fuzzy Hash: FED01231944130ABC3502B386E0C85B7B599F153313A2CB36F56AF12F0CB788C6296AC

Function 0040216B Relevance: 3.1, APIs: 2, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022A2

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: b96e618640ec3733a40c8f990ab161d406538e4b9c2d6c349f938f3337a4d74a
Instruction ID: 1d5fc0eda79a0a672284adf98007a832727f4b93af1a8b9a4894ceaf33dc30f5
Opcode Fuzzy Hash: b96e618640ec3733a40c8f990ab161d406538e4b9c2d6c349f938f3337a4d74a
Instruction Fuzzy Hash: 45510471A00208AFCB00DFE4CA88A9D7BB6EF48314F2041BAF515EB2D1DA799981CB54

Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B0

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 59237916fb72a4df27da046859b2f328e2f335d4eaafb740a0fb2c5245d815b3
Instruction ID: 13e9d4e2be50c596067d6900ef2af7155ed35788a2bbd6a4100e2a10f5e5ac7a
Opcode Fuzzy Hash: 59237916fb72a4df27da046859b2f328e2f335d4eaafb740a0fb2c5245d815b3
Instruction Fuzzy Hash: 0AF0A771604110DFD710EB649949AEE77A8DF51314F20057BF112B20C2D7B889469B2A

Function 00404B4A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B61
GetDlgItem.USER32(?,00000408), ref: 00404B6E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404BBD
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404BD4
SetWindowLongA.USER32(?,000000FC,0040515C), ref: 00404BEE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404C00
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404C14
SendMessageA.USER32(?,00001109,00000002), ref: 00404C2A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404C36
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404C46
DeleteObject.GDI32(00000110), ref: 00404C4B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404C76
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404C82
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D1C
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404D4C

Part of subcall function 0040417A: SendMessageA.USER32(00000028,?,00000001,00403FAA), ref: 00404188

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D60
GetWindowLongA.USER32(?,000000F0), ref: 00404D8E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404D9C
ShowWindow.USER32(?,00000005), ref: 00404DAC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404EA7
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404F0C
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404F21
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404F45
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404F65
ImageList_Destroy.COMCTL32(?), ref: 00404F7A
GlobalFree.KERNEL32(?), ref: 00404F8A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00405003
SendMessageA.USER32(?,00001102,?,?), ref: 004050AC
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004050BB
InvalidateRect.USER32(?,00000000,00000001), ref: 004050E5
ShowWindow.USER32(?,00000000), ref: 00405133
GetDlgItem.USER32(?,000003FE), ref: 0040513E
ShowWindow.USER32(00000000), ref: 00405145

Strings

N, xrefs: 00404DE5
M, xrefs: 00404D04
, xrefs: 0040511D

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 47f2d9c36709d7288c2157f5155d2d55d121774a694b688cb793ee6afb5df1ef
Instruction ID: 035ac8a7469eee7f523ea9a41678d20bac9593c5f5e0b875cc373c12e4cd4a79
Opcode Fuzzy Hash: 47f2d9c36709d7288c2157f5155d2d55d121774a694b688cb793ee6afb5df1ef
Instruction Fuzzy Hash: 63025DB0A00209AFDF209F94DD45AAE7BB5FB84354F50813AF610BA2E1D7799D42CF58

Function 00403C71 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CAD
ShowWindow.USER32(?), ref: 00403CCA
DestroyWindow.USER32 ref: 00403CDE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403CFA
GetDlgItem.USER32(?,?), ref: 00403D1B
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403D2F
IsWindowEnabled.USER32(00000000), ref: 00403D36
GetDlgItem.USER32(?,00000001), ref: 00403DE4
GetDlgItem.USER32(?,00000002), ref: 00403DEE
SetClassLongA.USER32(?,000000F2,?), ref: 00403E08
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403E59
GetDlgItem.USER32(?,00000003), ref: 00403EFF
ShowWindow.USER32(00000000,?), ref: 00403F20
EnableWindow.USER32(?,?), ref: 00403F32
EnableWindow.USER32(?,?), ref: 00403F4D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F63
EnableMenuItem.USER32(00000000), ref: 00403F6A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F82
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F95
lstrlenA.KERNEL32(00420D28,?,00420D28,00000000), ref: 00403FBF
SetWindowTextA.USER32(?,00420D28), ref: 00403FCE
ShowWindow.USER32(?,0000000A), ref: 00404102

Strings

(B, xrefs: 00403FAF

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (B
API String ID: 184305955-3831730363
Opcode ID: 7a58bff379e853cca07bcf65810b410c125cf819e0a5c8acdf48496fe53637fe
Instruction ID: b3becc50dc3ae915ab1c9f271a4527fb908fa7fae9a455a684dda11466253fc4
Opcode Fuzzy Hash: 7a58bff379e853cca07bcf65810b410c125cf819e0a5c8acdf48496fe53637fe
Instruction Fuzzy Hash: 77C11071600204BFDB206F61ED49E2B3AB8FB85706F50053EF651B51F1CB799982AB2D

Function 004038D4 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004064CA: GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
Part of subcall function 004064CA: GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp,00420D28,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D28,00000000,00000002,756F3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PI_20052024.exe",00000000), ref: 0040394F
lstrlenA.KERNEL32(004236C0,?,?,?,004236C0,00000000,0042A400,C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp,00420D28,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D28,00000000,00000002,756F3410), ref: 004039C4
lstrcmpiA.KERNEL32(?,.exe), ref: 004039D7
GetFileAttributesA.KERNEL32(004236C0), ref: 004039E2
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,0042A400), ref: 00403A2B

Part of subcall function 0040601F: wsprintfA.USER32 ref: 0040602C

RegisterClassA.USER32(00423EC0), ref: 00403A68
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A80
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AB5
ShowWindow.USER32(00000005,00000000), ref: 00403AEB
GetClassInfoA.USER32(00000000,RichEdit20A,00423EC0), ref: 00403B17
GetClassInfoA.USER32(00000000,RichEdit,00423EC0), ref: 00403B24
RegisterClassA.USER32(00423EC0), ref: 00403B2D
DialogBoxParamA.USER32(?,00000000,00403C71,00000000), ref: 00403B4C

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403908
C:\Users\user\AppData\Local\Temp\, xrefs: 004038D9
.DEFAULT\Control Panel\International, xrefs: 0040393A
RichEd20, xrefs: 00403AF1
_Nb, xrefs: 00403A47, 00403AAF
C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp, xrefs: 004038F4, 0040394A
(B, xrefs: 00403900
RichEd32, xrefs: 00403AFF
RichEdit, xrefs: 00403B1E
RichEdit20A, xrefs: 00403B0F, 00403B15
.exe, xrefs: 004039D1
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 004038D8

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PI_20052024.exe"$(B$.DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsvCAFB.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3717226707
Opcode ID: ca874c65e5546124d3cd3d782fc2237607ef3cb7aa3e488bb88335414d52c5b7
Instruction ID: 8119f10372a92e3ad89c0c28339df669361e1c2b2a074a7ad4fa5a04607ec86b
Opcode Fuzzy Hash: ca874c65e5546124d3cd3d782fc2237607ef3cb7aa3e488bb88335414d52c5b7
Instruction Fuzzy Hash: CC61B4703402446ED620AF65AD45F3B3AACEB8574AF40053FF991B62E3CB7D5D029A2D

Function 004042B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040433B
GetDlgItem.USER32(00000000,000003E8), ref: 0040434F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040436D
GetSysColor.USER32(?), ref: 0040437E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040438D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040439C
lstrlenA.KERNEL32(?), ref: 0040439F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004043AE
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004043C3
GetDlgItem.USER32(?,0000040A), ref: 00404425
SendMessageA.USER32(00000000), ref: 00404428
GetDlgItem.USER32(?,000003E8), ref: 00404453
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404493
LoadCursorA.USER32(00000000,00007F02), ref: 004044A2
SetCursor.USER32(00000000), ref: 004044AB
LoadCursorA.USER32(00000000,00007F00), ref: 004044C1
SetCursor.USER32(00000000), ref: 004044C4
SendMessageA.USER32(00000111,00000001,00000000), ref: 004044F0
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404504

Strings

{B@, xrefs: 004044AF
N, xrefs: 00404441

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N${B@
API String ID: 3103080414-3800482554
Opcode ID: acb20318001dbc993e8a8a4388a34ea8f8254a099665a8e39094a0f64cc29e55
Instruction ID: c600905809f0113b99b24623cb0d1ad186d6442f8c09b0c76a4ffb62e5d10872
Opcode Fuzzy Hash: acb20318001dbc993e8a8a4388a34ea8f8254a099665a8e39094a0f64cc29e55
Instruction Fuzzy Hash: 5661C7B1A00209BFEB109F60CD45F6A7B69FB84714F10813AFB057A1D1C7B89951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 927d9f4f17401607196459c248a51bb8bdb5d1fd0febad51b1ec1e4e61243643
Instruction ID: f39fc87f540bacaa9a77f224585c2e26811c2c777a6195e868dd16c74e67a44d
Opcode Fuzzy Hash: 927d9f4f17401607196459c248a51bb8bdb5d1fd0febad51b1ec1e4e61243643
Instruction Fuzzy Hash: AA419D71800209AFCF058FA5DE459AF7FB9FF45315F00802AF591AA1A0CB34DA55DFA4

Function 00402EA1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402EB2
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\PI_20052024.exe,00000400), ref: 00402ECE

Part of subcall function 00405C5A: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00405C5E
Part of subcall function 00405C5A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405C80

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PI_20052024.exe,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00402F1A
GlobalAlloc.KERNEL32(00000040,00000020), ref: 00403050

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403077
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EA8
C:\Users\user\Desktop\PI_20052024.exe, xrefs: 00402EB8, 00402EC7, 00402EDB, 00402EFB
Error launching installer, xrefs: 00402EF1
Null, xrefs: 00402F98
Inst, xrefs: 00402F86
C:\Users\user\Desktop, xrefs: 00402EFC, 00402F01, 00402F07
soft, xrefs: 00402F8F
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 00402EA1

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PI_20052024.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PI_20052024.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-93559990
Opcode ID: 1fdbf8666ac545bea4b4f259f72344d0a52c8dbd42631ed96dcafa73090d8d3a
Instruction ID: 301210c85c1c672c97290be40cd2ab013445f980247fce5a821d6afddb5369d2
Opcode Fuzzy Hash: 1fdbf8666ac545bea4b4f259f72344d0a52c8dbd42631ed96dcafa73090d8d3a
Instruction Fuzzy Hash: 8851C171A01204ABDF20AF65DD85BAE7FB8EB40369F11413BF504B22D5C7789E818B9D

Function 00405D30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405EC1,?,?), ref: 00405D61
GetShortPathNameA.KERNEL32(?,00422AB8,00000400), ref: 00405D6A

Part of subcall function 00405BBF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCF
Part of subcall function 00405BBF: lstrlenA.KERNEL32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C01

GetShortPathNameA.KERNEL32(?,00422EB8,00000400), ref: 00405D87
wsprintfA.USER32 ref: 00405DA5
GetFileSize.KERNEL32(00000000,00000000,00422EB8,C0000000,00000004,00422EB8,?,?,?,?,?), ref: 00405DE0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405DEF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E27
SetFilePointer.KERNEL32(0040A3D8,00000000,00000000,00000000,00000000,004226B8,00000000,-0000000A,0040A3D8,00000000,[Rename],00000000,00000000,00000000), ref: 00405E7D
GlobalFree.KERNEL32(00000000), ref: 00405E8E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405E95

Part of subcall function 00405C5A: GetFileAttributesA.KERNELBASE(00000003,00402EE1,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00405C5E
Part of subcall function 00405C5A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405C80

Strings

%s=%s, xrefs: 00405D9B
[Rename], xrefs: 00405E0F, 00405E21

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 7cd21256d08661d4eefe879962d933e7a9051a9aa49ec23cacfd0fd8735dfe10
Instruction ID: e2b4b59c5115c054d9977882ffa936deea793db07019febf4a6c543227337bd7
Opcode Fuzzy Hash: 7cd21256d08661d4eefe879962d933e7a9051a9aa49ec23cacfd0fd8735dfe10
Instruction Fuzzy Hash: 39312431205B15BBD2207B65AD48F6B3A5CDF45754F14003BFA85F62C2DBBCE9028AAD

Function 00406154 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(004236C0,00000400), ref: 0040627F
GetWindowsDirectoryA.KERNEL32(004236C0,00000400,?,00420508,00000000,00405220,00420508,00000000), ref: 00406292
SHGetSpecialFolderLocation.SHELL32(00405220,00000000,?,00420508,00000000,00405220,00420508,00000000), ref: 004062CE
SHGetPathFromIDListA.SHELL32(00000000,004236C0), ref: 004062DC
CoTaskMemFree.OLE32(00000000), ref: 004062E8
lstrcatA.KERNEL32(004236C0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040630C
lstrlenA.KERNEL32(004236C0,?,00420508,00000000,00405220,00420508,00000000,00000000,00000000,00000000), ref: 0040635E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040624E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406306

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: 188556e7dd67b187b2ef37ee62a8a6cc26365b5387ae4cc73a5f120017cd6666
Instruction ID: 8fbc972aa6bd3719c406fe4e3ec738975147f7369702dd1472e60f0af39698f0
Opcode Fuzzy Hash: 188556e7dd67b187b2ef37ee62a8a6cc26365b5387ae4cc73a5f120017cd6666
Instruction Fuzzy Hash: 31610671900111AADF20AF65DC84BBE3BA4AB46310F12417FE953B62D1C73C49A2CB9D

Function 004030D8 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403136
GetTickCount.KERNEL32 ref: 004031B7
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 004031E4
wsprintfA.USER32 ref: 004031F4

Strings

8A, xrefs: 00403169
xA, xrefs: 004030FF
8A, xrefs: 0040327B
... %d%%, xrefs: 004031EE

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$8A$8A$xA
API String ID: 551687249-3243659074
Opcode ID: 145cb7f0f1a4d58596aa3ea4fbc553685855696f4e517d36b82761c798af3a57
Instruction ID: 5859ff30484dbc6f12110d744d50748fce684291dc682ebadfc23bb097a10b04
Opcode Fuzzy Hash: 145cb7f0f1a4d58596aa3ea4fbc553685855696f4e517d36b82761c798af3a57
Instruction Fuzzy Hash: BA515E71900219ABCB10AF66D944A9F7BACEF44756F1481BFE810B72D1C738CA41CBAD

Function 0040639C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PI_20052024.exe",756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 004063F4
CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406401
CharNextA.USER32(?,"C:\Users\user\Desktop\PI_20052024.exe",756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00406406
CharPrevA.USER32(?,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00406416

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040639D
*?|<>/":, xrefs: 004063E4
"C:\Users\user\Desktop\PI_20052024.exe", xrefs: 004063D8

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PI_20052024.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4273723975
Opcode ID: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction ID: d9f0ee3981b821fe41e3526cabf2d3b5ed91aab2121061eeaaee8554b2496e7d
Opcode Fuzzy Hash: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction Fuzzy Hash: 161108518047A129FB3206384C44B777FD84F97760F1A507BE9C2722C2D67C5CA68BAD

Function 004041AC Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004041C9
GetSysColor.USER32(00000000), ref: 00404207
SetTextColor.GDI32(?,00000000), ref: 00404213
SetBkMode.GDI32(?,?), ref: 0040421F
GetSysColor.USER32(?), ref: 00404232
SetBkColor.GDI32(?,?), ref: 00404242
DeleteObject.GDI32(?), ref: 0040425C
CreateBrushIndirect.GDI32(?), ref: 00404266

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction ID: aaf6f474a4af46f2497c0aff4df426b114d26e681d2b1e7af029b8f8d9950092
Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction Fuzzy Hash: 422162B16007049BCB20DF78D908F5BBBF8AF81754B048A6EF992A22E1D734E944CB54

Function 004051E8 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
lstrlenA.KERNEL32(00403208,00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
lstrcatA.KERNEL32(00420508,00403208,00403208,00420508,00000000,00000000,00000000), ref: 00405244
SetWindowTextA.USER32(00420508,00420508), ref: 00405256
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b08f2dfb0154d146624c2a85736964c18aae38e83127c4de365ddcd676addf21
Instruction ID: 13bf9d5a188301c634d68c5bb2c809f87baf544d33da629d3068cd84ff66c9cb
Opcode Fuzzy Hash: b08f2dfb0154d146624c2a85736964c18aae38e83127c4de365ddcd676addf21
Instruction Fuzzy Hash: 7F218C71E00518BBDB119FA5DD81A9EBFB9EF09354F14807AF544B6290C7798A808F98

Function 00404A98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404AB3
GetMessagePos.USER32 ref: 00404ABB
ScreenToClient.USER32(?,?), ref: 00404AD5
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404AE7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404B0D

Strings

f, xrefs: 00404AE9

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: c5e689f19116b5cd7588311b3231e42886eb7a503382143ef86565be6c6ceac4
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: 98015E71A40219BADB00DBA4DD85BFFBBBCAF59711F10016BBB40B61D0C7B499458BA8

Function 00402DBA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD5
MulDiv.KERNEL32(?,00000064,?), ref: 00402E00
wsprintfA.USER32 ref: 00402E10
SetWindowTextA.USER32(?,?), ref: 00402E20
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E32

Strings

verifying installer: %d%%, xrefs: 00402E0A

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: c12f5796f431ffac12d06fef0705727a44af994ad502cf00351caa1c45e3c2e6
Instruction ID: 483ea5b0a2f0e0c8b194c47557f81135a9cf1dc15d145a61dc19a9cae62ee66c
Opcode Fuzzy Hash: c12f5796f431ffac12d06fef0705727a44af994ad502cf00351caa1c45e3c2e6
Instruction Fuzzy Hash: CD014F70640209BBEF10AF60DE09EEE37A9AB04305F008039FA06A51D0DBB499559B59

Function 004056AE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004056F1
GetLastError.KERNEL32 ref: 00405705
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040571A
GetLastError.KERNEL32 ref: 00405724

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056D4
C:\Users\user\Desktop, xrefs: 004056AE

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-4029896129
Opcode ID: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction ID: 8fda383858cfa3d81fea8572b973588b51770532f266deb4a47d6cf866d68d21
Opcode Fuzzy Hash: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction Fuzzy Hash: 5E010871C00219EADF009BA0D944BEFBBB4EB04354F00403AD545B6190EB799648DF99

Function 004027DF Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402833
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040284F
GlobalFree.KERNEL32(?), ref: 0040288E
GlobalFree.KERNEL32(00000000), ref: 004028A1
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 004028B9
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004028CD

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a7d1c20f5851c824e4d256ca6f8f0821325b31d261d7a450b2cf241459bb73ae
Instruction ID: 07af861edfd5d45cc772d4460453d41526fe3ac71611944f2ada717c13252223
Opcode Fuzzy Hash: a7d1c20f5851c824e4d256ca6f8f0821325b31d261d7a450b2cf241459bb73ae
Instruction Fuzzy Hash: 83218D72800128BBDF217FA5CE48D9E7E79EF09364F10423EF551762D1C67949418FA8

Function 0040498E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D28,00420D28,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004048A9,000000DF,00000000,00000400,?), ref: 00404A2C
wsprintfA.USER32 ref: 00404A34
SetDlgItemTextA.USER32(?,00420D28), ref: 00404A47

Strings

%u.%u%s%s, xrefs: 00404A16
(B, xrefs: 00404A1E

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(B
API String ID: 3540041739-1796307841
Opcode ID: 7464479753e629812bdf3700d903353588bc249d3655e79db3f03f4f51d42954
Instruction ID: 1301199a10d6bfa0f795ae51e8cceb2c664c9f74d195b05cdaf9af1bfefcf64c
Opcode Fuzzy Hash: 7464479753e629812bdf3700d903353588bc249d3655e79db3f03f4f51d42954
Instruction Fuzzy Hash: 7A11B7B36041286BEB0066799C46EAF32D9DB85374F250237FA26F61D1E9788C5281A9

Function 00401759 Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,0040A408,0042A800,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,0040A408,0040A408,00000000,00000000,0040A408,0042A800,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 004060C1: lstrcpynA.KERNEL32(?,?,00000400,004033E4,00423F20,NSIS Error,?,00000007,00000009,0000000B), ref: 004060CE

Part of subcall function 004051E8: lstrlenA.KERNEL32(00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
Part of subcall function 004051E8: lstrlenA.KERNEL32(00403208,00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
Part of subcall function 004051E8: lstrcatA.KERNEL32(00420508,00403208,00403208,00420508,00000000,00000000,00000000), ref: 00405244
Part of subcall function 004051E8: SetWindowTextA.USER32(00420508,00420508), ref: 00405256
Part of subcall function 004051E8: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
Part of subcall function 004051E8: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
Part of subcall function 004051E8: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 1413912204f72f8cb147cece884a2b3b0500c8f5e8f820d1f5a5e3a000fbe892
Instruction ID: ad8319ac8819e3f4f0647767249a41d8ee4e375b3a8deda6b30fbb54af0d7a5d
Opcode Fuzzy Hash: 1413912204f72f8cb147cece884a2b3b0500c8f5e8f820d1f5a5e3a000fbe892
Instruction Fuzzy Hash: D641B731900515BACF10BFA5CC45DAF3669EF45369B21423BF422B21E1CA7C8A528A6D

Function 00402CD0 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D24
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
Instruction ID: 479b5507277e1ed98100a043d195c8e3d67278c142fcba22c9f5c581f71d1c0c
Opcode Fuzzy Hash: c08e85f7896b9a4561d683b23b3b2dae21a167d845191f4bc040fadce0444681
Instruction Fuzzy Hash: DE215771900108BBEF129F90CE89EEE7A7DEF44344F100076FA55B11A0E7B48E94AA68

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 92fb06419dcf22d7c561d1c1cd7314035e184999ef60ddcb5701d42bd4b0d5ab
Instruction ID: 377f1368a79285744d6b6cf0b5e74a57d9b5ac4df0fb29ad0ac025f91be5ae75
Opcode Fuzzy Hash: 92fb06419dcf22d7c561d1c1cd7314035e184999ef60ddcb5701d42bd4b0d5ab
Instruction Fuzzy Hash: C8212872A00109AFCF15DFA4DD85AAEBBB5EB88300F24417EF911F62A1CB389941DB54

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B808), ref: 00401EBA

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: dbc41a527304c6fe7c4bbb0ed52bde6d70f826071420a725491f8bf133d98c2a
Instruction ID: 57a26ad33cd6426129b0cba3998c620b955dd558a32440fd51a8b23e498893f8
Opcode Fuzzy Hash: dbc41a527304c6fe7c4bbb0ed52bde6d70f826071420a725491f8bf133d98c2a
Instruction Fuzzy Hash: 3E019672500240AFE7007BB0AE4A7997FF8D755301F108839F241B62F2C67800458BAC

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7b70566c870daa96221156bf416f9a378a332c342d8049e94ba7da889c6dd66f
Instruction ID: 51da54adcba92585663a26c7e1368d4a3271239daaedb1c2ef7502cbfef702b9
Opcode Fuzzy Hash: 7b70566c870daa96221156bf416f9a378a332c342d8049e94ba7da889c6dd66f
Instruction Fuzzy Hash: 05216071A44208BEEB059FB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28

Function 00405B47 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004060C1: lstrcpynA.KERNEL32(?,?,00000400,004033E4,00423F20,NSIS Error,?,00000007,00000009,0000000B), ref: 004060CE

Part of subcall function 00405AF2: CharNextA.USER32(?,?,00422130,?,00405B5E,00422130,00422130,756F3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B00
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B05
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B19

lstrlenA.KERNEL32(00422130,00000000,00422130,00422130,756F3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,756F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B9A
GetFileAttributesA.KERNEL32(00422130,00422130,00422130,00422130,00422130,00422130,00000000,00422130,00422130,756F3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,756F3410,C:\Users\user\AppData\Local\Temp\), ref: 00405BAA

Strings

0!B, xrefs: 00405B4D
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B47

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0!B$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1033416423
Opcode ID: 833d5d7d4d88ab044a5975486a6ace5c2f1c8b1622a9b4308b288e25f9abd96d
Instruction ID: e51454695f06d4bf62575f1f71cc8d9d2da662beaff56aa2e5751c7b88ff0260
Opcode Fuzzy Hash: 833d5d7d4d88ab044a5975486a6ace5c2f1c8b1622a9b4308b288e25f9abd96d
Instruction Fuzzy Hash: 47F02835601E6029C622223A0C45BAF3A65CE8232474D013FFC51B52C2DB3CB943DE6E

Function 00405A59 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004032FF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00405A5F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004032FF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,00000007,00000009,0000000B), ref: 00405A68
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405A79

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A59

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1881609536
Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction ID: 4e9c794251620aa29aecb4049673505928abe3d31fb5bce1aa7abaa38b2a0d50
Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction Fuzzy Hash: 2DD0A7A22015347AD20166254C06DDB690C8F02310B050066F200B2191C63C4C1147FD

Function 0040209D Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020C8

Part of subcall function 004051E8: lstrlenA.KERNEL32(00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
Part of subcall function 004051E8: lstrlenA.KERNEL32(00403208,00420508,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
Part of subcall function 004051E8: lstrcatA.KERNEL32(00420508,00403208,00403208,00420508,00000000,00000000,00000000), ref: 00405244
Part of subcall function 004051E8: SetWindowTextA.USER32(00420508,00420508), ref: 00405256
Part of subcall function 004051E8: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
Part of subcall function 004051E8: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
Part of subcall function 004051E8: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020D8
GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402152

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: b916a0c3f952494d37ea268d276a431c88bd30287504aa54b74bf77ab4e56999
Instruction ID: 1a7932fae63aa7fb20f888994d80958c5ec2ba2518727ce514c528d89b281485
Opcode Fuzzy Hash: b916a0c3f952494d37ea268d276a431c88bd30287504aa54b74bf77ab4e56999
Instruction Fuzzy Hash: 08210B32A00125EBCF207FA58F49B5F76B0AF50359F21423BF211B61D1CBBC8982965E

Function 00402E3D Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040301B,00000001), ref: 00402E50
GetTickCount.KERNEL32 ref: 00402E6E
CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402E8B
ShowWindow.USER32(00000000,00000005), ref: 00402E99

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: d2a126c8e87298d62dcb77b716532c519560652f5a9048845524fe30780812a8
Instruction ID: 90c5076a8d782885986fbf54e6784afd95d1d531b418d8ad00c0f3389847d2fc
Opcode Fuzzy Hash: d2a126c8e87298d62dcb77b716532c519560652f5a9048845524fe30780812a8
Instruction Fuzzy Hash: E1F05E30A41620EBC621BB60FE0CA8B7BA4FB84B81705493AF049B11E8C77448878BDC

Function 0040515C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040518B
CallWindowProcA.USER32(?,?,?,?), ref: 004051DC

Part of subcall function 00404191: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004041A3

Strings

, xrefs: 0040516C

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 4e0d83b517ec3755641dbbc7163631964c054c7a669fd012e4d2f406caf64491
Instruction ID: 1a2e93e4b5b60595961c78cfe9b1f953e315c10ea79d8335bfdfcc16afa4850a
Opcode Fuzzy Hash: 4e0d83b517ec3755641dbbc7163631964c054c7a669fd012e4d2f406caf64491
Instruction Fuzzy Hash: 8B015E31A10709ABEB215F51DD85B5B3A7AEB84314F600537F6007A1D1C73A9C929A69

Function 00405760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422530,Error launching installer), ref: 00405789
CloseHandle.KERNEL32(?), ref: 00405796

Strings

Error launching installer, xrefs: 00405773

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c3c80266f92bd9d667c92bf3182b136ee7f32a01548fe2ad44771ad24a16863f
Instruction ID: 07a2ea870b6c965c9c8bd0de01314bb8301d1462abb1d5e573899e5cf6f1fbe8
Opcode Fuzzy Hash: c3c80266f92bd9d667c92bf3182b136ee7f32a01548fe2ad44771ad24a16863f
Instruction Fuzzy Hash: EEE04FB0A00309BFEB009B60ED45F7B77ACEB04204F408421BD44F2150E77498148A78

Function 0040383F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,756F3410,00000000,C:\Users\user\AppData\Local\Temp\,00403817,00403631,?,?,00000007,00000009,0000000B), ref: 00403859
GlobalFree.KERNEL32(?), ref: 00403860

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040383F

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1881609536
Opcode ID: d577bf8b0ad620a88e67a325e5e326df37630095cafad59fd52e64b4463e9122
Instruction ID: 8a9dc77c7c1ee1b135259636166a50b6bf5175fc084ac984c046f8d06e3dc5f9
Opcode Fuzzy Hash: d577bf8b0ad620a88e67a325e5e326df37630095cafad59fd52e64b4463e9122
Instruction Fuzzy Hash: 1BE0EC3350152057C661AF5AAA0475ABAEC7F48B22F05847AF884BB2618B745C429BDC

Function 00405AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PI_20052024.exe,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00405AA6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PI_20052024.exe,C:\Users\user\Desktop\PI_20052024.exe,80000000,00000003), ref: 00405AB4

Strings

C:\Users\user\Desktop, xrefs: 00405AA0

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-4267323751
Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction ID: b7fadc1cb965da237d7d6f6ff84102907be402caa55b699d9cfbdae9487d107c
Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction Fuzzy Hash: 98D0A9B25099B06EF303A2108C01B8F6A88CF13300F0A00A2E580E21A1C37C4C428BFD

Function 00406BF3 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126d375e0cd8dd3c96d9f56c9c2b4ea3570e5546f357d91bfce8ff404d349699
Instruction ID: 2508fafb39113fa530b835c7ee7350b0f579aeff726ee83cf5aef614fa8a9c48
Opcode Fuzzy Hash: 126d375e0cd8dd3c96d9f56c9c2b4ea3570e5546f357d91bfce8ff404d349699
Instruction Fuzzy Hash: A3A14271E00229CBDB28CFA8C8547ADBBB1FF44305F15816AD856BB281C7786A96DF44

Function 00406DF4 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0c270478a2f9a3adf3a01af42e260dfbb4be2f4416bec3860fa0cf1f45473d
Instruction ID: f0f32deb93356653934a7f7f8ad788a679267befe7528616fd809e2a8ddaf9c6
Opcode Fuzzy Hash: 7d0c270478a2f9a3adf3a01af42e260dfbb4be2f4416bec3860fa0cf1f45473d
Instruction Fuzzy Hash: C8913070D00229CBDF28CF98C854BADBBB1FF44305F15816AD856BB281C779AA96DF44

Function 00406B0A Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79859cd80aa4a68261cc067353b3b3a3bb11021b997dedf9f01a815f4beecf4f
Instruction ID: e43b34c51a548f07c4fb140720fe79cc87a03685924cd857d2d075badb14d917
Opcode Fuzzy Hash: 79859cd80aa4a68261cc067353b3b3a3bb11021b997dedf9f01a815f4beecf4f
Instruction Fuzzy Hash: 2F815371D04229CBDF24CFA8C8847ADBBB1FB44305F25816AD456BB281C738AA96DF05

Function 0040660F Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f3059c0ab10d0f6eca9bda3b9c7ef9d62a7fb15769fd34cf569834d4f38521
Instruction ID: 30cc61a65d8e7361f2687543d4853da4ee9de610700e1b42b944a6768b2f9653
Opcode Fuzzy Hash: 51f3059c0ab10d0f6eca9bda3b9c7ef9d62a7fb15769fd34cf569834d4f38521
Instruction Fuzzy Hash: D4817771D04229CBDF24CFA9C8447AEBBB0FF44305F21816AD856BB281C7796A86DF45

Function 00406A5D Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4b4001fee964b3ec39fcc62e642dbd1d089b63cfe1c3a3d4f330af07c9f72e
Instruction ID: 0ea1ed3bc64708edefeb163875b4580728164d017b9a5fabf4c3c9e69b53418c
Opcode Fuzzy Hash: ae4b4001fee964b3ec39fcc62e642dbd1d089b63cfe1c3a3d4f330af07c9f72e
Instruction Fuzzy Hash: 96712371D00229CBDF24CF98C854BADBBB1FF48305F15816AD856B7281C7395A96DF44

Function 00406B7B Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e38dc9042d38c3d36f7f10ec43a7b3aa55cd06347f931a7d3c587032d94121
Instruction ID: f909a51a05dfa9c5f202b5373a38b9e5f11f80519cee44c22f430a43d8e85a48
Opcode Fuzzy Hash: 46e38dc9042d38c3d36f7f10ec43a7b3aa55cd06347f931a7d3c587032d94121
Instruction Fuzzy Hash: 74713371E00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281C7796A96DF44

Function 00406AC7 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acf286bb029991ed8d3626521cf090d2a7bfbfd73cbce5b83777d77729d6ca6
Instruction ID: 8ba59c5cd0d20fcb356abc66f065f0fd9b5ab0142fa9d7a08340707df7706276
Opcode Fuzzy Hash: 0acf286bb029991ed8d3626521cf090d2a7bfbfd73cbce5b83777d77729d6ca6
Instruction Fuzzy Hash: 2A715571D00229CBDF28CF98C844BADBBB1FF44305F15816AD856B7281C779AA96DF44

Function 00405BBF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BE7
CharNextA.USER32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BF8
lstrlenA.KERNEL32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C01

Memory Dump Source

Source File: 00000000.00000002.1498711239.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1498694956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498724961.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498738256.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498794320.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PI_20052024.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction ID: 9eba209a39fe6667a971e8652d35f93e0e0dd93f5ee50219908c4175a565a31b
Opcode Fuzzy Hash: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction Fuzzy Hash: C7F0F631204914FFDB02DFA4DD40D9FBBA8EF56350B2540B9E840F7211D634EE01ABA8

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PI_20052024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PI_20052024.exePID: 1248, Parent PID: 2592

General

Chronological Activities

Disassembly

Analysis Process: PI_20052024.exePID: 1248, Parent PID: 2592COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
PI_20052024.exe

Function 00403312 Relevance: 86.1, APIs: 32, Strings: 17, Instructions: 366
stringcomfileCOMMON

Function 0040645C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405C89 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 004064CA Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405C5A Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 0040572B Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 00405CD2 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 004057DD Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Function 004037FA Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 00405326 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00404B4A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491
windowmemoryCOMMON

Function 00403C71 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 004038D4 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON