Edit tour

Windows Analysis Report
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Overview

General Information

Sample name:	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
Analysis ID:	1466656
MD5:	94f7917fd8334a283b0d5c408383e4ed
SHA1:	8b1e768eb4493d907df10b29042ef2ff11727c87
SHA256:	3b0246cc2beaacf7c22ab27377a14e9d5cba3dc5b514b4f4a5e8c2eb9c20f612
Tags:	DHLexeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe (PID: 3640 cmdline: "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe" MD5: 94F7917FD8334A283B0D5C408383E4ED)

RegSvcs.exe (PID: 348 cmdline: "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

KaGeys.exe (PID: 6512 cmdline: "C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KaGeys.exe (PID: 6512 cmdline: "C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 4440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.laboratoriosvilla.com.mx", "Username": "compras@laboratoriosvilla.com.mx", "Password": "WZ,2pliw#L)D"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4502936320.0000000002A63000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34754:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347de:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34870:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348da:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3494c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349e2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 348	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x328e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32954:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x329de:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32a70:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32ada:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b4c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32be2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32c72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34754:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347de:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34870:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348da:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3494c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349e2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34754:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347de:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34870:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348da:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3494c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349e2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 348, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KaGeys

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 216.194.161.167, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 348, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.laboratoriosvilla.com.mx", "Username": "compras@laboratoriosvilla.com.mx", "Password": "WZ,2pliw#L)D"}

Multi AV Scanner detection for submitted file

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Virustotal: Detection: 32%			Perma Link
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Joe Sandbox ML: detected

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: RegSvcs.pdb, source: KaGeys.exe, 00000003.00000000.2168403871.0000000000E02000.00000002.00000001.01000000.00000006.sdmp, KaGeys.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2032024813.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2031892049.0000000003B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2032024813.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2031892049.0000000003B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: KaGeys.exe, 00000003.00000000.2168403871.0000000000E02000.00000002.00000001.01000000.00000006.sdmp, KaGeys.exe.2.dr

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F04696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F04696
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F0C9C7
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0C93C FindFirstFileW,FindClose,	0_2_00F0C93C
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F0F200
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F0F35D
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F0F65E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F03A2B
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F03D4E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F0BF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 216.194.161.167:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: IMH-WESTUS IMH-WESTUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 216.194.161.167:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F125E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00F125E2

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.laboratoriosvilla.com.mx

Source: RegSvcs.exe, 00000002.00000002.4502936320.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://laboratoriosvilla.com.mx
Source: RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.laboratoriosvilla.com.mx
Source: RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.4502439200.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4502439200.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BC9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, NmHr1WHWKO.cs

.Net Code: lsx2fUddI

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F1425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F1425A

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F14458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F14458

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

0_2_00F1425A

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F00219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00F00219

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F2CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00F2CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00EA3B4C
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_acba96c3-5
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_52c122ce-c
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_162f6bc7-8
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1f26f108-5

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F040B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00F040B1

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EF8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00EF8858

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F0545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F0545F

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EAE800	0_2_00EAE800
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECDBB5	0_2_00ECDBB5
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EAE060	0_2_00EAE060
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F2804A	0_2_00F2804A
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB4140	0_2_00EB4140
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC2405	0_2_00EC2405
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED6522	0_2_00ED6522
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED267E	0_2_00ED267E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F20665	0_2_00F20665
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB6843	0_2_00EB6843
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC283A	0_2_00EC283A
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED89DF	0_2_00ED89DF
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F20AE2	0_2_00F20AE2
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED6A94	0_2_00ED6A94
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB8A0E	0_2_00EB8A0E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F08B13	0_2_00F08B13
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EFEB07	0_2_00EFEB07
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECCD61	0_2_00ECCD61
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED7006	0_2_00ED7006
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB3190	0_2_00EB3190
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB710E	0_2_00EB710E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EA1287	0_2_00EA1287
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC33C7	0_2_00EC33C7
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECF419	0_2_00ECF419
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC16C4	0_2_00EC16C4
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB5680	0_2_00EB5680
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EB58C0	0_2_00EB58C0
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC78D3	0_2_00EC78D3
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC1BB8	0_2_00EC1BB8
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ED9D05	0_2_00ED9D05
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EAFE40	0_2_00EAFE40
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECBFE6	0_2_00ECBFE6
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC1FD0	0_2_00EC1FD0
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_011135F0	0_2_011135F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FBF458	2_2_00FBF458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FBBAF0	2_2_00FBBAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FB4AD8	2_2_00FB4AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FB3EC0	2_2_00FB3EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FBAF20	2_2_00FBAF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FB4208	2_2_00FB4208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0643BCEC	2_2_0643BCEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0643A6B8	2_2_0643A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0643CE18	2_2_0643CE18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0643EC10	2_2_0643EC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0645B218	2_2_0645B218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06452350	2_2_06452350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_064561D8	2_2_064561D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_064551A0	2_2_064551A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_064558E0	2_2_064558E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06457968	2_2_06457968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06457288	2_2_06457288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0645E388	2_2_0645E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06450040	2_2_06450040

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: String function: 00EC0D27 appears 70 times
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: String function: 00EC8B40 appears 42 times
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: String function: 00EA7F41 appears 35 times

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2033788526.0000000003C63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2032399521.0000000003E0D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0dc05c25-f673-4789-ade7-dd3770f175cc.exe4 vs DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/8@3/3

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F0A2D5 GetLastError,FormatMessageW,

0_2_00F0A2D5

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EF8713 AdjustTokenPrivileges,CloseHandle,		0_2_00EF8713
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EF8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00EF8CC3

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F0B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F0B59E

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F1F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00F1F121

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F186D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00F186D0

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00EA4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\KaGeys

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4440:120:WilError_03
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

File created: C:\Users\user\AppData\Local\Temp\autC01D.tmp

Jump to behavior

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Virustotal: Detection: 32%
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe "C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Static file information: File size 1062400 > 1048576

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegSvcs.pdb, source: KaGeys.exe, 00000003.00000000.2168403871.0000000000E02000.00000002.00000001.01000000.00000006.sdmp, KaGeys.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2032024813.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2031892049.0000000003B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2032024813.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000003.2031892049.0000000003B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: KaGeys.exe, 00000003.00000000.2168403871.0000000000E02000.00000002.00000001.01000000.00000006.sdmp, KaGeys.exe.2.dr

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F1C304 LoadLibraryA,GetProcAddress,

0_2_00F1C304

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EC8B85 push ecx; ret	0_2_00EC8B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FBEFB0 push esp; ret	2_2_00FBF379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FB7593 push edx; retf	2_2_00FB759E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00FB0611 push edx; retf	2_2_00FB061A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_064363F0 push es; ret	2_2_06436400

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	File created: \dhl awb commercail invoice and tracking details.exe
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	File created: \dhl awb commercail invoice and tracking details.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KaGeys			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KaGeys			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00EA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00EA4A35
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F255FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00F255FD

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EC33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EC33C7

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

API/Special instruction interceptor: Address: 1113214

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 3170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 5170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Memory allocated: 2450000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599412	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599288	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7866			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1957			Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

API coverage: 4.6 %

Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe TID: 4764	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe TID: 6020	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F04696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F04696
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F0C9C7
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0C93C FindFirstFileW,FindClose,	0_2_00F0C93C
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F0F200
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F0F35D
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F0F65E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F03A2B
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F03D4E
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F0BF27

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00EA4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599412	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599288	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99646	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99058	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96727	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96616	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96487	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: RegSvcs.exe, 00000002.00000002.4504657727.0000000005BC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	API call chain: ExitProcess graph end node			graph_0-97860
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	API call chain: ExitProcess graph end node			graph_0-98057

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00FB7EE0 CheckRemoteDebuggerPresent,

2_2_00FB7EE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F141FD BlockInput,

0_2_00F141FD

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00EA3B4C

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00ED5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00ED5CCC

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F1C304 LoadLibraryA,GetProcAddress,

0_2_00F1C304

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_01113480 mov eax, dword ptr fs:[00000030h]	0_2_01113480
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_011134E0 mov eax, dword ptr fs:[00000030h]	0_2_011134E0
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_01111E70 mov eax, dword ptr fs:[00000030h]	0_2_01111E70

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EF81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00EF81F7

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00ECA395
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00ECA364 SetUnhandledExceptionFilter,		0_2_00ECA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 72E008

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EF8C93 LogonUserW,

0_2_00EF8C93

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00EA3B4C

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00EA4A35

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F04EF5 mouse_event,

0_2_00F04EF5

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

0_2_00EF81F7

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00F04C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F04C03

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EC886B cpuid

0_2_00EC886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00ED50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00ED50D7

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EE2230 GetUserNameW,

0_2_00EE2230

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00ED418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00ED418A

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Code function: 0_2_00EA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00EA4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 348, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_81
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_XP
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_XPe
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_VISTA
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_7
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: WIN_8
Source: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 348, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe.1120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 348, type: MEMORYSTR

Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F16596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00F16596
Source: C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Code function: 0_2_00F16A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00F16A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	32%	Virustotal		Browse
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	39%	ReversingLabs	Win32.Trojan.Strab
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
laboratoriosvilla.com.mx	0%	Virustotal	Browse
api.ipify.org	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
mail.laboratoriosvilla.com.mx	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://mail.laboratoriosvilla.com.mx	0%	Avira URL Cloud	safe
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://laboratoriosvilla.com.mx	0%	Avira URL Cloud	safe
http://laboratoriosvilla.com.mx	0%	Virustotal		Browse
http://r10.i.lencr.org/0	0%	Avira URL Cloud	safe
http://mail.laboratoriosvilla.com.mx	0%	Virustotal		Browse
http://r10.i.lencr.org/0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
laboratoriosvilla.com.mx	216.194.161.167	true	true	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
mail.laboratoriosvilla.com.mx	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.laboratoriosvilla.com.mx	RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.4502439200.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4502439200.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4504657727.0000000005BC9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000002.00000002.4502936320.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.o.lencr.org0#	RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://laboratoriosvilla.com.mx	RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.4502936320.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4504657727.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
216.194.161.167	laboratoriosvilla.com.mx	United States	22611	IMH-WESTUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466656
Start date and time:	2024-07-03 08:49:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/8@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 270
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target KaGeys.exe, PID 6512 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:50:24	API Interceptor	12392103x Sleep call for process: RegSvcs.exe modified
08:50:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run KaGeys C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
08:50:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run KaGeys C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	roger.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ld.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	roger.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MT_0615_60931PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Doc230906103882.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	roger.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Remittance Advice.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	arrival notice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IMH-WESTUS	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
	https://fhdqc8.fi59.fdske.com/ec/gAAAAABmfGZyxTh2_K7pHFLC0GqgMqzWDGy5rzOEXF5rWzzKyIh9SQQExFxMQ4awca19AuE2VvhAc9xMu62rgsB6VoJB4N9_fBGtHi3bqIWidSZzaqe6vAuqfJ2HLS_07LjIIFB3TPyWrVCoDPci0vJbEOdFpQbvgMhQ2bb5wwjc0QCyYMs2huEbMV0bF6VlM0VyKvcYrSXwroV9aI7YNrZVFratXAJOXua81IBgQ_lBlo0qGGQdFoqJacHMDkjGxuYp664Cy1FCW8W0d91K8bj980Cvliw9OLQxlehUsXbXZowsYCsVKv0Fne-F6gv0Krh2AVe-ilbzwDq1zcnJIobjeErIHapsGWTJtbLVauq4zhAsYdUWRkCB9SiulS3R7ML3XCRzZ_QN	Get hash	malicious	HTMLPhisher	Browse	209.182.194.173
	https://fhdqc8.fi59.fdske.com/ec/gAAAAABmfGZyjC4MVZ8WF44ySzBi6efN3zaqod3SxqQ1kDtzYoyQOsWWD19NsGcVNDBcFjl9mUT7fbfISshhTM2Hik02CHjq-9Q67vAot3BfkCz1fsPEPNCf7G7MVRriPpFBDyLvG5wWqHsR-cwOURIaxnerOQ99C00IkC5xo8SyVqmsRm4_h22BEVkgpwhIxN5ZLSZjkxsDiVXWEiomSy9VfeZMSpAZBIiVY5QOn61X75pVs8oUeoKLdPrvk2c30UYd3VO5mnFHavb6nEffGuo1D5oKxYWc0Cn_-p6tPW-P_jOehq5HKz3wTiXh0DEAmqouDGoQMnrEZrqh3uNO8i3DH8OUtiyY0qJrP4tokSeZMhLFcgcGL1rQtDYermPtRGb82rC_qMPluzB5vb8_joMO7PI6RQTXMQ==	Get hash	malicious	HTMLPhisher	Browse	209.182.194.173
	https://fhdqc8.fi59.fdske.com/ec/gAAAAABmfGZyxTh2_K7pHFLC0GqgMqzWDGy5rzOEXF5rWzzKyIh9SQQExFxMQ4awca19AuE2VvhAc9xMu62rgsB6VoJB4N9_fBGtHi3bqIWidSZzaqe6vAuqfJ2HLS_07LjIIFB3TPyWrVCoDPci0vJbEOdFpQbvgMhQ2bb5wwjc0QCyYMs2huEbMV0bF6VlM0VyKvcYrSXwroV9aI7YNrZVFratXAJOXua81IBgQ_lBlo0qGGQdFoqJacHMDkjGxuYp664Cy1FCW8W0d91K8bj980Cvliw9OLQxlehUsXbXZowsYCsVKv0Fne-F6gv0Krh2AVe-ilbzwDq1zcnJIobjeErIHapsGWTJtbLVauq4zhAsYdUWRkCB9SiulS3R7ML3XCRzZ_QN	Get hash	malicious	HTMLPhisher	Browse	209.182.194.173
	http://outselluar.live	Get hash	malicious	Unknown	Browse	199.250.212.132
	DHL AWB COMMERCAIL INVOICE AND BILL OF LANDING TRACKING DEATAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	216.194.161.167
CLOUDFLARENETUS	Payment_Advice.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://www.getaround.co.il/wp-logs/?r=mag372@norauto.es	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	66.235.200.146
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Att00173994.exe	Get hash	malicious	FormBook	Browse	104.21.92.152
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	MT_0615_60931PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	IMG_0178520003023PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
TUT-ASUS	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	roger.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs	Get hash	malicious	GuLoader	Browse	104.26.13.205
	AF85714759_htm#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.13.205
	Zapytanie ofertowe (GASTRON 07022024).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	AWB 3609 961.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MT_0615_60931PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Doc230906103882.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	birectangular.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	AWB#276097479258.pdf.html	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse
	54dse57Lv7.exe	Get hash	malicious	AgentTesla	Browse
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse
	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KaGeys.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\asset

Download File

Process:	C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.60716245529181
Encrypted:	false
SSDEEP:	6144:iep3Lxul5nE7uXhjWhN9NjqY+v1QRoJr8I:N37uJWhdjXur8I
MD5:	E34395899CA90C529429B7782F4C8D70
SHA1:	6E818F8996DA705E6BAA8FC7EC12858329FA84A1
SHA-256:	5E9B6F5183975D30B2D7247316235ED9C4270E3F7BE4F5825907636EAD92A676
SHA-512:	7A8073CBBB16A4919BF8A9FB3ED9BAE67FB53233EB0DBD3EA0D90C9A7DEAE370F2D5974E8D2B96DCDA296B7CD40F8877EEA0AF0A17D3E68317CE15FBF9804318
Malicious:	false
Reputation:	low
Preview:	y..TVUQMH62T..27.P334LAT.UQML62TMC27RP334LATUUQML62TMC27RP33.LAT[J.CL.;.l.3{.qg[]?a$':6?-[.7,-\X&pQV.>4:u<?m.yat ,VR\|]>9.LATUUQM.s2T.B17..V4LATUUQM.60UFB97R.034DATUUQM..1TMc27R.034L.TUuQML42TIC27RP330LATUUQML.6TMA27RP336L..UUAML&2TMC"7R@334LATEUQML62TMC27..03.LATU.RM.32TMC27RP334LATUUQML66TAC27RP334LATUUQML62TMC27RP334LATUUQML62TMC27RP334LATUuQMD62TMC27RP33<lAT.UQML62TMC27\|$VK@LAT..RML.2TM.17RR334LATUUQML62TmC2W\|"@AWLAT.PQML.1TME27R.034LATUUQML62T.C2w\|"V_[/ATYUQML66TMA27R.034LATUUQML62T.C2uRP334LATUUQML62T.17RP33\|LATWUTMD.0T.t37QP335LARUUQML62TMC27RP334LATUUQML62TMC27RP334LATUUQML62TP...{.\|1.^7R.k.Q.W..!..).\|;.T..A..p?....u%5.}L.[e..E...6.?W)2....m5Z<B^a#bLS.O.o.q` ...K".H...L..>5..e...sr...~[9.j..$.W#,z4%!!).a5+"@^.R.24LAT......$;ym.S<-.^9....x$J.....,P33PLAT'UQM-62T.C27=P33ZLAT+UQM262T.C27.P33.LATpUQM!62TiC27,P33.1N[..$?..TMC27g....!.....z...b<.Ll0h...(....T..9Z.:.~p..=..'..B.:KoxjSLE62PW708qO....lN26QOD64^m=x..u.s.u...<....*.O4LATUU.ML.2TM.7.P33.L.T..QML..T.C.7..3

C:\Users\user\AppData\Local\Temp\autC01D.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	151054
Entropy (8bit):	7.875688617250052
Encrypted:	false
SSDEEP:	3072:dXqZMYTU8sPR/E0MdiZT+V8sMWyyJii1N8aUoU//VhqI87j:da+C0xZT+V8s5AcuXXVhXCj
MD5:	865405B06C50C314DB6FAC4373CCBC56
SHA1:	B936DD7B10193933339B558B975E9DEE09878DB3
SHA-256:	54A320EE3C78D294CD1CCC0A85BE0FA541BF8CE3181B67160E2055FF323B24EF
SHA-512:	DE8CB822BEDFF69079AFD197A37D8F2DBB14E2B0AD9A650635F97A1890E5173AE65029FAC7C6423E9FBE82341CC1909207BF7A88A32DB0D65ECC22F1AA109DCB
Malicious:	false
Reputation:	low
Preview:	EA06......5J.V.M.M.UM..e7.T&s9.2.T......B.C.M.@.....\|[@.B.J...).f.......=n.?..$..[[.M...bMp......<..a....A,.T..... .....eT..3....V.d.m0..S..K.0..(....y.5Jm.........R.u..&..$.33...E..Jm..S.jd..U..i..0..".......dv...L.....M.L.<>y.R......}.....S..e....(..IV.........h......R.P.m.9.^.".Pj...N..(u.A.(.....\|.....\|.U...}..Y....%..(......7%1......^.T..5.....3..@...2.R.....3P....E..\|....z.2........%..o..mSs...u.{..+...:.Y,.q}.gkv_.?aE...y...W..:<...m.....Gb.T.4......$.X..."..=<oU2..Mb../......=..9...9'sEW../SI,.C).Xf......rf@...K...p[^..wy...s.l..9.......IJ.y.}... ....p..Z..B.7....Z..%`....P.... .B..(\......i.......[...2I.g..1Y..h..C....Z;.g...O3..d....{..x...T.u'5....~.j.3..O....]..j..(.i.B.7.N.4...Y..S.Sj.>.6.W....+k...}.M.a..O<....U....c]M.m.d...o....5N.T.@.sj...6o..l.v...m9.\g28..c>.W.3{...`...2...P..J.Zw;.Piu{.z.6._...D.T.....ZU..$)...6...T...u..A._..9..m2.L$.).Z...M)..._WW..&.I<..2...s...V.K....B.N.R@....9;..+.d.6mm.l.RNMN.y......Q..-2MU2..^#Q. ..t..

C:\Users\user\AppData\Local\Temp\autC05C.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	9824
Entropy (8bit):	7.5986589087356275
Encrypted:	false
SSDEEP:	192:65jwEiqEH1WgUJuzJkecGgJo7xocBkP/eH6exLOFyFTfvPPT:I6qEHYV0eecGGo7xocBE/c6ePTfvPr
MD5:	B7EB242789A017337E30B39AFC2F9EC6
SHA1:	9F1830E2A2A1C43AAA78EB25F4566CFCE89B9CFE
SHA-256:	05B47EF147E25A619A4DE6D528FFB57B8B4FAD222CD82ED84E3CC360CCCEA5D9
SHA-512:	6E0468D459EE564ECBD466308F1232553E3DE3CAFC7E542C88EFECACE9227E4F8145775E47DFFE8EC7FC32515627DDC094E4FEE15D9D232861DBF77379A1A12B
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\tapestring

Download File

Process:	C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5885483301510295
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbd+IH6B34vfF3if6gyCy:miTZ+2QoioGRk6ZklputwjpjBkCiw2R5
MD5:	CBDD3E6669D36E57E1DDFD29FDDD1676
SHA1:	D3504178A0012DDB1646547A5B9B4879CF105A13
SHA-256:	D1E02581F0B47D6B55D1A304E519E188196C8EDACD7FA9F2D0F4877952FF3FFA
SHA-512:	7530AB9F0F0E46D3FE84B761E4EFA75EFE65358EAAC509D4E94F44E0789BF8FE2DFF137E67900323584BFA860AE65F14FDAC6A4D73DBFEBC55EF583445D0FCF8
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: llD1w4ROY5.exe, Detection: malicious, Browse Filename: DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe, Detection: malicious, Browse Filename: 8f5WsFcnTc.exe, Detection: malicious, Browse Filename: v31TgVEtHi.exe, Detection: malicious, Browse Filename: 54dse57Lv7.exe, Detection: malicious, Browse Filename: 001 Tech. Spec pdf.exe, Detection: malicious, Browse Filename: doc -scan file.exe, Detection: malicious, Browse Filename: payment order.exe, Detection: malicious, Browse Filename: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, Detection: malicious, Browse Filename: ORDERDATASHEET#PO8738763.scr.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.975205070022554
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
File size:	1'062'400 bytes
MD5:	94f7917fd8334a283b0d5c408383e4ed
SHA1:	8b1e768eb4493d907df10b29042ef2ff11727c87
SHA256:	3b0246cc2beaacf7c22ab27377a14e9d5cba3dc5b514b4f4a5e8c2eb9c20f612
SHA512:	92e649893733de391d1427f5255331acff1184c637f55339793b5c8b3fc881ae1b8f771b2528d576c1e1e041621f3c73f72b539e98842e82c0a44044b9d9feb4
SSDEEP:	24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaIoQ1TwWFq6d5:Vh+ZkldoPK8YaIF1qk
TLSH:	2035AD0273E1C036FFAB92739B6AF64156BC79254133852F13981DB9BD701B2263E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x668499C7 [Wed Jul 3 00:22:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F6F487F326Dh
jmp 00007F6F487E6024h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6F487E61AAh
cmp edi, eax
jc 00007F6F487E650Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F6F487E61A9h
rep movsb
jmp 00007F6F487E64BCh
cmp ecx, 00000080h
jc 00007F6F487E6374h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F6F487E61B0h
bt dword ptr [004BF324h], 01h
jc 00007F6F487E6680h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F6F487E634Dh
test edi, 00000003h
jne 00007F6F487E635Eh
test esi, 00000003h
jne 00007F6F487E633Dh
bt edi, 02h
jnc 00007F6F487E61AFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F6F487E61B3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F6F487E6205h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x38e50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x101000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x38e50	0x39000	d322d905916c6631b0d60a158ce25371	False	0.8837119654605263	data	7.788364236930816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x101000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x30116	data			1.0003606147720001
RT_GROUP_ICON	0x1008d0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x100948	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10095c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x100970	0x14	data	English	Great Britain	1.25
RT_VERSION	0x100984	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x100a60	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:50:24.675971031 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:24.676074982 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:24.676167011 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:24.694832087 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:24.694875002 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.157649040 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.157829046 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.161411047 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.161447048 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.161719084 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.204246044 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.207457066 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.248507977 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.314979076 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.315047979 CEST	443	49704	104.26.13.205	192.168.2.5
Jul 3, 2024 08:50:25.315110922 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.333009005 CEST	49704	443	192.168.2.5	104.26.13.205
Jul 3, 2024 08:50:25.345383883 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:25.350282907 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:25.350403070 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:25.350487947 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:25.355401039 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:25.812995911 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:25.860470057 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.338695049 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.641642094 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.866565943 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:26.866683960 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.866777897 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:26.866851091 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.866859913 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:26.866942883 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:26.867171049 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:26.867408991 CEST	80	49705	208.95.112.1	192.168.2.5
Jul 3, 2024 08:50:26.867512941 CEST	49705	80	192.168.2.5	208.95.112.1
Jul 3, 2024 08:50:27.201354027 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:27.208563089 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:27.208672047 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:27.766865969 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:27.767138958 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:27.772017956 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.146859884 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.146946907 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.147002935 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.147118092 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.152544022 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.313728094 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.314184904 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.319240093 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.485704899 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.485796928 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.485815048 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.485851049 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.524178028 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.529392958 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.688896894 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.691750050 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.697259903 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.856544018 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:28.857781887 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:28.863070965 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.023797989 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.024171114 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.031209946 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.194175005 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.194521904 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.199430943 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.358650923 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.358930111 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.363945007 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.681951046 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.684887886 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.689888000 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.849570036 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.856139898 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856414080 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856476068 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856573105 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856606960 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856683016 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.856707096 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:50:29.861530066 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861673117 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861701965 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861829042 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861857891 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861885071 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:29.861987114 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:30.098651886 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:50:30.141628981 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:52:06.362847090 CEST	49706	587	192.168.2.5	216.194.161.167
Jul 3, 2024 08:52:06.367758036 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:52:06.527513027 CEST	587	49706	216.194.161.167	192.168.2.5
Jul 3, 2024 08:52:06.531338930 CEST	49706	587	192.168.2.5	216.194.161.167

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:50:24.577615976 CEST	63073	53	192.168.2.5	1.1.1.1
Jul 3, 2024 08:50:24.584476948 CEST	53	63073	1.1.1.1	192.168.2.5
Jul 3, 2024 08:50:25.337747097 CEST	62035	53	192.168.2.5	1.1.1.1
Jul 3, 2024 08:50:25.344615936 CEST	53	62035	1.1.1.1	192.168.2.5
Jul 3, 2024 08:50:26.338551998 CEST	57735	53	192.168.2.5	1.1.1.1
Jul 3, 2024 08:50:27.185787916 CEST	53	57735	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 08:50:24.577615976 CEST	192.168.2.5	1.1.1.1	0x805e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:25.337747097 CEST	192.168.2.5	1.1.1.1	0x31d1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:26.338551998 CEST	192.168.2.5	1.1.1.1	0x38d1	Standard query (0)	mail.laboratoriosvilla.com.mx	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 08:50:24.584476948 CEST	1.1.1.1	192.168.2.5	0x805e	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:24.584476948 CEST	1.1.1.1	192.168.2.5	0x805e	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:24.584476948 CEST	1.1.1.1	192.168.2.5	0x805e	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:25.344615936 CEST	1.1.1.1	192.168.2.5	0x31d1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:50:27.185787916 CEST	1.1.1.1	192.168.2.5	0x38d1	No error (0)	mail.laboratoriosvilla.com.mx	laboratoriosvilla.com.mx		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 08:50:27.185787916 CEST	1.1.1.1	192.168.2.5	0x38d1	No error (0)	laboratoriosvilla.com.mx		216.194.161.167	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	208.95.112.1	80	348	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 08:50:25.350487947 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 08:50:25.812995911 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:50:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jul 3, 2024 08:50:26.866565943 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:50:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jul 3, 2024 08:50:26.866777897 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:50:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jul 3, 2024 08:50:26.866859913 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:50:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	443	348	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:50:25 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-03 06:50:25 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 06:50:25 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89d4f0f3de717285-EWR
2024-07-03 06:50:25 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 08:50:27.766865969 CEST	587	49706	216.194.161.167	192.168.2.5	220-server.aipssa.com ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 23:50:27 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 3, 2024 08:50:27.767138958 CEST	49706	587	192.168.2.5	216.194.161.167	EHLO 284992
Jul 3, 2024 08:50:28.146859884 CEST	587	49706	216.194.161.167	192.168.2.5	250-server.aipssa.com Hello 284992 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 3, 2024 08:50:28.146946907 CEST	587	49706	216.194.161.167	192.168.2.5	250-server.aipssa.com Hello 284992 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 3, 2024 08:50:28.147118092 CEST	49706	587	192.168.2.5	216.194.161.167	STARTTLS
Jul 3, 2024 08:50:28.313728094 CEST	587	49706	216.194.161.167	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	02:50:22
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
Imagebase:	0xea0000
File size:	1'062'400 bytes
MD5 hash:	94F7917FD8334A283B0D5C408383E4ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2035158176.0000000001120000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:50:23
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
Imagebase:	0x5e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4502936320.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4502936320.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4501642541.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4502936320.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:50:36
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
Imagebase:	0xe00000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:50:36
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:50:44
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
Imagebase:	0x2d0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:50:44
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 00EA3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EA3B7A
IsDebuggerPresent.KERNEL32 ref: 00EA3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00F662F8,00F662E0,?,?), ref: 00EA3BFD

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Part of subcall function 00EB0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00EA3C26,00F662F8,?,?,?), ref: 00EB0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00EA3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00F593F0,00000010), ref: 00EDD4BC
SetCurrentDirectoryW.KERNEL32(?,00F662F8,?,?,?), ref: 00EDD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00F55D40,00F662F8,?,?,?), ref: 00EDD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00EDD581

Part of subcall function 00EA3A58: GetSysColorBrush.USER32(0000000F), ref: 00EA3A62
Part of subcall function 00EA3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00EA3A71
Part of subcall function 00EA3A58: LoadIconW.USER32(00000063), ref: 00EA3A88
Part of subcall function 00EA3A58: LoadIconW.USER32(000000A4), ref: 00EA3A9A
Part of subcall function 00EA3A58: LoadIconW.USER32(000000A2), ref: 00EA3AAC
Part of subcall function 00EA3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00EA3AD2
Part of subcall function 00EA3A58: RegisterClassExW.USER32(?), ref: 00EA3B28

Part of subcall function 00EA39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EA3A15
Part of subcall function 00EA39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EA3A36
Part of subcall function 00EA39E7: ShowWindow.USER32(00000000,?,?), ref: 00EA3A4A
Part of subcall function 00EA39E7: ShowWindow.USER32(00000000,?,?), ref: 00EA3A53

Part of subcall function 00EA43DB: _memset.LIBCMT ref: 00EA4401
Part of subcall function 00EA43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EA44A6

Strings

This is a third-party compiled AutoIt script., xrefs: 00EDD4B4
runas, xrefs: 00EDD575

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 36a4fb6c7a48fcc974c178fe7b5ad91a716bf4ea7e0dbb3b7a2ff9549cee4c82
Instruction ID: ab0e6425b0b4d44aa9a12b1f119865d736286a7a08add7ffb1cc21b703cbda3b
Opcode Fuzzy Hash: 36a4fb6c7a48fcc974c178fe7b5ad91a716bf4ea7e0dbb3b7a2ff9549cee4c82
Instruction Fuzzy Hash: 0F510D3190824CBECF11EBB4DC15DEDBBB8AF0E714F005179F461BA192DAB46606EB61

Function 00EA4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00EA4EEE,?,?,00000000,00000000), ref: 00EA4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00EA4EEE,?,?,00000000,00000000), ref: 00EA5010
LoadResource.KERNEL32(?,00000000,?,?,00EA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00EA4F8F), ref: 00EDDD60
SizeofResource.KERNEL32(?,00000000,?,?,00EA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00EA4F8F), ref: 00EDDD75
LockResource.KERNEL32(N,?,?,00EA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00EA4F8F,00000000), ref: 00EDDD88

Strings

SCRIPT, xrefs: 00EA5006
N, xrefs: 00EDDD85

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N
API String ID: 3051347437-3852340653
Opcode ID: 84a4f33976b3e8c913d7acf5b8c5b726fc4fe5137e7857b28770f3ff2894b829
Instruction ID: d959ec1874dd35e8e0b0800e142898751fea613fd89084d4142397c6ecac27ba
Opcode Fuzzy Hash: 84a4f33976b3e8c913d7acf5b8c5b726fc4fe5137e7857b28770f3ff2894b829
Instruction Fuzzy Hash: C5115E75200704AFD7318B65DC98F6B7BB9EBCAB11F104578F5059A2A0DB61E8059660

Function 00EA4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00EA4B2B

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

GetCurrentProcess.KERNEL32(?,00F2FAEC,00000000,00000000,?), ref: 00EA4BF8
IsWow64Process.KERNEL32(00000000), ref: 00EA4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00EA4C45
FreeLibrary.KERNEL32(00000000), ref: 00EA4C50
GetSystemInfo.KERNEL32(00000000), ref: 00EA4C81
GetSystemInfo.KERNEL32(00000000), ref: 00EA4C8D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: cd189975f646f11aa0635248305fa406674044fae0a7ce03ac9eebca6435927d
Instruction ID: 668a510edc5b2f37393a89f8939e40ba5e0f23d7a99be9de612b019b55097659
Opcode Fuzzy Hash: cd189975f646f11aa0635248305fa406674044fae0a7ce03ac9eebca6435927d
Instruction Fuzzy Hash: 4C91F57154E7C4DEC731CB6888511AAFFE4AF6A304F4459AED0CBA7B81D260F908D729

Function 00F04696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00EDE7C1), ref: 00F046A6
FindFirstFileW.KERNELBASE(?,?), ref: 00F046B7
FindClose.KERNEL32(00000000), ref: 00F046C7

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: eaa8e83284a2a08c66745688c1ddc8f0204e2218796f21b1e14db52d2da7168f
Instruction ID: ca923777a751fcd7b7c89ca4fc294065e79c43ac185384778c98081f6f25f1e4
Opcode Fuzzy Hash: eaa8e83284a2a08c66745688c1ddc8f0204e2218796f21b1e14db52d2da7168f
Instruction Fuzzy Hash: 25E0D872C204049B8220A738EC4D4EAB76C9E07335F100735F935C10E0F7B06D54B595

Function 00EAE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00EE428C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: a8ea837907080bcc1b079ab172f2a68f6727f146d40069ff8b4022c50a19de93
Instruction ID: 5b02db429dacb4ee6831c47100ced2b04db3897d17930a6a662089b290bf42b0
Opcode Fuzzy Hash: a8ea837907080bcc1b079ab172f2a68f6727f146d40069ff8b4022c50a19de93
Instruction Fuzzy Hash: 40A26A74A04209CFCB24CF98C884AAAB7B1FF4A314F249069E916BF351D775BD42DB91

Function 00EB0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EB0BBB
timeGetTime.WINMM ref: 00EB0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EB0FB3
TranslateMessage.USER32(?), ref: 00EB0FC7
DispatchMessageW.USER32(?), ref: 00EB0FD5
Sleep.KERNEL32(0000000A), ref: 00EB0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00EB105A
DestroyWindow.USER32 ref: 00EB1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EB1080
Sleep.KERNEL32(0000000A,?,?), ref: 00EE52AD
TranslateMessage.USER32(?), ref: 00EE608A
DispatchMessageW.USER32(?), ref: 00EE6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EE60AC

Strings

@GUI_WINHANDLE, xrefs: 00EE53B9
@GUI_CTRLID, xrefs: 00EE5364
@COM_EVENTOBJ, xrefs: 00EE591A
@TRAY_ID, xrefs: 00EE5BB9
@GUI_CTRLHANDLE, xrefs: 00EE540E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: f03d9d4b793baa3f2465425a7ef4821ceefac27a307bbe2b1d87be48206f1da6
Instruction ID: 961cc784aa4cdb8d837d6f689374ac7912507e6c856ed42a94c1a4a17aab3340
Opcode Fuzzy Hash: f03d9d4b793baa3f2465425a7ef4821ceefac27a307bbe2b1d87be48206f1da6
Instruction Fuzzy Hash: B1B2F471608785DFD724DF24C884BABB7E1BF85308F14592DF49AA72A1DB71E844CB82

Function 00F093DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F091E9: __time64.LIBCMT ref: 00F091F3

Part of subcall function 00EA5045: _fseek.LIBCMT ref: 00EA505D

__wsplitpath.LIBCMT ref: 00F094BE

Part of subcall function 00EC432E: __wsplitpath_helper.LIBCMT ref: 00EC436E

_wcscpy.LIBCMT ref: 00F094D1
_wcscat.LIBCMT ref: 00F094E4
__wsplitpath.LIBCMT ref: 00F09509
_wcscat.LIBCMT ref: 00F0951F
_wcscat.LIBCMT ref: 00F09532

Part of subcall function 00F0922F: _memmove.LIBCMT ref: 00F09268
Part of subcall function 00F0922F: _memmove.LIBCMT ref: 00F09277

_wcscmp.LIBCMT ref: 00F09479

Part of subcall function 00F099BE: _wcscmp.LIBCMT ref: 00F09AAE
Part of subcall function 00F099BE: _wcscmp.LIBCMT ref: 00F09AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F096DC
_wcsncpy.LIBCMT ref: 00F0974F
DeleteFileW.KERNEL32(?,?), ref: 00F09785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F0979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F097AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F097BE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 0c1fe227d75d8207f63ee77824e1f5a02c70c6fdbc6cd556ea0307c8d49287bc
Instruction ID: ef58450cf348a9a98c5d049a807260f39e992b4a2ebd6f639ecb08a36e3330a9
Opcode Fuzzy Hash: 0c1fe227d75d8207f63ee77824e1f5a02c70c6fdbc6cd556ea0307c8d49287bc
Instruction Fuzzy Hash: A2C151B2D00119AACF21DF94CD81EDEB7BDEF45310F0040AAF609E7192EB719A45AF65

Function 00EA3031 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 61
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EA3074
RegisterClassExW.USER32(00000030), ref: 00EA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00EA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EA30DC
LoadIconW.USER32(000000A9), ref: 00EA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EA3101

Strings

TaskbarCreated, xrefs: 00EA30A4
AutoIt v3 GUI, xrefs: 00EA3090
+, xrefs: 00EA305D
0, xrefs: 00EA3056

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 69275fa3d6a9c26196c3cfd1a0bb15973a9543d882222000a7784baca9783098
Instruction ID: 50f340a3fa469965c22947216c8294ab1c66228354315b06f62cc3d2970e53e5
Opcode Fuzzy Hash: 69275fa3d6a9c26196c3cfd1a0bb15973a9543d882222000a7784baca9783098
Instruction Fuzzy Hash: 532103B1960218AFDB50CFA4EC89BCDBBF4FB08710F10452AE560E62A0D3B54585AF91

Function 00EA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EA3074
RegisterClassExW.USER32(00000030), ref: 00EA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00EA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EA30DC
LoadIconW.USER32(000000A9), ref: 00EA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EA3101

Strings

TaskbarCreated, xrefs: 00EA30A4
AutoIt v3 GUI, xrefs: 00EA3090
+, xrefs: 00EA305D
0, xrefs: 00EA3056

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e069fec1da9eb149968e7a68d2e61cdfe7e3081e43d9f9d1256b9645e7fabd7b
Instruction ID: 6717bdc3c73d850e7f3b94cb3b2c40ab6b49af38a0800c282ccfe89b7dc8f5d4
Opcode Fuzzy Hash: e069fec1da9eb149968e7a68d2e61cdfe7e3081e43d9f9d1256b9645e7fabd7b
Instruction Fuzzy Hash: F521B2B192121CAFDB10DFA4E989B9DBBF4FB08700F00412AF921E62A0D7B54549AF95

Function 00EA71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EA4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F662F8,?,00EA37C0,?), ref: 00EA4882

Part of subcall function 00EC074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00EA72C5), ref: 00EC0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00EA7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00EDECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00EDED32
RegCloseKey.ADVAPI32(?), ref: 00EDED70
_wcscat.LIBCMT ref: 00EDEDC9

Strings

\, xrefs: 00EDEDEC
Software\AutoIt v3\AutoIt, xrefs: 00EA72FE
\Include\, xrefs: 00EA72C5
Include, xrefs: 00EDECE8, 00EDED29

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 2c7d977de07e22ea8a570255f8280c6f2e6e12004a270274eca63cfdbc6c50ec
Instruction ID: 138579ee90e4df9d5b0f0aa1a0a8275318212d23ad4001fa91dd0ed1c587d6d3
Opcode Fuzzy Hash: 2c7d977de07e22ea8a570255f8280c6f2e6e12004a270274eca63cfdbc6c50ec
Instruction Fuzzy Hash: 3E71CF710183059EC310EF25EC9199BBBF8FF49704F40152EF495AB2A1EB70A949DFA2

Function 00EA3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EA3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00EA3A71
LoadIconW.USER32(00000063), ref: 00EA3A88
LoadIconW.USER32(000000A4), ref: 00EA3A9A
LoadIconW.USER32(000000A2), ref: 00EA3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00EA3AD2
RegisterClassExW.USER32(?), ref: 00EA3B28

Part of subcall function 00EA3041: GetSysColorBrush.USER32(0000000F), ref: 00EA3074
Part of subcall function 00EA3041: RegisterClassExW.USER32(00000030), ref: 00EA309E
Part of subcall function 00EA3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EA30AF
Part of subcall function 00EA3041: InitCommonControlsEx.COMCTL32(?), ref: 00EA30CC
Part of subcall function 00EA3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EA30DC
Part of subcall function 00EA3041: LoadIconW.USER32(000000A9), ref: 00EA30F2
Part of subcall function 00EA3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EA3101

Strings

0, xrefs: 00EA3B06
AutoIt v3, xrefs: 00EA3B17
#, xrefs: 00EA3B0D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 1caf1a1ec7e1ee68c3bda4e0522f744696a0103ba5a261545221122911e334f8
Instruction ID: ba1b5740c60cffa35ab3699cc30122e1bb4461994e3ab36a693d7e5dd173bddf
Opcode Fuzzy Hash: 1caf1a1ec7e1ee68c3bda4e0522f744696a0103ba5a261545221122911e334f8
Instruction Fuzzy Hash: 502137B1910308AFEF109FA4ED19B9D7FB4EB09711F00012AF514EA2A0D3FA5654AF84

Function 00EA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00EA36D2
KillTimer.USER32(?,00000001), ref: 00EA36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EA371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EA372A
CreatePopupMenu.USER32 ref: 00EA373E
PostQuitMessage.USER32(00000000), ref: 00EA375F

Strings

TaskbarCreated, xrefs: 00EA3725

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: b367b71581aa0e907138efeedad51eb6ba06728f8441299bf19b60c74bac6aea
Instruction ID: faec445c2db0da303da0655eb86d581d3125b5f3fd7734baf0cd3732ffc84bf4
Opcode Fuzzy Hash: b367b71581aa0e907138efeedad51eb6ba06728f8441299bf19b60c74bac6aea
Instruction Fuzzy Hash: A2411CB1204109BBDF149F38DC09BBA3755EB4A305F14212AF511FE2B2CAA4BD15B361

Function 00EA3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 00EA380D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00EA37C0
/AutoIt3ExecuteLine, xrefs: 00EA38B9
/AutoIt3OutputDebug, xrefs: 00EA38A4
CMDLINE, xrefs: 00EA3834
/ErrorStdOut, xrefs: 00EA388F
/AutoIt3ExecuteScript, xrefs: 00EA38CE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 5688f2402c462b2f15e8feae1b363f44094d934d65abf3587582aa7051ac4b60
Instruction ID: 9933eeff5dfb14a040ae91cf9bfeda10998674f1e51a2fe5c036abf1a3902fe2
Opcode Fuzzy Hash: 5688f2402c462b2f15e8feae1b363f44094d934d65abf3587582aa7051ac4b60
Instruction Fuzzy Hash: 01A1547191021DAACF04EBA0DC91DEEB7B8BF59300F14142AF416BB191EF756A09CB60

Function 011125D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 011126A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 011128C7

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: 6fca63c806e706b56fb757a088c8069b18d8c567397e781deaf5b3a8b02ad7a0
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 53A10874E04209EBDB18CFA4C894BEEFBB5BF48304F208569E611BB284D7759A80CB55

Function 00EA39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EA3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EA3A36
ShowWindow.USER32(00000000,?,?), ref: 00EA3A4A
ShowWindow.USER32(00000000,?,?), ref: 00EA3A53

Strings

edit, xrefs: 00EA3A30
AutoIt v3, xrefs: 00EA3A0D, 00EA3A12, 00EA3A13

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 49fc7ace725d1d5bbab9f695d45feaeb335e4f6706eb64961c060daec80e6b43
Instruction ID: 6b06dd39be2e2f59ba7132eee907a9e490b3d4d53fb480f5e8a53170ac2412d2
Opcode Fuzzy Hash: 49fc7ace725d1d5bbab9f695d45feaeb335e4f6706eb64961c060daec80e6b43
Instruction Fuzzy Hash: F5F03A706102987EEF3017236C19E273E7DD7C7F50B00003AF910E2170C2E50841EAB0

Function 011123B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011122A0: Sleep.KERNELBASE(000001F4), ref: 011122B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 011124BD

Strings

4LATUUQML62TMC27RP33, xrefs: 01112520, 01112523

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateFileSleep
String ID: 4LATUUQML62TMC27RP33
API String ID: 2694422964-1484607617
Opcode ID: ac7cada94437ac21822bb3d010ff9ab1c3040b54421bc5f037d8afa3a26268a9
Instruction ID: c4ab3e9e66226f1bfaa75b142f6c96c216e00b57b1f77459d2871bd5941e6347
Opcode Fuzzy Hash: ac7cada94437ac21822bb3d010ff9ab1c3040b54421bc5f037d8afa3a26268a9
Instruction Fuzzy Hash: 0B518F30D04249EBEF15DBA4C858BEEFBB9AF14304F1041A9E6097B2C0D7B91B44CBA5

Function 00EA410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00EDD5EC

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

_memset.LIBCMT ref: 00EA418D
_wcscpy.LIBCMT ref: 00EA41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EA41F1

Strings

Line: , xrefs: 00EDD615

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 51f4b2971869fa4dab62f7709967bfacf2a5c9b1137d9c8967cd7e47fd01aa86
Instruction ID: 430806ba055b7968c275bd36a01b25603cb0b759a4a18c15e41b4da764116ff0
Opcode Fuzzy Hash: 51f4b2971869fa4dab62f7709967bfacf2a5c9b1137d9c8967cd7e47fd01aa86
Instruction Fuzzy Hash: 2931E7B1009308AAD721EB60DC56FDB77ECAF9A304F10551EF195A60E1DBB0B649C793

Function 00EC564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00EC56AB
_memcpy_s.LIBCMT ref: 00EC571D
__read_nolock.LIBCMT ref: 00EC577B
__filbuf.LIBCMT ref: 00EC579E
_memset.LIBCMT ref: 00EC57E2

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: c8d0d68703c5844ddaf644f636e07f983d405076c1edec394f19f18df96d4d7c
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 1D519B32A00B05DBDB248F698A40F9E77A5EF40324F64572EF825B62D0D772ADD28B40

Function 00EA69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00EA4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00F662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EA4F6F

_free.LIBCMT ref: 00EDE68C
_free.LIBCMT ref: 00EDE6D3

Part of subcall function 00EA6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00EA6D0D

Strings

Bad directive syntax error, xrefs: 00EDE6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00EDE462

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 266e2ac55a9267f9d5d6540facb3f8b3c92fe9df5dbbac8f0bab1997dd9fc596
Instruction ID: 07baf5da96b4b5bfce03ea7ba5b51c062ee5079f8888f5fe969f333915e997e6
Opcode Fuzzy Hash: 266e2ac55a9267f9d5d6540facb3f8b3c92fe9df5dbbac8f0bab1997dd9fc596
Instruction Fuzzy Hash: FC916B71A10219AFCF04EFA4CC959EDB7B4FF19314B14546AE815BF3A1EB30A905DB50

Function 00EA35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00EA35A1,SwapMouseButtons,00000004,?), ref: 00EA35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00EA35A1,SwapMouseButtons,00000004,?,?,?,?,00EA2754), ref: 00EA35F5
RegCloseKey.KERNELBASE(00000000,?,?,00EA35A1,SwapMouseButtons,00000004,?,?,?,?,00EA2754), ref: 00EA3617

Strings

Control Panel\Mouse, xrefs: 00EA35D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: c93b7894572caddeb9c8a94a9efa95b38391773c678fb22373386ed7bd5a9dae
Instruction ID: efdd9313d67a0c44949ef296a2490b9a76b2c965e75018b86b2478f26815329c
Opcode Fuzzy Hash: c93b7894572caddeb9c8a94a9efa95b38391773c678fb22373386ed7bd5a9dae
Instruction Fuzzy Hash: 4C114871910208BFDB20CFA4DC40DEFBBB8EF49744F0054AAF805EB210E271AE45AB60

Function 011112A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01111ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01111AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01111B13

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: e5c03160b1addcc6191cdf075686c5b77bef4c9c30fc4565104006a8ef27b8d3
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: BA620C30A14658DBEB28CFA4C850BDEB776FF58300F1091A9D20DEB294E7759E81CB59

Function 00F097E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00EA5045: _fseek.LIBCMT ref: 00EA505D

Part of subcall function 00F099BE: _wcscmp.LIBCMT ref: 00F09AAE
Part of subcall function 00F099BE: _wcscmp.LIBCMT ref: 00F09AC1

_free.LIBCMT ref: 00F0992C
_free.LIBCMT ref: 00F09933
_free.LIBCMT ref: 00F0999E

Part of subcall function 00EC2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00EC9C64), ref: 00EC2FA9
Part of subcall function 00EC2F95: GetLastError.KERNEL32(00000000,?,00EC9C64), ref: 00EC2FBB

_free.LIBCMT ref: 00F099A6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: cca83407523c65cb2de902670c4ba565807ad0117f559909f885f6625c0d6782
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: F0514FB1D04258AFDF249F64CC81A9EBBB9EF48310F1044AEB649B7281DB755E80DF58

Function 00EC493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EC49D0
__flush.LIBCMT ref: 00EC49F0
__write.LIBCMT ref: 00EC4A23
__flsbuf.LIBCMT ref: 00EC4A51

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 60d43dbd261eb0a127ce969f52f404c7aa915f1f2ae9912e8093d155adc5673f
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 3741E8B0A007169BDF18CE69CAA0FAF77A5EF80364B14A13DE855E76C0E772DD428744

Function 00EA73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EDEE62
GetOpenFileNameW.COMDLG32(?), ref: 00EDEEAC

Part of subcall function 00EA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EA48A1,?,?,00EA37C0,?), ref: 00EA48CE

Part of subcall function 00EC09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EC09F4

Strings

X, xrefs: 00EDEE7A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 39183bdfd84ecb9f18f0d54f4e8370b0229f039462036152a01a8f21f0a6c949
Instruction ID: 378e766439e3dd7290ba5204caefda53ae59c1cbc539784272d372af010d553a
Opcode Fuzzy Hash: 39183bdfd84ecb9f18f0d54f4e8370b0229f039462036152a01a8f21f0a6c949
Instruction Fuzzy Hash: 1C21A4719042589BCB15DF94DC45BEE7BF89F49304F00505AE908FB342DBF8594E9B91

Function 00F0901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F09036
__fread_nolock.LIBCMT ref: 00F0904B

Strings

EA06, xrefs: 00F0907D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 7756c89097b547fb7f232ec15ffc89a1bcaa72735c7bd7dadbf77fa03adc4e6c
Instruction ID: 0092ad5729676ca12624267b87df70d6ad01dda706ace3245392fbbb1d278a0b
Opcode Fuzzy Hash: 7756c89097b547fb7f232ec15ffc89a1bcaa72735c7bd7dadbf77fa03adc4e6c
Instruction Fuzzy Hash: FC01B9729042586EDB28C6A8C856FEE7BF89B15311F00419EF552D2181E5B5E6189B60

Function 00F09B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00F09B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00F09B99

Strings

aut, xrefs: 00F09B93

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: a63b4c59a388f0c2e1c58de699c258f9307b5d464980ce88ac561a57a668a2df
Instruction ID: 8801348603167e3e193ce358b9b339ea5a097f57de068f3ff7641cc929921a9b
Opcode Fuzzy Hash: a63b4c59a388f0c2e1c58de699c258f9307b5d464980ce88ac561a57a668a2df
Instruction Fuzzy Hash: 88D05E7954030DABDB20DBA0DC0EF9A773CE704701F0042B1BF54911E1DEB095AD9BA2

Function 00F1CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68754e75b4e2e97274420dad34dd13ab5906cf55dfabea2f1df219ab73a2870
Instruction ID: e176d5174c85d648652dbc4c42a424724765c1ebe9eb0e85a84b21d580893a8e
Opcode Fuzzy Hash: d68754e75b4e2e97274420dad34dd13ab5906cf55dfabea2f1df219ab73a2870
Instruction Fuzzy Hash: 9BF14971A083459FC714DF28C880A6ABBF5FF89314F14892EF8999B251D735E945CF82

Function 00EAF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EC03D3
Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00EC03DB
Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EC03E6
Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EC03F1
Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00EC03F9
Part of subcall function 00EC03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00EC0401

Part of subcall function 00EB6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00EAFA90), ref: 00EB62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00EAFB2D
OleInitialize.OLE32(00000000), ref: 00EAFBAA
CloseHandle.KERNEL32(00000000), ref: 00EE49F2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 9b4a26a13c19b5e4ca90b64a4905550bf2f04bf4acee08064fc794f7fee5933c
Instruction ID: 3bca7a78a497bf7992dec23b07ad43a9a6a311d592c45bbed7580b72f9f03ba8
Opcode Fuzzy Hash: 9b4a26a13c19b5e4ca90b64a4905550bf2f04bf4acee08064fc794f7fee5933c
Instruction Fuzzy Hash: 2B81AAB09012489EC784DF29ED52655BBF4FB99308B10923EE429D7362EFB19405FF90

Function 00EA43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EA4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EA44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EA44C3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: a34a63030dc0f4cdda0e2a64834f2b70e6941b99479847e85350e397c5429246
Instruction ID: 41e407f8a355612df88cd0c5c8116627ea21a4e9a0f5b2a652df303f8af81076
Opcode Fuzzy Hash: a34a63030dc0f4cdda0e2a64834f2b70e6941b99479847e85350e397c5429246
Instruction Fuzzy Hash: 7A3180B05043059FD720DF24D884797BBF8FB8D308F00092EE5AAD7291D7B5A948DB92

Function 00EC594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00EC5963

Part of subcall function 00ECA3AB: __NMSG_WRITE.LIBCMT ref: 00ECA3D2
Part of subcall function 00ECA3AB: __NMSG_WRITE.LIBCMT ref: 00ECA3DC

__NMSG_WRITE.LIBCMT ref: 00EC596A

Part of subcall function 00ECA408: GetModuleFileNameW.KERNEL32(00000000,00F643BA,00000104,?,00000001,00000000), ref: 00ECA49A
Part of subcall function 00ECA408: ___crtMessageBoxW.LIBCMT ref: 00ECA548

Part of subcall function 00EC32DF: ___crtCorExitProcess.LIBCMT ref: 00EC32E5
Part of subcall function 00EC32DF: ExitProcess.KERNEL32 ref: 00EC32EE

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

RtlAllocateHeap.NTDLL(01160000,00000000,00000001,00000000,?,?,?,00EC1013,?), ref: 00EC598F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 049824920f9735b842f69ef1a453021f1d566cfd29eb6d0e4731caa03f321537
Instruction ID: 79efd29cf300431af62e3a4a6e9f388cd99c9bdc5dde063f7f24e0cd44781811
Opcode Fuzzy Hash: 049824920f9735b842f69ef1a453021f1d566cfd29eb6d0e4731caa03f321537
Instruction Fuzzy Hash: 5301C432200B15DED6213B749B51F6D72A89F92B34F10216EF421B6181DA73BD839760

Function 00F09B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00F097D2,?,?,?,?,?,00000004), ref: 00F09B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00F097D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00F09B5B
CloseHandle.KERNEL32(00000000,?,00F097D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F09B62

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: a697bea9d11b21f297bbbab0a5c1b800fdbad1064cb33a5af30996b35d2ef9eb
Instruction ID: a50cbed46c81852c4d0a3a5dc899b98d96a290d1a35221e77017798acb8f5469
Opcode Fuzzy Hash: a697bea9d11b21f297bbbab0a5c1b800fdbad1064cb33a5af30996b35d2ef9eb
Instruction Fuzzy Hash: B6E08632580318B7D7311B94EC0AFCA7B28EB05771F104230FB24690E087B12A26A798

Function 00F08F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F08FA5

Part of subcall function 00EC2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00EC9C64), ref: 00EC2FA9
Part of subcall function 00EC2F95: GetLastError.KERNEL32(00000000,?,00EC9C64), ref: 00EC2FBB

_free.LIBCMT ref: 00F08FB6
_free.LIBCMT ref: 00F08FC8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 5549d675c4d4805946aec68aa7076d183d5f3e37386b95fa34c9c828152819cd
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 6BE012A1B097464ACA24B578AE40F9357EF5F483B1718181DB549FB182DE24E843A124

Function 00EAAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00EE002B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 77013c0594f778d782f07f6572abc5c71b4b0cdf9a3a42efaf0e5c221fd1bbf2
Instruction ID: 3f5b18a35e3541e99b4cd5b73162173542a79d829a0b967147c68c199b966338
Opcode Fuzzy Hash: 77013c0594f778d782f07f6572abc5c71b4b0cdf9a3a42efaf0e5c221fd1bbf2
Instruction Fuzzy Hash: C4226A70508341DFC724DF14C494B6ABBE1BF8A304F19996DE896AB362D771EC81DB82

Function 00EA4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EA4E1A

Strings

EA06, xrefs: 00EDDCF5

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 8c67d1d1bb68dfa2afd8704a6f01233a0f0153f871bf027836e7049787eb9be4
Instruction ID: 377f4823ed93e93bd931bde4f456d9eb8761be150906581139c12f6091b1efd0
Opcode Fuzzy Hash: 8c67d1d1bb68dfa2afd8704a6f01233a0f0153f871bf027836e7049787eb9be4
Instruction Fuzzy Hash: A5416FB2A041545BCF115B648C517FE7FE6AB8F304F18B065E841BE2C2C6E1BD4483E1

Function 00EA492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00EA4992

Part of subcall function 00EC35AC: __lock.LIBCMT ref: 00EC35B2
Part of subcall function 00EC35AC: DecodePointer.KERNEL32(00000001,?,00EA49A7,00EF81BC), ref: 00EC35BE
Part of subcall function 00EC35AC: EncodePointer.KERNEL32(?,?,00EA49A7,00EF81BC), ref: 00EC35C9

Part of subcall function 00EA4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00EA4A73
Part of subcall function 00EA4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EA4A88

Part of subcall function 00EA3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EA3B7A
Part of subcall function 00EA3B4C: IsDebuggerPresent.KERNEL32 ref: 00EA3B8C
Part of subcall function 00EA3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00F662F8,00F662E0,?,?), ref: 00EA3BFD
Part of subcall function 00EA3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00EA3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EA49D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 5beeeab316f97201a85966b90392bf19101028541419bb16b26f6e4c052bd6ec
Instruction ID: c26fce73476957e635ca7164ab1cbad31b9373ef63885a2c3c63c0729074bf2e
Opcode Fuzzy Hash: 5beeeab316f97201a85966b90392bf19101028541419bb16b26f6e4c052bd6ec
Instruction Fuzzy Hash: 56119D719183199BC700EF28DD0590AFFF8EB9A710F00852EF065A72B2DBB1A555DB92

Function 00EA5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00EA5981,?,?,?,?), ref: 00EA5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00EA5981,?,?,?,?), ref: 00EDE19C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 869b438d49e7ffa5868cc4fd2ccd44d7e5817635e7f93ae69c0cbf0fc51cce7e
Instruction ID: 04983634f41645600d00c56a9cf56a28f10ccefb7379758ec88103b152a052cd
Opcode Fuzzy Hash: 869b438d49e7ffa5868cc4fd2ccd44d7e5817635e7f93ae69c0cbf0fc51cce7e
Instruction Fuzzy Hash: 49019671244708BEF7241E14CC8AF66379CEB0677CF10C315BAE56E1D0C6B02D458B50

Function 00EC0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EC594C: __FF_MSGBANNER.LIBCMT ref: 00EC5963
Part of subcall function 00EC594C: __NMSG_WRITE.LIBCMT ref: 00EC596A
Part of subcall function 00EC594C: RtlAllocateHeap.NTDLL(01160000,00000000,00000001,00000000,?,?,?,00EC1013,?), ref: 00EC598F

std::exception::exception.LIBCMT ref: 00EC102C
__CxxThrowException@8.LIBCMT ref: 00EC1041

Part of subcall function 00EC87DB: RaiseException.KERNEL32(?,?,?,00F5BAF8,00000000,?,?,?,?,00EC1046,?,00F5BAF8,?,00000001), ref: 00EC8830

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: a97a69fdf9a861f60054395829733d3a6866982b9a9b8907ea57ccedd90fbb2a
Instruction ID: f2173766f5e0f59ee9990103449d69137c4fe3a30cb671cdee3106f8a6e1a7d2
Opcode Fuzzy Hash: a97a69fdf9a861f60054395829733d3a6866982b9a9b8907ea57ccedd90fbb2a
Instruction Fuzzy Hash: D9F0A935500259E6C720AA54EF16FDF77E89F01365F10145EFC04F6552EF729A8292D1

Function 00EC582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EC585C
__lock_file.LIBCMT ref: 00EC587D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: d7d6ddfa7650943f652e36d4fe2aea3abda0d6c3d39790a35d7820684ef82cd9
Instruction ID: 1fe31517b14038870c77bfb0f3cbc8b4bc522afbedba9e8837cb58fbdfa8ded0
Opcode Fuzzy Hash: d7d6ddfa7650943f652e36d4fe2aea3abda0d6c3d39790a35d7820684ef82cd9
Instruction Fuzzy Hash: 68012573800619EBCF15AF658F06E9E7BA1AF40360F14922DB8147A161DB339A53DB51

Function 00EC55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

__lock_file.LIBCMT ref: 00EC561B

Part of subcall function 00EC6E4E: __lock.LIBCMT ref: 00EC6E71

__fclose_nolock.LIBCMT ref: 00EC5626

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: b89d4ea7580663f1c3f609dbecb649022c88aed92d0d7267becd629ce0667fad
Instruction ID: c5b86aa194789cd9e0d91edbbb812b9a14e4874844e22d5b1faa22d6ef19f403
Opcode Fuzzy Hash: b89d4ea7580663f1c3f609dbecb649022c88aed92d0d7267becd629ce0667fad
Instruction Fuzzy Hash: 35F0C232800B049AD720AB748B02F6E67E05F40334F54A10DE820BB1C1CF7999839B45

Function 0111129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01111ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01111AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01111B13

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: ff7884f8758b5d95c2cf37cb7ec4be78ac64174af1e267f091e8815a84df5e1d
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 0A12BF24E24658C6EB24DF64D8507DEB232EF68300F1094E9D10DEB7A5E77A4F81CB5A

Function 00EB2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9750b24a02069c16b4e21b98082848855e8857b2e17e75ab49c40f89a14f6f67
Instruction ID: dddeeaf2fcbeeaa58936f0111a361d60339a6491d044815ad3d8e01792af3cfd
Opcode Fuzzy Hash: 9750b24a02069c16b4e21b98082848855e8857b2e17e75ab49c40f89a14f6f67
Instruction Fuzzy Hash: 3F517F35700604ABCF14EB58C991EAE77E5AF89314F14A1A8F906BF392CA30FD00DB51

Function 00EA766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EA774A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ff4398cb78296a2dbd202ebd1e29aa3c893a1f701c43b194804ea4deae2e0d62
Instruction ID: c8c33022e89f26dd15819f1827030943460782c15c313fa2ef9a2f8184520310
Opcode Fuzzy Hash: ff4398cb78296a2dbd202ebd1e29aa3c893a1f701c43b194804ea4deae2e0d62
Instruction Fuzzy Hash: 95319279208A02DFC724DF18C990A62F7E0FF4A310714D56EE9899F765E730E882CB44

Function 00EA5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00EA5CF6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 15ef9fc92cf8a714a9c0f4adcc24a5a68b6b132b4a64eff5698f940244ce83c1
Instruction ID: 82ef0a55bcc02cadd7db885fde29a02568c7b866216633798a41da70c3995981
Opcode Fuzzy Hash: 15ef9fc92cf8a714a9c0f4adcc24a5a68b6b132b4a64eff5698f940244ce83c1
Instruction Fuzzy Hash: 24316D32A00B09AFCB18DF2DC484A9DF7B1FF49324F148629E819AB714D731B960DB90

Function 00EE00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00EE00E1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4f44db94fa651d249c4635e7d7d40b86713c7ca42cee6928c5c20fa1b19d79ac
Instruction ID: 7dd415306faa6ff8eddf5fb05903a14cdf6043485dbb4fe9e72f4d0f517ad2b1
Opcode Fuzzy Hash: 4f44db94fa651d249c4635e7d7d40b86713c7ca42cee6928c5c20fa1b19d79ac
Instruction Fuzzy Hash: FA41E574504351DFDB24DF14C484B1ABBE0BF4A318F1998ACE8996B762C772F885CB52

Function 00EA80D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EA8109

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction ID: d8fff8be522a715c7d71e4126673b5da691c0ddccb8c1810f40941d77829aee7
Opcode Fuzzy Hash: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction Fuzzy Hash: 9C117C75201601DFC724CF28D581A16B7E9FF49314720C82EE88ADB261DB32F842CB40

Function 00EA4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00EA4D4D

Part of subcall function 00EC548B: __wfsopen.LIBCMT ref: 00EC5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00F662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EA4F6F

Part of subcall function 00EA4CC8: FreeLibrary.KERNEL32(00000000), ref: 00EA4D02

Part of subcall function 00EA4DD0: _memmove.LIBCMT ref: 00EA4E1A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 42a67a938f230c632fa97604143bddac0a5e98ab6a9d720636414f8ce0c5103d
Instruction ID: e7caf140477c49280210b248bf6b09708ef5fe77c70af85566d57ad99103932e
Opcode Fuzzy Hash: 42a67a938f230c632fa97604143bddac0a5e98ab6a9d720636414f8ce0c5103d
Instruction Fuzzy Hash: 3411EB72700309AADF14BF70DC42FAD77E59F89710F14A439F541BA1C1DAF1AA059750

Function 00EE01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00EE01BB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: afd4cecfb8836e6fcbe7772532af111eee3b7d95f5a4572e8dc8cf7a534eb4d6
Instruction ID: a45c423cfdc046269eed959fcc7caef0d9863c5f53bf7fa30d7e3b1ce8c57fcb
Opcode Fuzzy Hash: afd4cecfb8836e6fcbe7772532af111eee3b7d95f5a4572e8dc8cf7a534eb4d6
Instruction Fuzzy Hash: 7C212774508341DFCB24DF54C445B5ABBE0BF8A304F09996CE9896B722D731F885DB52

Function 00EA5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00EA5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00EA5D76

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 211cfeaa6d57a972a45c1789816de0e204af7302c9fa3da68459ec08bcf97f0e
Instruction ID: b69985e45cfd1b5da33aa5861580f61f1305e7bc4c33b762f6fc5763891a8df1
Opcode Fuzzy Hash: 211cfeaa6d57a972a45c1789816de0e204af7302c9fa3da68459ec08bcf97f0e
Instruction Fuzzy Hash: 6C113A32200B059FD3308F15C884B67B7E9EF4A764F10C92EE5AA9AA50D770F945CB60

Function 00EC4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00EC4AD6

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: c7efe5d7c6579f782c7544aae49cda5f1cdb2c6725fda48f29b9290995c7fbbc
Instruction ID: 283538a762b20b361ebdb7ec91489be1faa08816717439bb6b708ee63c75a799
Opcode Fuzzy Hash: c7efe5d7c6579f782c7544aae49cda5f1cdb2c6725fda48f29b9290995c7fbbc
Instruction Fuzzy Hash: AEF0D1B1900209ABDB61AF648B02F9E36E0AF00329F04950CF824BA1D1DB7A8E52DB41

Function 00EA4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00F662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EA4FDE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 90765d9954a586554aeb1a16d37087e4b41ec9a4990b737b514856c5ec92ed32
Instruction ID: 37b5aa3916799d3fc2b6a339f2934f29e561e1ca458e369bac54716ef7e21a2b
Opcode Fuzzy Hash: 90765d9954a586554aeb1a16d37087e4b41ec9a4990b737b514856c5ec92ed32
Instruction Fuzzy Hash: 73F01CB5205711CFC7349F64D494852BBE1AF4A329320BA3EE1D696650C7B1A854DB40

Function 00EC09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EC09F4

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 6eb7341163d53ec8c50656686e6e7ec87656e62dbc28c505532c8c4f3bdd6f56
Instruction ID: 7c72706c64e06ac193618a8c039ee12837ecff207abc6068b3fa1ace2bcc9eb4
Opcode Fuzzy Hash: 6eb7341163d53ec8c50656686e6e7ec87656e62dbc28c505532c8c4f3bdd6f56
Instruction Fuzzy Hash: 83E0863690422897C720D6989C05FFA77EDDF89790F0501B6FC4CD7244D960AC868690

Function 00F09129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F0914B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 4986e8a876b39d397c4e673f49786fb1d25c18915b6903ca62fd962e186012fb
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 0CE092B1608B409FDB388A24D810BE373E0AB06315F00091CF29A93342EBA378429759

Function 00EA5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00EDE16B,?,?,00000000), ref: 00EA5DBF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: fc1cc8834c62bde45db5ba9106b4171dc822a532417e682e551e2a73b943e1ca
Instruction ID: 2d4ffa325c9bc0464d8cc7bb1096aaf592d354fb0b57334edb411463ba25e8df
Opcode Fuzzy Hash: fc1cc8834c62bde45db5ba9106b4171dc822a532417e682e551e2a73b943e1ca
Instruction Fuzzy Hash: 90D0C77465020CBFE710DB80DC46FA9777CD705710F500194FD0456290D6B27D549795

Function 00EC548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00EC5496

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 964ec2fe1836abe3c01db534ac0d36472ffc247995e37f83d097baddfab21f16
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B9B0927684020C77DE012E82EC02F593B59AB40679F808020FB1C28162A673A6B19689

Function 00F0D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00F0D46A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 0bbe04e5066bc7a917d4d92bf1b11e03b56a2104c96ec43b1fd8a2e49f1adcf6
Instruction ID: 6b1269b48f69d37c877630533559b3f895376c8b6bb46237eb48abb09f1baa10
Opcode Fuzzy Hash: 0bbe04e5066bc7a917d4d92bf1b11e03b56a2104c96ec43b1fd8a2e49f1adcf6
Instruction Fuzzy Hash: CC7171356083018FC714EF64C891A6EB7E4AF89314F04596DF8969B2E2DB30FD49EB52

Function 00EC0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00EC0EF7

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 82ac0cde4a9910abb279918fd773a5460029a28aa782b178dad9c33426070795
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4A31E970A40105DFCB18DF58C680A69F7B6FF59304B649AA9E409EB651D732EDC2CBC0

Function 0111229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 011122B1

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: e87b84037c1dee869f55d56651aaf36348218d700b3190948a0ef5af8c891081
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: DEE0BF7494010EEFDB00EFE4D5496DE7BB4EF04311F1005A1FD05D7681DB309E648A62

Function 011122A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 011122B1

Memory Dump Source

Source File: 00000000.00000002.2035139060.0000000001110000.00000040.00001000.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 8c8255bbb1b67b8cb441bb6c9a2513347190bffa9a651bf600627ac1061f1625
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 4BE0BF7494010E9FDB00EFA4D54969E7BB4EF04301F100161FD0192281D73099608A62

Non-executed Functions

Function 00F2CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F2CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F2CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00F2CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F2CF00
SendMessageW.USER32 ref: 00F2CF29
_wcsncpy.LIBCMT ref: 00F2CFA1
GetKeyState.USER32(00000011), ref: 00F2CFC2
GetKeyState.USER32(00000009), ref: 00F2CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F2CFE5
GetKeyState.USER32(00000010), ref: 00F2CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F2D018
SendMessageW.USER32 ref: 00F2D03F
SendMessageW.USER32(?,00001030,?,00F2B602), ref: 00F2D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F2D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F2D16E
SetCapture.USER32(?), ref: 00F2D177
ClientToScreen.USER32(?,?), ref: 00F2D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F2D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F2D203
ReleaseCapture.USER32 ref: 00F2D20E
GetCursorPos.USER32(?), ref: 00F2D248
ScreenToClient.USER32(?,?), ref: 00F2D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F2D2B1
SendMessageW.USER32 ref: 00F2D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F2D31C
SendMessageW.USER32 ref: 00F2D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F2D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F2D37B
GetCursorPos.USER32(?), ref: 00F2D39B
ScreenToClient.USER32(?,?), ref: 00F2D3A8
GetParent.USER32(?), ref: 00F2D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F2D431
SendMessageW.USER32 ref: 00F2D462
ClientToScreen.USER32(?,?), ref: 00F2D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F2D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F2D51A
SendMessageW.USER32 ref: 00F2D53D
ClientToScreen.USER32(?,?), ref: 00F2D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F2D5C3

Part of subcall function 00EA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EA25EC

GetWindowLongW.USER32(?,000000F0), ref: 00F2D65F

Strings

@GUI_DRAGID, xrefs: 00F2D1AA
F, xrefs: 00F2D543

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 1025c21257aea1310abc60a6c0b4600c57a84b93b7a31a106dad90d7000570ed
Instruction ID: 3a441949c3332b9f5f2859c3e06833bfe38d507b627797275dfa64c13c85053a
Opcode Fuzzy Hash: 1025c21257aea1310abc60a6c0b4600c57a84b93b7a31a106dad90d7000570ed
Instruction Fuzzy Hash: CF42CB30A04251AFDB20CF28D844FAABBF5FF49324F14062DF695972A1C771A845EB92

Function 00F2804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00F2873F

Strings

%d/%02d/%02d, xrefs: 00F28478

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 5afa30d86e09f4ba8a173d172d4e6f4b47d901d860c80661cd0ee97f451c69ee
Instruction ID: 3d642fe5817c3a5d0cdb2bfb1ce0e65343bd378ea39348b073ffa471942bfba5
Opcode Fuzzy Hash: 5afa30d86e09f4ba8a173d172d4e6f4b47d901d860c80661cd0ee97f451c69ee
Instruction Fuzzy Hash: A012F471901228ABEB258F24DC49FAE7BF8EF493A0F144129F515EB1E1DF709946EB10

Function 00EB710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EB75C2
_memset.LIBCMT ref: 00EB76B1
_memmove.LIBCMT ref: 00EB7C4B
_memmove.LIBCMT ref: 00EB7E4F

Strings

Q\E, xrefs: 00EB81C1
[:<:]], xrefs: 00EB75F1
[:>:]], xrefs: 00EB760A
\b(?<=\w), xrefs: 00EF3C41
\b(?=\w), xrefs: 00EF3C34
Oa, xrefs: 00EF287E
DEFINE, xrefs: 00EF25AF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Oa$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-2202602582
Opcode ID: 4f627569940d99fe86b7fe37001c2d6c12436f7f4e298abb4f3141013146ec81
Instruction ID: 850589c6c4b0280dd5e0efe04d7c4503d89ec26a15406856012690c29fddc538
Opcode Fuzzy Hash: 4f627569940d99fe86b7fe37001c2d6c12436f7f4e298abb4f3141013146ec81
Instruction Fuzzy Hash: AC938071A002199BDB24CF68C8817FEB7B1FF48714F25916AEA55FB290E7709E81CB40

Function 00EA4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00EA4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00EDDA8E
IsIconic.USER32(?), ref: 00EDDA97
ShowWindow.USER32(?,00000009), ref: 00EDDAA4
SetForegroundWindow.USER32(?), ref: 00EDDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00EDDAC4
GetCurrentThreadId.KERNEL32 ref: 00EDDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EDDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EDDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EDDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00EDDAF8
SetForegroundWindow.USER32(?), ref: 00EDDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EDDB10
keybd_event.USER32(00000012,00000000), ref: 00EDDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EDDB25
keybd_event.USER32(00000012,00000000), ref: 00EDDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EDDB33
keybd_event.USER32(00000012,00000000), ref: 00EDDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EDDB42
keybd_event.USER32(00000012,00000000), ref: 00EDDB47
SetForegroundWindow.USER32(?), ref: 00EDDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00EDDB71

Strings

Shell_TrayWnd, xrefs: 00EDDA89

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9f79b50a2322e8ef0853ea202a4364f15ed9f47b7c34d0706c6aad2c3e4f65ca
Instruction ID: 374c0656b498d56c50c9ac4d23a706f6cc55457723dea411d6df6fddb21a9ac5
Opcode Fuzzy Hash: 9f79b50a2322e8ef0853ea202a4364f15ed9f47b7c34d0706c6aad2c3e4f65ca
Instruction Fuzzy Hash: 60316271A5031CBBEB306FA19C4AF7E3E7CEB44B50F154036FA04EA1D0C6B05912BAA0

Function 00EF8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00EF8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EF8D0D
Part of subcall function 00EF8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EF8D3A
Part of subcall function 00EF8CC3: GetLastError.KERNEL32 ref: 00EF8D47

_memset.LIBCMT ref: 00EF889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00EF88ED
CloseHandle.KERNEL32(?), ref: 00EF88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00EF8915
GetProcessWindowStation.USER32 ref: 00EF892E
SetProcessWindowStation.USER32(00000000), ref: 00EF8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00EF8952

Part of subcall function 00EF8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EF8851), ref: 00EF8728
Part of subcall function 00EF8713: CloseHandle.KERNEL32(?,?,00EF8851), ref: 00EF873A

Strings

default, xrefs: 00EF894D
winsta0, xrefs: 00EF8910
, xrefs: 00EF88AA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: aa4c75d5b8718d37dd339235ef564d307965884e81d7b8584d08142cc142fb4b
Instruction ID: 7ef405262ab672618414b609be9ffd1caabb6621690c53a109050835199872b8
Opcode Fuzzy Hash: aa4c75d5b8718d37dd339235ef564d307965884e81d7b8584d08142cc142fb4b
Instruction Fuzzy Hash: 2A813A7190024DAFDF21DFA4DE45AFE7BB8EF04348F08516AFA20B6161DB318E159B60

Function 00F1425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00F2F910), ref: 00F14284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00F14292
GetClipboardData.USER32(0000000D), ref: 00F1429A
CloseClipboard.USER32 ref: 00F142A6
GlobalLock.KERNEL32(00000000), ref: 00F142C2
CloseClipboard.USER32 ref: 00F142CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00F142E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00F142EE
GetClipboardData.USER32(00000001), ref: 00F142F6
GlobalLock.KERNEL32(00000000), ref: 00F14303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00F14337
CloseClipboard.USER32 ref: 00F14447

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: d5a54847a36ff634dfb309b479d7a2c36be2d4128dc1b2370fa081ec7008a44f
Instruction ID: 33a93f84fa2755de13f99074b41f180a438f0d5b25ed6b3cf9862c79cc412949
Opcode Fuzzy Hash: d5a54847a36ff634dfb309b479d7a2c36be2d4128dc1b2370fa081ec7008a44f
Instruction Fuzzy Hash: 7C51C331204305ABD310EF60DC85FAE77B8AF84B10F104539F556E61E1DB70E94AAB62

Function 00F0C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F0C9F8
FindClose.KERNEL32(00000000), ref: 00F0CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F0CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F0CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F0CAAF
__swprintf.LIBCMT ref: 00F0CAFB
__swprintf.LIBCMT ref: 00F0CB3E

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

__swprintf.LIBCMT ref: 00F0CB92

Part of subcall function 00EC38D8: __woutput_l.LIBCMT ref: 00EC3931

__swprintf.LIBCMT ref: 00F0CBE0

Part of subcall function 00EC38D8: __flsbuf.LIBCMT ref: 00EC3953
Part of subcall function 00EC38D8: __flsbuf.LIBCMT ref: 00EC396B

__swprintf.LIBCMT ref: 00F0CC2F
__swprintf.LIBCMT ref: 00F0CC7E
__swprintf.LIBCMT ref: 00F0CCCD

Strings

%02d, xrefs: 00F0CB86, 00F0CB90, 00F0CBDE, 00F0CC2D, 00F0CC7C, 00F0CCCB
%4d, xrefs: 00F0CB38
%4d%02d%02d%02d%02d%02d, xrefs: 00F0CAF5

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 5957f9f15ab2c61f6c275f00d8cfb6797ec96c68640e7f53b9e02eb9b35df45f
Instruction ID: 668a8e001e7561caf0190984e71eecef7cd5c4df537fbfd81a7c691c117f8c7f
Opcode Fuzzy Hash: 5957f9f15ab2c61f6c275f00d8cfb6797ec96c68640e7f53b9e02eb9b35df45f
Instruction Fuzzy Hash: 5CA14FB2508305ABC710EB64CD85DAFB7ECEF99700F40592DB585D7192EB34EA09CB62

Function 00F0F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00F0F221
_wcscmp.LIBCMT ref: 00F0F236
_wcscmp.LIBCMT ref: 00F0F24D
GetFileAttributesW.KERNEL32(?), ref: 00F0F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00F0F279
FindNextFileW.KERNEL32(00000000,?), ref: 00F0F291
FindClose.KERNEL32(00000000), ref: 00F0F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00F0F2B8
_wcscmp.LIBCMT ref: 00F0F2DF
_wcscmp.LIBCMT ref: 00F0F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00F0F308
SetCurrentDirectoryW.KERNEL32(00F5A5A0), ref: 00F0F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F0F330
FindClose.KERNEL32(00000000), ref: 00F0F33D
FindClose.KERNEL32(00000000), ref: 00F0F34F

Strings

*.*, xrefs: 00F0F2B3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: f706a2859284d8fb80fdfb070b12d86507c3cf7785d13ae6c7bdc2f38a3577ae
Instruction ID: a5695a2d53c0b6860a2391e689e902be5601f7aa5715c8f19596cee7bb4873c1
Opcode Fuzzy Hash: f706a2859284d8fb80fdfb070b12d86507c3cf7785d13ae6c7bdc2f38a3577ae
Instruction Fuzzy Hash: 0631B376900219AADB30DBB4DC48EDE73AC9F49371F144276E904E30D0EB30DA4ABA51

Function 00F20AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F20BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00F2F910,00000000,?,00000000,?,?), ref: 00F20C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00F20C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00F20D1D
RegCloseKey.ADVAPI32(?), ref: 00F2103D
RegCloseKey.ADVAPI32(00000000), ref: 00F2104A

Strings

REG_EXPAND_SZ, xrefs: 00F20CBA
REG_DWORD, xrefs: 00F20F0E
REG_MULTI_SZ, xrefs: 00F20E05
REG_QWORD, xrefs: 00F20F8B
REG_BINARY, xrefs: 00F20FD8
REG_SZ, xrefs: 00F20D5B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 87ed351040d2d9e7a2f0881d1f09c1f0183bb1d91fa70a5d39dede21ba5b14b2
Instruction ID: 6795cac5ef4ed143cafd3eab9fb8bae24462ffe1f0fbb05c8272bfb29ba90b64
Opcode Fuzzy Hash: 87ed351040d2d9e7a2f0881d1f09c1f0183bb1d91fa70a5d39dede21ba5b14b2
Instruction Fuzzy Hash: 9C024A756006119FCB14EF24D881E2AB7E5FF89720F04985DF98AAB362DB30ED45DB81

Function 00F0F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00F0F37E
_wcscmp.LIBCMT ref: 00F0F393
_wcscmp.LIBCMT ref: 00F0F3AA

Part of subcall function 00F045C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F045DC

FindNextFileW.KERNEL32(00000000,?), ref: 00F0F3D9
FindClose.KERNEL32(00000000), ref: 00F0F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00F0F400
_wcscmp.LIBCMT ref: 00F0F427
_wcscmp.LIBCMT ref: 00F0F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00F0F450
SetCurrentDirectoryW.KERNEL32(00F5A5A0), ref: 00F0F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F0F478
FindClose.KERNEL32(00000000), ref: 00F0F485
FindClose.KERNEL32(00000000), ref: 00F0F497

Strings

*.*, xrefs: 00F0F3FB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 424bc8f3fb73c263e0390ce0dc1aba07df4ed4cd015260e801a0ddf35acbb601
Instruction ID: 02af8565ce935c901566b719df1d7a449d6da790602a2c4f61a8746664a916a5
Opcode Fuzzy Hash: 424bc8f3fb73c263e0390ce0dc1aba07df4ed4cd015260e801a0ddf35acbb601
Instruction Fuzzy Hash: 3E31B3769012196ACB30EBA4EC88EDF77AC9F49331F144275EC00A24E0E771DA4AFA51

Function 00EF81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EF8766
Part of subcall function 00EF874A: GetLastError.KERNEL32(?,00EF822A,?,?,?), ref: 00EF8770
Part of subcall function 00EF874A: GetProcessHeap.KERNEL32(00000008,?,?,00EF822A,?,?,?), ref: 00EF877F
Part of subcall function 00EF874A: HeapAlloc.KERNEL32(00000000,?,00EF822A,?,?,?), ref: 00EF8786
Part of subcall function 00EF874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EF879D

Part of subcall function 00EF87E7: GetProcessHeap.KERNEL32(00000008,00EF8240,00000000,00000000,?,00EF8240,?), ref: 00EF87F3
Part of subcall function 00EF87E7: HeapAlloc.KERNEL32(00000000,?,00EF8240,?), ref: 00EF87FA
Part of subcall function 00EF87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00EF8240,?), ref: 00EF880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EF825B
_memset.LIBCMT ref: 00EF8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EF828F
GetLengthSid.ADVAPI32(?), ref: 00EF82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00EF82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EF82F9
GetLengthSid.ADVAPI32(?), ref: 00EF8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00EF8325
HeapAlloc.KERNEL32(00000000), ref: 00EF832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EF834D
CopySid.ADVAPI32(00000000), ref: 00EF8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EF8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EF83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EF83BF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 436f50bce1c7fedb9a5e61e32ae22435c5eea04d15a2a79e64ebad61b8d30094
Instruction ID: 6800ea26289107cda635da3c41ef684ae8599fe7625d5f74df680662eeabe086
Opcode Fuzzy Hash: 436f50bce1c7fedb9a5e61e32ae22435c5eea04d15a2a79e64ebad61b8d30094
Instruction Fuzzy Hash: 8961687190021DEBDF10DFA0DE85EFEBBB9FF04704F049129EA15A62A1DB319A05DB60

Function 00EB6843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON

Download Yara Rule

Strings

LF), xrefs: 00EF16DD
ANY), xrefs: 00EF1717
CR), xrefs: 00EF16C0
UTF), xrefs: 00EF1533
NO_AUTO_POSSESS), xrefs: 00EF1567
LIMIT_MATCH=, xrefs: 00EF15A9
UCP), xrefs: 00EF1546
UTF16), xrefs: 00EF1508
Oa, xrefs: 00EF1888, 00EF192F, 00EF19DD
CRLF), xrefs: 00EF16FA
NO_START_OPT), xrefs: 00EF1588
LIMIT_RECURSION=, xrefs: 00EF1635
ANYCRLF), xrefs: 00EF1734
BSR_UNICODE), xrefs: 00EF1771
BSR_ANYCRLF), xrefs: 00EF1757

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa$UCP)$UTF)$UTF16)
API String ID: 0-3700951917
Opcode ID: 3df60ca9f3f60334cb95cee3ef27ee590e9e3e9289a75ae8a91d0f23c13969bd
Instruction ID: 91f17db3af36de419c74b9e3e65d4c2557b0f9523dd572be40538d261bf9ffa1
Opcode Fuzzy Hash: 3df60ca9f3f60334cb95cee3ef27ee590e9e3e9289a75ae8a91d0f23c13969bd
Instruction Fuzzy Hash: 69726B75E00219DBDB24DF58C8807FEB7B5EF48314F1491AAE949FB290EB749981CB90

Function 00F20665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F20038,?,?), ref: 00F210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F20737

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F207D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F2086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00F20AAD
RegCloseKey.ADVAPI32(00000000), ref: 00F20ABA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 369f880047c36889236f34a5587a8fbec126fb91550d8d943acd4ff72cca664d
Instruction ID: 0cf313c4d2da4a04e6dd9f02dba3c2a1c8926fe9f6601583fafb850bba4630ae
Opcode Fuzzy Hash: 369f880047c36889236f34a5587a8fbec126fb91550d8d943acd4ff72cca664d
Instruction Fuzzy Hash: 1DE14C32604314AFCB14DF28D895E6BBBF4EF89714B04896DF84ADB262DA30ED05DB51

Function 00F00219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F00241
GetAsyncKeyState.USER32(000000A0), ref: 00F002C2
GetKeyState.USER32(000000A0), ref: 00F002DD
GetAsyncKeyState.USER32(000000A1), ref: 00F002F7
GetKeyState.USER32(000000A1), ref: 00F0030C
GetAsyncKeyState.USER32(00000011), ref: 00F00324
GetKeyState.USER32(00000011), ref: 00F00336
GetAsyncKeyState.USER32(00000012), ref: 00F0034E
GetKeyState.USER32(00000012), ref: 00F00360
GetAsyncKeyState.USER32(0000005B), ref: 00F00378
GetKeyState.USER32(0000005B), ref: 00F0038A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1204f5aaa5852360f18b70751c68962aa1cdd008743c04c36673b5a2c7caddfd
Instruction ID: fe31ce063c2d781800507e667db69130eba4fa0351cbece5c19956c9cdea0a7b
Opcode Fuzzy Hash: 1204f5aaa5852360f18b70751c68962aa1cdd008743c04c36673b5a2c7caddfd
Instruction Fuzzy Hash: 03419C34D047C96EFF325A6488097B5FFA0AF12364F08416DD5C5561C2DF9459C8B792

Function 00F186D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

CoInitialize.OLE32 ref: 00F18718
CoUninitialize.OLE32 ref: 00F18723
CoCreateInstance.OLE32(?,00000000,00000017,00F32BEC,?), ref: 00F18783
IIDFromString.OLE32(?,?), ref: 00F187F6
VariantInit.OLEAUT32(?), ref: 00F18890
VariantClear.OLEAUT32(?), ref: 00F188F1

Strings

Invalid parameter, xrefs: 00F1880F
Failed to create object, xrefs: 00F1878E, 00F18844
NULL Pointer assignment, xrefs: 00F187C8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 96d7b44319b73d2023bb97294e2c3853444523c164cdb3195adca4fb7d2f7840
Instruction ID: aaf7a66242a7e10c1d916ef2848d934a1b3daa65a12385c2e342dda087945d82
Opcode Fuzzy Hash: 96d7b44319b73d2023bb97294e2c3853444523c164cdb3195adca4fb7d2f7840
Instruction Fuzzy Hash: 9361C2716083019FD710DF24CA48B9FBBE4AF49764F10491DF9859B291CB70ED8AEB92

Function 00F14458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F1447F
EmptyClipboard.USER32 ref: 00F14485
GlobalAlloc.KERNEL32(00000002,?), ref: 00F1449A
CloseClipboard.USER32 ref: 00F14539

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 611f15b33910f414193fe7d1cec9fdf0e22a37f401e58a6441df9f81662221bd
Instruction ID: 2ad5790aaa4e709689f017f268e99f9a318de66febce78136f494ff8c58957a9
Opcode Fuzzy Hash: 611f15b33910f414193fe7d1cec9fdf0e22a37f401e58a6441df9f81662221bd
Instruction Fuzzy Hash: F5219F353116149FDB20AF60EC09B697BB8EF48720F14802AF946EB2B1DB74BC01EB54

Function 00F03A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EA48A1,?,?,00EA37C0,?), ref: 00EA48CE

Part of subcall function 00F04CD3: GetFileAttributesW.KERNEL32(?,00F03947), ref: 00F04CD4

FindFirstFileW.KERNEL32(?,?), ref: 00F03ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00F03B87
MoveFileW.KERNEL32(?,?), ref: 00F03B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00F03BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F03BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00F03BF5

Strings

\*.*, xrefs: 00F03A8A, 00F03A93, 00F03AA8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: f936ca80478ac1c4a5e7a8790026a891c8d2cb528ad65138fc0a14f65fd9e651
Instruction ID: aa3fd3aca6e09fa45b2c1790368193e658aa729b63c2f557e294c55be0a7ca4c
Opcode Fuzzy Hash: f936ca80478ac1c4a5e7a8790026a891c8d2cb528ad65138fc0a14f65fd9e651
Instruction Fuzzy Hash: B251807190114C9ACF15EBA0CE929EDB7B8AF59304F6441A9E4467B0D1EF306F0DEB60

Function 00EB4140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00EB421F
VUUU, xrefs: 00EB44DB
VUUU, xrefs: 00EB44ED
Oa, xrefs: 00EB4984, 00EE8173
VUUU, xrefs: 00EE7B0C
VUUU, xrefs: 00EB4520

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID: ERCP$Oa$VUUU$VUUU$VUUU$VUUU
API String ID: 0-3486589167
Opcode ID: fd613ef82547d9f5e63ecd5995acde6993b60d1a0cf0453d96d021a90427288f
Instruction ID: c2e2846654e9bb84c708c9158c8e46aa8faf7b89e989b704022d0629ccec9169
Opcode Fuzzy Hash: fd613ef82547d9f5e63ecd5995acde6993b60d1a0cf0453d96d021a90427288f
Instruction Fuzzy Hash: 81A28EB0E0426ACBDF24CF59C9807EEB7B1FB55318F14A1AAD859B7285D7309E81DB40

Function 00F0F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00F0F6AB
Sleep.KERNEL32(0000000A), ref: 00F0F6DB
_wcscmp.LIBCMT ref: 00F0F6EF
_wcscmp.LIBCMT ref: 00F0F70A
FindNextFileW.KERNEL32(?,?), ref: 00F0F7A8
FindClose.KERNEL32(00000000), ref: 00F0F7BE

Strings

*.*, xrefs: 00F0F690

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: cf39dd8edc56766761574a57629b3ca9864215b7c3404638f5d14586daa7eef0
Instruction ID: ad0c584b472510ae2e326015950e0da4cf82b260ed682b5e21ea6437a4475465
Opcode Fuzzy Hash: cf39dd8edc56766761574a57629b3ca9864215b7c3404638f5d14586daa7eef0
Instruction Fuzzy Hash: ED41907190020A9FCF21DF64CC45AEEBBB4FF09310F14456AE815A71D0EB31AE49EB91

Function 00EB58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EB5A05
_memmove.LIBCMT ref: 00EB5A55
_memmove.LIBCMT ref: 00EB5ABB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4f8aa2484826dfdc2f133aa82bad4b84ee9966ed3911420370914725e3756f69
Instruction ID: 34727a8d72ef710229c4114a4091ae8a1416ef513c4146f174faf3d881235cd7
Opcode Fuzzy Hash: 4f8aa2484826dfdc2f133aa82bad4b84ee9966ed3911420370914725e3756f69
Instruction Fuzzy Hash: 97127971A00609DBDF14DFA4DA81AEEB7F5FF48300F109669E846B7291EB36AD11CB50

Function 00EB5680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00EC0FF6: std::exception::exception.LIBCMT ref: 00EC102C
Part of subcall function 00EC0FF6: __CxxThrowException@8.LIBCMT ref: 00EC1041

_memmove.LIBCMT ref: 00EF062F
_memmove.LIBCMT ref: 00EF0744
_memmove.LIBCMT ref: 00EF07EB

Strings

yZ, xrefs: 00EF0881, 00EF07FF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ
API String ID: 1300846289-3798167742
Opcode ID: 1bbe9495ca7e28180c59b52037f500c9a3296689f084faaa8d74c48f181c89b4
Instruction ID: 336b2ff889d19b2d16924d5c09fde9145a49f30f20b0ca6b7f6c7f63608a9638
Opcode Fuzzy Hash: 1bbe9495ca7e28180c59b52037f500c9a3296689f084faaa8d74c48f181c89b4
Instruction Fuzzy Hash: D40281B1E00209DBDF14DF64D981ABEBBF5EF44300F1490A9E906EB295EB31DA51CB91

Function 00F0545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EF8D0D
Part of subcall function 00EF8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EF8D3A
Part of subcall function 00EF8CC3: GetLastError.KERNEL32 ref: 00EF8D47

ExitWindowsEx.USER32(?,00000000), ref: 00F0549B

Strings

@, xrefs: 00F0548E
SeShutdownPrivilege, xrefs: 00F0546B
, xrefs: 00F05489

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: ae643e862e29e7c2c7ec610271d47c19ade8810fabba1f91155400f67d07b0e7
Instruction ID: ec12239830937c6224fabd4eadb1946e9462edf767ba8eb6401a287cb2ad9202
Opcode Fuzzy Hash: ae643e862e29e7c2c7ec610271d47c19ade8810fabba1f91155400f67d07b0e7
Instruction Fuzzy Hash: AE014C79A64A055AE738D674DC6BFFB7258EB05B63F240531FD06D20D2D6D40C8079A0

Function 00EB3190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa, xrefs: 00EB3482

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa
API String ID: 674341424-3945284152
Opcode ID: 431bf82f9555440b21f5bb382c087aa6de3c42abfa076477b6414634659b3c9f
Instruction ID: b7a3dbd89a999e22e3574e4fc4d4e4da29554c3ba0547e1671de37f6b4a1a8b7
Opcode Fuzzy Hash: 431bf82f9555440b21f5bb382c087aa6de3c42abfa076477b6414634659b3c9f
Instruction Fuzzy Hash: B4229F716083419FC724DF24C882BAFB7E5AF89704F10591DF596AB292DB71EE04CB92

Function 00F16596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F165EF
WSAGetLastError.WSOCK32(00000000), ref: 00F165FE
bind.WSOCK32(00000000,?,00000010), ref: 00F1661A
listen.WSOCK32(00000000,00000005), ref: 00F16629
WSAGetLastError.WSOCK32(00000000), ref: 00F16643
closesocket.WSOCK32(00000000,00000000), ref: 00F16657

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 98adcfcecdcc7d275e3eafec10b9b5fb98b5b2b3e2d63ac762f0efb283339edb
Instruction ID: 725790a6ddac4f39ba8863262c03e02f15f8ede6b037b87bea2a68a95025a655
Opcode Fuzzy Hash: 98adcfcecdcc7d275e3eafec10b9b5fb98b5b2b3e2d63ac762f0efb283339edb
Instruction Fuzzy Hash: C821A0316006049FCB10EF24C945BAEB7F9EF49720F148169E956EB3E2CB70AD46EB51

Function 00EA1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00EA19FA
GetSysColor.USER32(0000000F), ref: 00EA1A4E
SetBkColor.GDI32(?,00000000), ref: 00EA1A61

Part of subcall function 00EA1290: DefDlgProcW.USER32(?,00000020,?), ref: 00EA12D8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 66812af8427bc2fc929e743f82b74636936d64ece2b2a34c3a2e9d8e876baf2b
Instruction ID: 6cc77d267212b9242d5f3cfd470b89804a0ebd1302b073180dadd86af9a7e4b0
Opcode Fuzzy Hash: 66812af8427bc2fc929e743f82b74636936d64ece2b2a34c3a2e9d8e876baf2b
Instruction Fuzzy Hash: A2A14771115598FAD628AB285C44DFF359CEB8F349F16215EF402FE292DE14BD02E2B2

Function 00F16A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F180A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F180CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F16AB1
WSAGetLastError.WSOCK32(00000000), ref: 00F16ADA
bind.WSOCK32(00000000,?,00000010), ref: 00F16B13
WSAGetLastError.WSOCK32(00000000), ref: 00F16B20
closesocket.WSOCK32(00000000,00000000), ref: 00F16B34

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 6413f8e7a5f992123f83b7af8afac9cdde422eab195030ec527fb5971bedefbf
Instruction ID: 87a348e7204fbc196cf476dad3fa9524f416f656dccdda053773664fde5d686d
Opcode Fuzzy Hash: 6413f8e7a5f992123f83b7af8afac9cdde422eab195030ec527fb5971bedefbf
Instruction Fuzzy Hash: B941B175B00614AFEB10AF249C86F6EB7E89B49720F048059F91ABB2D3DA70AD019791

Function 00F255FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00F2564C
IsWindowEnabled.USER32 ref: 00F2565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00F25667
IsIconic.USER32 ref: 00F25675
IsZoomed.USER32 ref: 00F25683

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2751ec6b23fd2ea33f0203cb419bfe2a39d23cd4c125bbe0179117d8ae08c99d
Instruction ID: f3dad7453662e234599b4e4375e1d285b7ca0d8c42e7e8319f955b2416c20f5b
Opcode Fuzzy Hash: 2751ec6b23fd2ea33f0203cb419bfe2a39d23cd4c125bbe0179117d8ae08c99d
Instruction Fuzzy Hash: AE11C4327009246FE7211F26EC44B2F7FA9EF89B21B444039F806D7251CB30E9029AA5

Function 00F1C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EE1D88,?), ref: 00F1C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F1C324

Strings

GetSystemWow64DirectoryW, xrefs: 00F1C31E
kernel32.dll, xrefs: 00F1C30D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 1ac9664de43b2225cd999ea9c20d1049042ee394fd0b0145dc2b001c77cd5608
Instruction ID: a9a1989ade532e73e00ac66b0696254493b2d88a498579ed46bf6b047885f8b0
Opcode Fuzzy Hash: 1ac9664de43b2225cd999ea9c20d1049042ee394fd0b0145dc2b001c77cd5608
Instruction Fuzzy Hash: 29E01274E50713CFDB304F25D809A8676E4EF48769F80C43EE8A5D6250E770D896EBA1

Function 00F1F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F1F151
Process32FirstW.KERNEL32(00000000,?), ref: 00F1F15F

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Process32NextW.KERNEL32(00000000,?), ref: 00F1F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00F1F22E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 8d0ea7cef322974b87db1979077ca5420fba6a2532f31bd91f67ce865064bba4
Instruction ID: 9f7dff59fda69282726fe72ef5c6be0447f4e8a4c892a343dff57097b2efc510
Opcode Fuzzy Hash: 8d0ea7cef322974b87db1979077ca5420fba6a2532f31bd91f67ce865064bba4
Instruction Fuzzy Hash: A0517271504301AFD310EF24DC85EABB7E8FF99710F50592DF595A72A2EB70A908CB92

Function 00F040B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F040D1
_memset.LIBCMT ref: 00F040F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00F04144
CloseHandle.KERNEL32(00000000), ref: 00F0414D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 23f3bc09207f119b60d7d52d8808de4c1b2687ff13d0362158373bb3ec384028
Instruction ID: 78fc9403b9a1dede04b785bf7ff1434e2c1fd79721d5399dd7cf1de7fb5d2e0a
Opcode Fuzzy Hash: 23f3bc09207f119b60d7d52d8808de4c1b2687ff13d0362158373bb3ec384028
Instruction Fuzzy Hash: 6411EB75D0122C7AD7309BA59C4DFABBB7CEF44760F1041AAF908E71C0D6744E849BA4

Function 00EFEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00EFEB19

Strings

(, xrefs: 00EFEB5F
|, xrefs: 00EFEB49

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8a13f3f1379bf906877e44d14dfcff02a9c1bde0c41517d61e8dcb8284c91c82
Instruction ID: df0b401faa0fec8ce01b7078186f58da90684c0f695c17dc415a47fb9d707c78
Opcode Fuzzy Hash: 8a13f3f1379bf906877e44d14dfcff02a9c1bde0c41517d61e8dcb8284c91c82
Instruction Fuzzy Hash: 5D322575A007059FD728CF19C481A6AB7F1FF48310B15D56EE99AEB3A1EB70E941CB40

Function 00F125E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00F126D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F1270C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 9b18522689803f946c6377cffd62bd620b5e07bbcd8b9098cc2754d85d4dde65
Instruction ID: fb50170de89fa57d1d24bdfeccd87b3bab266d7a4b93961d0e47464826c22653
Opcode Fuzzy Hash: 9b18522689803f946c6377cffd62bd620b5e07bbcd8b9098cc2754d85d4dde65
Instruction Fuzzy Hash: 2441B372900209BFEB64DAD4DD85FFBB7FCEB40724F10406EFA01A6180EA719E91B654

Function 00F0B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F0B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F0B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00F0B655

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 72d424199ce6db0559e6dd5503a5871a4548b4aeefbaea20856e83c290f02275
Instruction ID: 450ba02f119bc78cae3e7687583ffab1961bc08ab56a48adaf27dd52acba0a58
Opcode Fuzzy Hash: 72d424199ce6db0559e6dd5503a5871a4548b4aeefbaea20856e83c290f02275
Instruction Fuzzy Hash: 44217135A10518EFCB00EF65D881EADBBF8FF49310F1480AAE905AB361DB31A916DB51

Function 00EF8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00EC0FF6: std::exception::exception.LIBCMT ref: 00EC102C
Part of subcall function 00EC0FF6: __CxxThrowException@8.LIBCMT ref: 00EC1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EF8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EF8D3A
GetLastError.KERNEL32 ref: 00EF8D47

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: af616493144a6df316f7afe6eb70d627a585736febe38f555a957d5894209c90
Instruction ID: 3cb28f2500fa39c455acbf00aa7e06ca9947c041002a31cde8441ea1ee04c5f8
Opcode Fuzzy Hash: af616493144a6df316f7afe6eb70d627a585736febe38f555a957d5894209c90
Instruction Fuzzy Hash: 60118FB1514209AFD728DF54DD85D7BB7FCEF44710B20852EF456A3241EB31AC418B60

Function 00F04C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F04C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F04C43
FreeSid.ADVAPI32(?), ref: 00F04C53

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6a4742a5f30a682ea380a1aa1eb25d50a7f2e11cd4a84e7214c73e63a3571394
Instruction ID: ce208c61619d45f32ead1454a121373eadcd324b044120d9a4088e9e09af818f
Opcode Fuzzy Hash: 6a4742a5f30a682ea380a1aa1eb25d50a7f2e11cd4a84e7214c73e63a3571394
Instruction Fuzzy Hash: 01F03775A1130CBBDF04DFE09D89AAEBBB8EB08311F0044A9AA01E2181E6706A489B50

Function 00EAE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcfd33ba6c20fd6d6e39e51ee5943451db4819e6f093d9127b80eb45cb54bc7
Instruction ID: 46bd08e6429cc92f7f919555b800dcb61e353955d294f428c803dbc9cc9364e1
Opcode Fuzzy Hash: edcfd33ba6c20fd6d6e39e51ee5943451db4819e6f093d9127b80eb45cb54bc7
Instruction Fuzzy Hash: 86229A70A0021ACFDB24DF64C494AAEBBF4FF0A304F149069E856BF351E735A985CB91

Function 00F0C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F0C966
FindClose.KERNEL32(00000000), ref: 00F0C996

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 37f3685584acecefa83d2dcab12c8a897a9a484abda2f8541ebc72a6d8ae18fd
Instruction ID: 5fcd420117b395e816d72b00b5d3de40ff2c9c3bb573cb7a5a5595d6a74666bc
Opcode Fuzzy Hash: 37f3685584acecefa83d2dcab12c8a897a9a484abda2f8541ebc72a6d8ae18fd
Instruction Fuzzy Hash: 081188726106049FD710DF29D845A2AF7E5FF89324F00851EF9A5DB2A1DB30BC05DB81

Function 00F0A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00F1977D,?,00F2FB84,?), ref: 00F0A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00F1977D,?,00F2FB84,?), ref: 00F0A314

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: cdd480ced233aba1237e37b4b20240022fea3fe3cfe6c44bc5051ccfa3a57bb6
Instruction ID: 00bd1ecb1237156defa3f4af0e6b835ad1e7631a1417478a75e928b0acfdccbb
Opcode Fuzzy Hash: cdd480ced233aba1237e37b4b20240022fea3fe3cfe6c44bc5051ccfa3a57bb6
Instruction Fuzzy Hash: 21F0E23555432DFBDB209FA4CC48FEA736CFF09761F004166B808D6180D6309944DBA1

Function 00EF8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EF8851), ref: 00EF8728
CloseHandle.KERNEL32(?,?,00EF8851), ref: 00EF873A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 9d7bf71108f95f0288ef7aedf91a70d8f0197822a92803f0e3572b8a2b39c323
Instruction ID: fcf039c0f9b0de9e8f89bed66b04947963be05f2e5e86291b07fbe0e9c90bc67
Opcode Fuzzy Hash: 9d7bf71108f95f0288ef7aedf91a70d8f0197822a92803f0e3572b8a2b39c323
Instruction Fuzzy Hash: A3E0B676010610EFE7352B60ED09E777BE9EB04794724887DB99690471DB62AC92EB10

Function 00ECA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00EC8F97,?,?,?,00000001), ref: 00ECA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00ECA3A3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d898276d7246eb273f654ac0add4876aea80c387b3f1a77fcd27d6d073a0642
Instruction ID: 074aea43a366ff48fecefa8b878110923fd167b6337de94bd2c4712d037d9c79
Opcode Fuzzy Hash: 0d898276d7246eb273f654ac0add4876aea80c387b3f1a77fcd27d6d073a0642
Instruction Fuzzy Hash: 51B0923106420CEBCA106B91EC09B883F78EB44AA2F404030F60D84060CB625856AA91

Function 00ECF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b315eacc0268aa20e3b50a5872032d12b83c6cf51d31488e15e775daac0166a
Instruction ID: 7175e3101bf27a85e1fe02b2ee897ac3b73db0b4392b93685247f6a7bf55d7fd
Opcode Fuzzy Hash: 7b315eacc0268aa20e3b50a5872032d12b83c6cf51d31488e15e775daac0166a
Instruction Fuzzy Hash: E2323761D29F094DD7236634D932336A25AAFB73D4F14E73BF819B59AAEB39C4831100

Function 00ED267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a930412abc3a130fdbe209bc4e23cdaaf5ebcfaacc1f8ab4594ddca1dc4984b
Instruction ID: ff882aa24ce1381af72d0d1c04d0f4ddae2b39acc100f270c1b80b345c6677fb
Opcode Fuzzy Hash: 0a930412abc3a130fdbe209bc4e23cdaaf5ebcfaacc1f8ab4594ddca1dc4984b
Instruction Fuzzy Hash: 2CB10120D2AF454DD323963AC831336B64DAFBB2E5F51D71BFC6674E22EB2285835141

Function 00F08B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F08B25

Part of subcall function 00EC543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00F091F8,00000000,?,?,?,?,00F093A9,00000000,?), ref: 00EC5443
Part of subcall function 00EC543A: __aulldiv.LIBCMT ref: 00EC5463

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 98c3fe59a6b979b686c3783e07015da4e3317a699f31367f0b879c2046535e23
Instruction ID: 333b3345659ae851b0789defd3ed60de0d5d4e71f5e0ef0000602ab683305d02
Opcode Fuzzy Hash: 98c3fe59a6b979b686c3783e07015da4e3317a699f31367f0b879c2046535e23
Instruction Fuzzy Hash: 5F21B4726356108BC729CF25D841A52B3E1EBA5321B288E6CD0F6CB2D0CA75BD45EB94

Function 00F141FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00F14218

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 18411e3b289ed89d93106d5c12e9f64e33f5c3334d940a64a2bf6d10a7083de3
Instruction ID: 090e7fc95271028a471215c21f74c3ce30104bd5d1b16f726848c6580cd6d0aa
Opcode Fuzzy Hash: 18411e3b289ed89d93106d5c12e9f64e33f5c3334d940a64a2bf6d10a7083de3
Instruction Fuzzy Hash: D6E048312501145FC710DF59D444A9AF7E8EF99760F008026FC49DB352DA70F8819B90

Function 00F04EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00F04F18

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 7ce74bf75cbd1f64b160c67688a14be13c4fdf49d14231af7d77f9c0a72e09ac
Instruction ID: 99e34c459d5b06f584eaad2ca9768917ee2cc7283fbb4e4ebef398fa023915d5
Opcode Fuzzy Hash: 7ce74bf75cbd1f64b160c67688a14be13c4fdf49d14231af7d77f9c0a72e09ac
Instruction Fuzzy Hash: 5CD05EF156420B38FC284B20AC0FF761108E3407A3F8449897301C74D199E57890B434

Function 00EF8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00EF88D1), ref: 00EF8CB3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 8d4491484d67813072e1f53d1686593edf77d5ca8ab0ede16ce2d4f9b61168ab
Instruction ID: 3a725ad8acb63045297e14784ada13cace4c3dfbd5f233bc84e45f0893d42d37
Opcode Fuzzy Hash: 8d4491484d67813072e1f53d1686593edf77d5ca8ab0ede16ce2d4f9b61168ab
Instruction Fuzzy Hash: 91D05E3226050EABEF018EA4DD01EAE3B69EB04B01F408121FE15D50A1C775D835AB60

Function 00EE2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00EE2242

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ce8e569c5b6f704121227dcdfe7b3a44a7a15da87d2fa72cb792c51009ca1cb5
Instruction ID: 904a131bc782f6dce28577394c064f5f7cd82ce9f069ed533024a979f0c85774
Opcode Fuzzy Hash: ce8e569c5b6f704121227dcdfe7b3a44a7a15da87d2fa72cb792c51009ca1cb5
Instruction Fuzzy Hash: E7C048F181010DDBEB15DBA0DA88DEFB7BCAB08304F2040A6A102F2100E7749B889A72

Function 00ECA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00ECA36A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 78c5af4211b9017ad38465b9a9d2a26f350227148a8eff80e10e7b55521e4ea8
Instruction ID: 2bee322eb49ac5ad72da68e7ce693dc0b6eb3b3aa8ffb089904827a11343b64b
Opcode Fuzzy Hash: 78c5af4211b9017ad38465b9a9d2a26f350227148a8eff80e10e7b55521e4ea8
Instruction Fuzzy Hash: 7FA0113002020CEB8A002B82EC08888BFACEA002A0B008030F80C800228B32A822AA80

Function 00EB8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c2320287a8a84c1ae7f96ec7ba01d88daef163f26f64ccc2954a34dd7cfcd5
Instruction ID: f7235680bd07552b89956c1aea68ea0173b7a8a4b41d8210bb13a191aefc68c0
Opcode Fuzzy Hash: b8c2320287a8a84c1ae7f96ec7ba01d88daef163f26f64ccc2954a34dd7cfcd5
Instruction Fuzzy Hash: 4F224A71501619DBCF289F28C5D46FEBBA5EB11308F28642AD652BB391DB30DD81CFA1

Function 00EC2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 171959cfafa903aae3ac09bc8b554ba3c99a5c34477ad91b992d0b325b4f98b9
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 9BC1D8322050930ADF2D4639D630A3EBAE15EA37B531A279DE4B3EB4C5EF11D536D620

Function 00EC283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 18ffad2ee330d9aee1ed781aa1b3a50c24145d2142b707dfd12b71d6afa5a37b
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 8BC1D73220519309DF2D4639C630A3EBBE15E937B531A27ADE4B2EB0C5EF21D535D620

Function 00EC1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: ccb63dfc9b527ed8b468e9ffec21fac351a884f995b30829e5f677fba8499dd1
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E4C1D33230519309DF2D46398630A3EBAE05EA37B531A27DDE4B3EB1C6EF21D5369610

Function 00F17B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F17B70
DeleteObject.GDI32(00000000), ref: 00F17B82
DestroyWindow.USER32 ref: 00F17B90
GetDesktopWindow.USER32 ref: 00F17BAA
GetWindowRect.USER32(00000000), ref: 00F17BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00F17CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00F17D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17D4A
GetClientRect.USER32(00000000,?), ref: 00F17D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F17D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17DF8
GlobalFree.KERNEL32(00000000), ref: 00F17E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00F32CAC,00000000), ref: 00F17E2B
GlobalFree.KERNEL32(00000000), ref: 00F17E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00F17E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00F17E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F17EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F1808F

Strings

, xrefs: 00F18015
static, xrefs: 00F17D8A, 00F17EE1
AutoIt v3, xrefs: 00F17D42
DISPLAY, xrefs: 00F17EF2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 702919abab56577819e72541c6600b1222d6eea6c4bedc34617230ba8dd05aee
Instruction ID: 34016991cf8fa6dfe0d0c20fdba382c8d46a516ca328a009383702393677ed23
Opcode Fuzzy Hash: 702919abab56577819e72541c6600b1222d6eea6c4bedc34617230ba8dd05aee
Instruction Fuzzy Hash: 57028E71910219EFDF14DF64CD89EAE7BB9FB49310F108168F919AB2A1CB70AD41DB60

Function 00F237F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00F2F910), ref: 00F238AF
IsWindowVisible.USER32(?), ref: 00F238D3

Strings

SHOWDROPDOWN, xrefs: 00F23968
GETSELECTED, xrefs: 00F23B2B
TABRIGHT, xrefs: 00F23925
SETCURRENTSELECTION, xrefs: 00F23A3E
HIDEDROPDOWN, xrefs: 00F23988
SENDCOMMANDID, xrefs: 00F23C62
EDITPASTE, xrefs: 00F23BE7
FINDSTRING, xrefs: 00F239FE
GETCURRENTSELECTION, xrefs: 00F23A6B
ISENABLED, xrefs: 00F238F3
GETCURRENTLINE, xrefs: 00F23B75
TABLEFT, xrefs: 00F2390F
SELECTSTRING, xrefs: 00F23A8E
GETLINECOUNT, xrefs: 00F23B4E
ISVISIBLE, xrefs: 00F238BF
DELSTRING, xrefs: 00F239D1
ISCHECKED, xrefs: 00F23AC1
GETLINE, xrefs: 00F23C23
GETCURRENTCOL, xrefs: 00F23BB0
ADDSTRING, xrefs: 00F2399E
UNCHECK, xrefs: 00F23B0B
CHECK, xrefs: 00F23AF5
CURRENTTAB, xrefs: 00F23945

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 6cb90adb20033992846170187c7a75ac5cd407c559ca384b7b545f34fc805846
Instruction ID: f871455620d24fc36e7c83379075327e7e181ad004c4026701031f2ee0e03adc
Opcode Fuzzy Hash: 6cb90adb20033992846170187c7a75ac5cd407c559ca384b7b545f34fc805846
Instruction Fuzzy Hash: E0D19E70204219DBCB14EF10D551B6ABBE2AF95354F01546CF8866B2A3CB39EE4BEB41

Function 00F2A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00F2A89F
GetSysColorBrush.USER32(0000000F), ref: 00F2A8D0
GetSysColor.USER32(0000000F), ref: 00F2A8DC
SetBkColor.GDI32(?,000000FF), ref: 00F2A8F6
SelectObject.GDI32(?,?), ref: 00F2A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00F2A930
GetSysColor.USER32(00000010), ref: 00F2A938
CreateSolidBrush.GDI32(00000000), ref: 00F2A93F
FrameRect.USER32(?,?,00000000), ref: 00F2A94E
DeleteObject.GDI32(00000000), ref: 00F2A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00F2A9A0
FillRect.USER32(?,?,?), ref: 00F2A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00F2A9FD

Part of subcall function 00F2AB60: GetSysColor.USER32(00000012), ref: 00F2AB99
Part of subcall function 00F2AB60: SetTextColor.GDI32(?,?), ref: 00F2AB9D
Part of subcall function 00F2AB60: GetSysColorBrush.USER32(0000000F), ref: 00F2ABB3
Part of subcall function 00F2AB60: GetSysColor.USER32(0000000F), ref: 00F2ABBE
Part of subcall function 00F2AB60: GetSysColor.USER32(00000011), ref: 00F2ABDB
Part of subcall function 00F2AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F2ABE9
Part of subcall function 00F2AB60: SelectObject.GDI32(?,00000000), ref: 00F2ABFA
Part of subcall function 00F2AB60: SetBkColor.GDI32(?,00000000), ref: 00F2AC03
Part of subcall function 00F2AB60: SelectObject.GDI32(?,?), ref: 00F2AC10
Part of subcall function 00F2AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00F2AC2F
Part of subcall function 00F2AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F2AC46
Part of subcall function 00F2AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00F2AC5B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: d915dee0f2be082e04992328ab11127125bd434397936213341caf5b27c65c82
Instruction ID: 7f3d9c0c5ea4749c36d460dea7a575ff74372318cefee91714b13073d8685af4
Opcode Fuzzy Hash: d915dee0f2be082e04992328ab11127125bd434397936213341caf5b27c65c82
Instruction Fuzzy Hash: 7DA19D72418315EFD7209F64DC08E6B7BB9FF88321F140A29F962D61A1D734D84AEB52

Function 00EA2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00EA2CA2
DeleteObject.GDI32(00000000), ref: 00EA2CE8
DeleteObject.GDI32(00000000), ref: 00EA2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00EA2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00EA2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00EDC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00EDC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00EDCAED

Part of subcall function 00EA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EA2036,?,00000000,?,?,?,?,00EA16CB,00000000,?), ref: 00EA1B9A

SendMessageW.USER32(?,00001053), ref: 00EDCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00EDCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00EDCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00EDCB62

Strings

0, xrefs: 00EDC981

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: cbacc463e87b58e6a37d4e0bf92b8de3d81a21e713edc0783d2c6592a4895acc
Instruction ID: e815ad06befbaf9783214c2215c682dae0896218be274bcb555489e70a0bf28e
Opcode Fuzzy Hash: cbacc463e87b58e6a37d4e0bf92b8de3d81a21e713edc0783d2c6592a4895acc
Instruction Fuzzy Hash: 5F129E30600202EFDB24CF28C884BA9BBE5FF49354F64656EE595FB262C731E842DB51

Function 00F177BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F177F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F178B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00F178EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00F17900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00F17946
GetClientRect.USER32(00000000,?), ref: 00F17952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00F17996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F179A5
GetStockObject.GDI32(00000011), ref: 00F179B5
SelectObject.GDI32(00000000,00000000), ref: 00F179B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00F179C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F179D2
DeleteDC.GDI32(00000000), ref: 00F179DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F17A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F17A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00F17A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F17A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F17A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00F17AAE
GetStockObject.GDI32(00000011), ref: 00F17AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F17AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00F17ACE

Strings

static, xrefs: 00F17990, 00F17AA8
AutoIt v3, xrefs: 00F1793E
msctls_progress32, xrefs: 00F17A4F
DISPLAY, xrefs: 00F1799B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: d25a8ff622b751b447f3da5b62e5a81758fe3fb914de388c4a06113edbf06642
Instruction ID: 81d3cfdd93645e46ddd7022c646e8fe3a6e9fd20822dd0df4411d769b4c68993
Opcode Fuzzy Hash: d25a8ff622b751b447f3da5b62e5a81758fe3fb914de388c4a06113edbf06642
Instruction Fuzzy Hash: E0A18171A50219BFEB14DBA4DC4AFAE7BB9EB48710F104224FA14E71E1C7B0AD05DB60

Function 00F0AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F0AF89
GetDriveTypeW.KERNEL32(?,00F2FAC0,?,\\.\,00F2F910), ref: 00F0B066
SetErrorMode.KERNEL32(00000000,00F2FAC0,?,\\.\,00F2F910), ref: 00F0B1C4

Strings

\\.\, xrefs: 00F0AFDB
1394, xrefs: 00F0B146
Removable, xrefs: 00F0B0B8
Virtual, xrefs: 00F0B18C
PhysicalDrive, xrefs: 00F0B012
SATA, xrefs: 00F0B177
Unknown, xrefs: 00F0B086, 00F0B12A
MMC, xrefs: 00F0B185
Fibre, xrefs: 00F0B154
Network, xrefs: 00F0B0A4
FileBackedVirtual, xrefs: 00F0B193
SSA, xrefs: 00F0B14D
USB, xrefs: 00F0B15B
SSD, xrefs: 00F0B0F1
CDROM, xrefs: 00F0B09A
RAMDisk, xrefs: 00F0B090
RAID, xrefs: 00F0B162
ATAPI, xrefs: 00F0B138
SAS, xrefs: 00F0B170
SCSI, xrefs: 00F0B131
Fixed, xrefs: 00F0B0AE
iSCSI, xrefs: 00F0B169
ATA, xrefs: 00F0B13F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 1818e6eb55e061a1a3f8cbc3cc30d7b9e951e4c44b4cd7ad470cfcc1fa5a8eda
Instruction ID: 3fcaf234083d3068e5dc8fcaf5a69bbf51735181436d399747e1496d48a207db
Opcode Fuzzy Hash: 1818e6eb55e061a1a3f8cbc3cc30d7b9e951e4c44b4cd7ad470cfcc1fa5a8eda
Instruction Fuzzy Hash: 6F51B331A84306EBCB00DB10DD62A7D77B0AB1A3567204116ED0ABB2D1D735ED55FB43

Function 00EA6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00EA6A91
__wcsnicmp.LIBCMT ref: 00EA6AA9
__wcsnicmp.LIBCMT ref: 00EA6AC1
__wcsnicmp.LIBCMT ref: 00EA6AD9
__wcsnicmp.LIBCMT ref: 00EA6AF1
__wcsnicmp.LIBCMT ref: 00EA6B09
__wcsnicmp.LIBCMT ref: 00EA6B21
__wcsnicmp.LIBCMT ref: 00EA6B35
__wcsnicmp.LIBCMT ref: 00EA6B76
__wcsnicmp.LIBCMT ref: 00EA6B8A
__wcsnicmp.LIBCMT ref: 00EA6B9E
__wcsnicmp.LIBCMT ref: 00EA6BB2

Strings

#comments-start, xrefs: 00EA6B1B, 00EA6B70
#ce, xrefs: 00EA6BAC
#pragma compile, xrefs: 00EA6A8B
#OnAutoItStartRegister, xrefs: 00EA6AD3
Bad directive syntax error, xrefs: 00EDE743
Unterminated group of comments, xrefs: 00EDE82C
#notrayicon, xrefs: 00EA6AA3
#cs, xrefs: 00EA6B2F, 00EA6B84
#comments-end, xrefs: 00EA6B98
#include, xrefs: 00EA6B03
#requireadmin, xrefs: 00EA6ABB
#include-once, xrefs: 00EA6AEB
Cannot parse #include, xrefs: 00EDE819

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 54c6825dead59143953dd5a14ef7e714cf5e3b6fed52ae2556665ffe5ffdd9e2
Instruction ID: 69afffbeacce4805f669717c9b6d20c1b2f3e1423d07b75cf634e81753d0a05b
Opcode Fuzzy Hash: 54c6825dead59143953dd5a14ef7e714cf5e3b6fed52ae2556665ffe5ffdd9e2
Instruction Fuzzy Hash: 19811F71640215BACB11BB20CD87FAE7798EF1B704F086025FD45BE282EB61FA56D261

Function 00F2AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00F2AB99
SetTextColor.GDI32(?,?), ref: 00F2AB9D
GetSysColorBrush.USER32(0000000F), ref: 00F2ABB3
GetSysColor.USER32(0000000F), ref: 00F2ABBE
CreateSolidBrush.GDI32(?), ref: 00F2ABC3
GetSysColor.USER32(00000011), ref: 00F2ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F2ABE9
SelectObject.GDI32(?,00000000), ref: 00F2ABFA
SetBkColor.GDI32(?,00000000), ref: 00F2AC03
SelectObject.GDI32(?,?), ref: 00F2AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00F2AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F2AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00F2AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F2ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F2ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00F2ACEC
DrawFocusRect.USER32(?,?), ref: 00F2ACF7
GetSysColor.USER32(00000011), ref: 00F2AD05
SetTextColor.GDI32(?,00000000), ref: 00F2AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00F2AD21
SelectObject.GDI32(?,00F2A869), ref: 00F2AD38
DeleteObject.GDI32(?), ref: 00F2AD43
SelectObject.GDI32(?,?), ref: 00F2AD49
DeleteObject.GDI32(?), ref: 00F2AD4E
SetTextColor.GDI32(?,?), ref: 00F2AD54
SetBkColor.GDI32(?,?), ref: 00F2AD5E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 6e792dc6f6499fba253e41bf7df894e824b8ec27bb1d2cbe5fad3baf8489179a
Instruction ID: 54b8366ae481ee4bd8d1eb73762d3920cc8456067de8ec3dab92a1a15d9e7560
Opcode Fuzzy Hash: 6e792dc6f6499fba253e41bf7df894e824b8ec27bb1d2cbe5fad3baf8489179a
Instruction Fuzzy Hash: 97617D71D10218EFDF219FA4DC49EAE7BB9EF08320F104125F911AB2A1D6759D41EF90

Function 00F28C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F28D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F28D45
CharNextW.USER32(0000014E), ref: 00F28D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F28DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F28DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F28DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00F28DF9
SetWindowTextW.USER32(?,0000014E), ref: 00F28E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00F28E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F28E8C
_memset.LIBCMT ref: 00F28EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00F28EFA
_memset.LIBCMT ref: 00F28F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F28F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00F28FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00F29088
InvalidateRect.USER32(?,00000000,00000001), ref: 00F290AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F290F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F29121
DrawMenuBar.USER32(?), ref: 00F29130
SetWindowTextW.USER32(?,0000014E), ref: 00F29158

Strings

0, xrefs: 00F290C2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 8f93143806bb486b3539d2cb0a6fbba44cb77bf9f215b72522b6fc2abdbcf52a
Instruction ID: 8cc4087d6a7814bbf84bfea416225d191af33d7bd64be5461d1ee906ebc0c656
Opcode Fuzzy Hash: 8f93143806bb486b3539d2cb0a6fbba44cb77bf9f215b72522b6fc2abdbcf52a
Instruction Fuzzy Hash: 08E1C471901229AFDF20DF60DC84EEE7BB9EF05760F008159F915AB291DB708A46EF61

Function 00F24B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F24C51
GetDesktopWindow.USER32 ref: 00F24C66
GetWindowRect.USER32(00000000), ref: 00F24C6D
GetWindowLongW.USER32(?,000000F0), ref: 00F24CCF
DestroyWindow.USER32(?), ref: 00F24CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F24D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F24D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00F24D68
SendMessageW.USER32(?,00000421,?,?), ref: 00F24D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00F24D90
IsWindowVisible.USER32(?), ref: 00F24DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00F24DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00F24DDF
GetWindowRect.USER32(?,?), ref: 00F24DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00F24E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00F24E37
CopyRect.USER32(?,?), ref: 00F24E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00F24EB9

Strings

0, xrefs: 00F24BFC
tooltips_class32, xrefs: 00F24D1D
(, xrefs: 00F24E2A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 878278e99e6a183b6a0e31505e45ebc02acb6ebf9bd190b4ebb193a8c9000ac0
Instruction ID: 6096752c99865d1fb7035deb44c9e29d71fae848ce629cfc1c987495197182b9
Opcode Fuzzy Hash: 878278e99e6a183b6a0e31505e45ebc02acb6ebf9bd190b4ebb193a8c9000ac0
Instruction Fuzzy Hash: A6B19D71604350AFDB14DF24D845B6ABBE4FF89710F00892CF599AB2A1D7B1EC05DB92

Function 00F046D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00F046E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00F0470E
_wcscpy.LIBCMT ref: 00F0473C
_wcscmp.LIBCMT ref: 00F04747
_wcscat.LIBCMT ref: 00F0475D
_wcsstr.LIBCMT ref: 00F04768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00F04784
_wcscat.LIBCMT ref: 00F047CD
_wcscat.LIBCMT ref: 00F047D4
_wcsncpy.LIBCMT ref: 00F047FF

Strings

\VarFileInfo\Translation, xrefs: 00F0477C
DefaultLangCodepage, xrefs: 00F047E7
StringFileInfo\, xrefs: 00F04757
%u.%u.%u.%u, xrefs: 00F04862
04090000, xrefs: 00F047BA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 236c556c5dec581fd0b8ef8bf2afd14b6b0426d54a5848f07a1d3ea70303c2ab
Instruction ID: 9c5488d5267a59cb284195bbf841e5eb9ef3da84f957fef97174d95e890c77ed
Opcode Fuzzy Hash: 236c556c5dec581fd0b8ef8bf2afd14b6b0426d54a5848f07a1d3ea70303c2ab
Instruction Fuzzy Hash: 3141E576A002147AD714A6749D43FBF77FCDF41710F04416EFA05B6182EB26E902B6B6

Function 00EA27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EA28BC
GetSystemMetrics.USER32(00000007), ref: 00EA28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EA28EF
GetSystemMetrics.USER32(00000008), ref: 00EA28F7
GetSystemMetrics.USER32(00000004), ref: 00EA291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EA2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00EA2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EA297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EA2990
GetClientRect.USER32(00000000,000000FF), ref: 00EA29AE
GetStockObject.GDI32(00000011), ref: 00EA29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00EA29D5

Part of subcall function 00EA2344: GetCursorPos.USER32(?), ref: 00EA2357
Part of subcall function 00EA2344: ScreenToClient.USER32(00F667B0,?), ref: 00EA2374
Part of subcall function 00EA2344: GetAsyncKeyState.USER32(00000001), ref: 00EA2399
Part of subcall function 00EA2344: GetAsyncKeyState.USER32(00000002), ref: 00EA23A7

SetTimer.USER32(00000000,00000000,00000028,00EA1256), ref: 00EA29FC

Strings

AutoIt v3 GUI, xrefs: 00EA2974

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 56aad549f7acf76fdc52ad43d7285cf3159461113224a96596cb22b05096e356
Instruction ID: 882fc1dfb01be088c363f74aec857dc900e9d87ac3a2f3011c0243665605c7d8
Opcode Fuzzy Hash: 56aad549f7acf76fdc52ad43d7285cf3159461113224a96596cb22b05096e356
Instruction Fuzzy Hash: FCB16D71A0020AEFDB14DFA8DC45BAE7BB5FB08714F109229FA15FB290DB74A851DB50

Function 00F24069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F240F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00F241B6

Strings

FINDITEM, xrefs: 00F24329
GETSELECTED, xrefs: 00F242E4
SELECTALL, xrefs: 00F2421D
SELECTINVERT, xrefs: 00F24286
DESELECT, xrefs: 00F242A4
ISSELECTED, xrefs: 00F241C1
GETITEMCOUNT, xrefs: 00F24128
GETSELECTEDCOUNT, xrefs: 00F24199
GETSUBITEMCOUNT, xrefs: 00F24141
SELECT, xrefs: 00F24250
SELECTCLEAR, xrefs: 00F24235
GETTEXT, xrefs: 00F2415F
VIEWCHANGE, xrefs: 00F24375

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 30cecacf9a83529dc4faa7be7f703950911f45fc97068612ce7cc5b0abe90a74
Instruction ID: e51a4f2c2539be560cc7d8b942bb618682e492ffbe51b066566af94f60d6c7ab
Opcode Fuzzy Hash: 30cecacf9a83529dc4faa7be7f703950911f45fc97068612ce7cc5b0abe90a74
Instruction Fuzzy Hash: 42A1AF30214215DBCB14EF20D941B6AB7E5BF89324F14586CB896AB2D3DB70FD0AEB51

Function 00F152F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00F15309
LoadCursorW.USER32(00000000,00007F8A), ref: 00F15314
LoadCursorW.USER32(00000000,00007F00), ref: 00F1531F
LoadCursorW.USER32(00000000,00007F03), ref: 00F1532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00F15335
LoadCursorW.USER32(00000000,00007F01), ref: 00F15340
LoadCursorW.USER32(00000000,00007F81), ref: 00F1534B
LoadCursorW.USER32(00000000,00007F88), ref: 00F15356
LoadCursorW.USER32(00000000,00007F80), ref: 00F15361
LoadCursorW.USER32(00000000,00007F86), ref: 00F1536C
LoadCursorW.USER32(00000000,00007F83), ref: 00F15377
LoadCursorW.USER32(00000000,00007F85), ref: 00F15382
LoadCursorW.USER32(00000000,00007F82), ref: 00F1538D
LoadCursorW.USER32(00000000,00007F84), ref: 00F15398
LoadCursorW.USER32(00000000,00007F04), ref: 00F153A3
LoadCursorW.USER32(00000000,00007F02), ref: 00F153AE
GetCursorInfo.USER32(?), ref: 00F153BE
GetLastError.KERNEL32(00000001,00000000), ref: 00F153E9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 13ed7186e3f0fa418dec417013b4a89ccd0653445e393a56260d64b30629cc61
Instruction ID: f660a6472acf004de58a97dffe09d8d3cedddd3e3cad7ba5e070be24aa65b57e
Opcode Fuzzy Hash: 13ed7186e3f0fa418dec417013b4a89ccd0653445e393a56260d64b30629cc61
Instruction Fuzzy Hash: D5417670E04319AADB109FB68C499AFFFF8EF51B20B10452FE519E7291DAB8A441CE51

Function 00EFAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00EFAAA5
__swprintf.LIBCMT ref: 00EFAB46
_wcscmp.LIBCMT ref: 00EFAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00EFABAE
_wcscmp.LIBCMT ref: 00EFABEA
GetClassNameW.USER32(?,?,00000400), ref: 00EFAC21
GetDlgCtrlID.USER32(?), ref: 00EFAC73
GetWindowRect.USER32(?,?), ref: 00EFACA9
GetParent.USER32(?), ref: 00EFACC7
ScreenToClient.USER32(00000000), ref: 00EFACCE
GetClassNameW.USER32(?,?,00000100), ref: 00EFAD48
_wcscmp.LIBCMT ref: 00EFAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00EFAD82
_wcscmp.LIBCMT ref: 00EFAD96

Part of subcall function 00EC386C: _iswctype.LIBCMT ref: 00EC3874

Strings

%s%u, xrefs: 00EFAB40

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: f95780373dd95360df4787af7a04dbf2c9fc68b9400c7c6c98f2062a64dcfdba
Instruction ID: 4d84f0ad2bde6bdc960ce19c4108e8e654606337c08c4c584d7ba6ae20650de1
Opcode Fuzzy Hash: f95780373dd95360df4787af7a04dbf2c9fc68b9400c7c6c98f2062a64dcfdba
Instruction Fuzzy Hash: 77A1B1B120470AABD714DF20C884BBAF7E8FF04319F049539FA9DA6590D731E945CB92

Function 00EFB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00EFB3DB
_wcscmp.LIBCMT ref: 00EFB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00EFB414
CharUpperBuffW.USER32(?,00000000), ref: 00EFB431
_wcscmp.LIBCMT ref: 00EFB44F
_wcsstr.LIBCMT ref: 00EFB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00EFB498
_wcscmp.LIBCMT ref: 00EFB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00EFB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00EFB518
_wcscmp.LIBCMT ref: 00EFB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00EFB550
GetWindowRect.USER32(00000004,?), ref: 00EFB5B9

Strings

@, xrefs: 00EFB3BC
ThumbnailClass, xrefs: 00EFB4A3, 00EFB523

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: acb6dd05b2d85c429db47d4147d9a05943c61503ea500398ea8c3fde31058fd7
Instruction ID: bb900c8d349cacd22e5d2b3a9e404c30c506c70c742271d5aac4968f893e4fd2
Opcode Fuzzy Hash: acb6dd05b2d85c429db47d4147d9a05943c61503ea500398ea8c3fde31058fd7
Instruction Fuzzy Hash: 1881C4711043099FDB14DF10C985FBA7BE9EF44318F04A569FE85AA092DB34DE49CB61

Function 00EFB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00EFB23F

Strings

ACTIVE, xrefs: 00EFB21A
[HANDLE:, xrefs: 00EFB24B
[REGEXPTITLE:, xrefs: 00EFB267
LAST, xrefs: 00EFB204
REGEXP=, xrefs: 00EFB254
[ACTIVE, xrefs: 00EFB22C
[ALL, xrefs: 00EFB2E5
HANDLE=, xrefs: 00EFB238
[LAST, xrefs: 00EFB2EC
ALL, xrefs: 00EFB2D3
[CLASS:, xrefs: 00EFB28F
CLASSNAME=, xrefs: 00EFB27C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: f292d03057ce6b473228a13bbc1860746158083b070abbfbc99f0186e5c73f19
Instruction ID: 5e2d77e42d81ead13bca1067acb60eb3341bf523f9d78da3f4bb44d28de2c720
Opcode Fuzzy Hash: f292d03057ce6b473228a13bbc1860746158083b070abbfbc99f0186e5c73f19
Instruction Fuzzy Hash: EA31E831648209E6EB14FA60CD43EFEB7E49F19751F602019FA41750E1EF91BE08D592

Function 00EFC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00EFC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00EFC4E6
SetWindowTextW.USER32(?,?), ref: 00EFC4FD
GetDlgItem.USER32(?,000003EA), ref: 00EFC512
SetWindowTextW.USER32(00000000,?), ref: 00EFC518
GetDlgItem.USER32(?,000003E9), ref: 00EFC528
SetWindowTextW.USER32(00000000,?), ref: 00EFC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00EFC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00EFC569
GetWindowRect.USER32(?,?), ref: 00EFC572
SetWindowTextW.USER32(?,?), ref: 00EFC5DD
GetDesktopWindow.USER32 ref: 00EFC5E3
GetWindowRect.USER32(00000000), ref: 00EFC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00EFC636
GetClientRect.USER32(?,?), ref: 00EFC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00EFC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00EFC693

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 965dde0e82ef3da7b2b005050f8dd30fc5380be244a97e91921c718810542054
Instruction ID: 4f0b5841b6b632791483ca69e9b5c89a3a0b1423b7ee7f1a4eab519ef5ed2dbb
Opcode Fuzzy Hash: 965dde0e82ef3da7b2b005050f8dd30fc5380be244a97e91921c718810542054
Instruction Fuzzy Hash: D9516E7090070DAFDB20DFA8DE85B6EBBF5FF04705F204928E686A25A0C774A949DB50

Function 00F2A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F2A4C8
DestroyWindow.USER32(?,?), ref: 00F2A542

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F2A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F2A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F2A5F1
DestroyWindow.USER32(00000000), ref: 00F2A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00EA0000,00000000), ref: 00F2A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F2A663
GetDesktopWindow.USER32 ref: 00F2A67C
GetWindowRect.USER32(00000000), ref: 00F2A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F2A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F2A6B3

Part of subcall function 00EA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EA25EC

Strings

0, xrefs: 00F2A4DE
tooltips_class32, xrefs: 00F2A5B5, 00F2A643

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: ef91bb8dc8eb47dc23df45f51993f6feec300314099aae0fef645ff208117a81
Instruction ID: 69bdb549b9502da8f0939d21d93223126efead40cf7b09531a2078c25b5f136a
Opcode Fuzzy Hash: ef91bb8dc8eb47dc23df45f51993f6feec300314099aae0fef645ff208117a81
Instruction Fuzzy Hash: C071DE71540209AFD720CF28DC59F6A7BF6FB88714F08492CF995972A0C7B1E906EB52

Function 00F2C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

DragQueryPoint.SHELL32(?,?), ref: 00F2C917

Part of subcall function 00F2ADF1: ClientToScreen.USER32(?,?), ref: 00F2AE1A
Part of subcall function 00F2ADF1: GetWindowRect.USER32(?,?), ref: 00F2AE90
Part of subcall function 00F2ADF1: PtInRect.USER32(?,?,00F2C304), ref: 00F2AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00F2C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F2C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F2C9AE
_wcscat.LIBCMT ref: 00F2C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F2C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00F2CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00F2CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00F2CA47
DragFinish.SHELL32(?), ref: 00F2CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F2CB41

Strings

@GUI_DRAGFILE, xrefs: 00F2CAF0
@GUI_DRAGID, xrefs: 00F2CAB9
@GUI_DROPID, xrefs: 00F2CA6E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 8ff4cdd89d448a71be3690735c39c742659206f458f9752b4ef328e7d695085f
Instruction ID: 49ebe5d203bad4a8e2a017967de35f755d7cd3b617598ab1ee0c0175e1ae49b4
Opcode Fuzzy Hash: 8ff4cdd89d448a71be3690735c39c742659206f458f9752b4ef328e7d695085f
Instruction Fuzzy Hash: B2614871108304AFC711EF64DC85D9FBBF8EF89710F00092EF595A61A1DB70AA49DBA2

Function 00F24619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F246AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F246F6

Strings

GETSELECTED, xrefs: 00F24806
GETITEMCOUNT, xrefs: 00F247D8
EXPAND, xrefs: 00F247A8
ISCHECKED, xrefs: 00F24879
SELECT, xrefs: 00F248A7
GETTOTALCOUNT, xrefs: 00F246DD
GETTEXT, xrefs: 00F24849
EXISTS, xrefs: 00F2475F
COLLAPSE, xrefs: 00F2473C
UNCHECK, xrefs: 00F248D2
CHECK, xrefs: 00F24716

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: aca076d3964c3adaa71d01a4e711abce129e71306dc49cd1cf3e041a3e3ffe4a
Instruction ID: a331910c43992472306e9e49f496bb48583312da07a72af4a1d008080a92e4b3
Opcode Fuzzy Hash: aca076d3964c3adaa71d01a4e711abce129e71306dc49cd1cf3e041a3e3ffe4a
Instruction Fuzzy Hash: 44919C346047159FCB14EF20C451A6ABBE1AF89310F04586DF8966B3A3DB71FD4ADB81

Function 00F2BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F2BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00F29431), ref: 00F2BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F2BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00F2BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F2BC7D
FreeLibrary.KERNEL32(?), ref: 00F2BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F2BC99
DestroyIcon.USER32(?,?,?,?,?,00F29431), ref: 00F2BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F2BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F2BCD1

Part of subcall function 00EC313D: __wcsicmp_l.LIBCMT ref: 00EC31C6

Strings

.icl, xrefs: 00F2BAE4
.exe, xrefs: 00F2BB04
.dll, xrefs: 00F2BB27

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 01461af060c7d3271f1c2dd87a673555ea60fa565078251d443ab7116a6e712e
Instruction ID: 967481716caa9f1a01a041fd4e469b3c9de87df7223300cb77992a32aad4e280
Opcode Fuzzy Hash: 01461af060c7d3271f1c2dd87a673555ea60fa565078251d443ab7116a6e712e
Instruction Fuzzy Hash: B3610071940229BEEB24DF60DC41FBE77B8EB08720F104129FD15EA1D1DB70A985EBA0

Function 00F0A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

CharLowerBuffW.USER32(?,?), ref: 00F0A636
GetDriveTypeW.KERNEL32 ref: 00F0A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F0A730

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Strings

type cdaudio alias cd wait, xrefs: 00F0A6AE
closed, xrefs: 00F0A64A, 00F0A653
wait, xrefs: 00F0A6ED
open , xrefs: 00F0A692
close cd wait, xrefs: 00F0A71B
close, xrefs: 00F0A63C
open, xrefs: 00F0A65D
set cd door , xrefs: 00F0A6D1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 46aa54fd14a7d964d01a07022bd6f9ab16d7abb9fd9f1f78ebe999f078c73a1c
Instruction ID: b2a8fb25c6406d16753d45d47b5a8aaebbcc7f537c936d28590f2404cf3d261e
Opcode Fuzzy Hash: 46aa54fd14a7d964d01a07022bd6f9ab16d7abb9fd9f1f78ebe999f078c73a1c
Instruction Fuzzy Hash: 20515E711043059FC700EF20C98196AB7F4FF89718F04996DF8966B2A2DB31EE0ADB52

Function 00F0A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F0A47A
__swprintf.LIBCMT ref: 00F0A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F0A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F0A4FE
_memset.LIBCMT ref: 00F0A51D
_wcsncpy.LIBCMT ref: 00F0A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F0A58E
CloseHandle.KERNEL32(00000000), ref: 00F0A599
RemoveDirectoryW.KERNEL32(?), ref: 00F0A5A2
CloseHandle.KERNEL32(00000000), ref: 00F0A5AC

Strings

\??\%s, xrefs: 00F0A496
\, xrefs: 00F0A4B2
:, xrefs: 00F0A4BD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 5cfec6b1a89da8b54632e21f1a004772fbd47a045b891e5723ac0bdcdf39368f
Instruction ID: 0c7469e7f5da106e5abad3e1926f53d1ec3a8ed8f90d39e59b4b11fd6fbbf862
Opcode Fuzzy Hash: 5cfec6b1a89da8b54632e21f1a004772fbd47a045b891e5723ac0bdcdf39368f
Instruction Fuzzy Hash: 273192B6910209ABDB21DFA0DC49FEB73BCEF89711F1441B6F908D21A0E7709645AB25

Function 00F2C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F2C4EC
GetFocus.USER32 ref: 00F2C4FC
GetDlgCtrlID.USER32(00000000), ref: 00F2C507
_memset.LIBCMT ref: 00F2C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00F2C65D
GetMenuItemCount.USER32(?), ref: 00F2C67D
GetMenuItemID.USER32(?,00000000), ref: 00F2C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00F2C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00F2C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F2C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00F2C779

Strings

0, xrefs: 00F2C62A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 0bb3f1963673bce5a75a03b68f154554722c80ebe62d7f7a8c63d8896f230ade
Instruction ID: baf421ba0aaa7563fed5d4779d855ca6d1605677840c2b29972473761693a798
Opcode Fuzzy Hash: 0bb3f1963673bce5a75a03b68f154554722c80ebe62d7f7a8c63d8896f230ade
Instruction Fuzzy Hash: 1F819C716083259FD720CF24E985A6FBBE8FF88324F04052DF99997291C731D805EBA2

Function 00EF83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EF8766
Part of subcall function 00EF874A: GetLastError.KERNEL32(?,00EF822A,?,?,?), ref: 00EF8770
Part of subcall function 00EF874A: GetProcessHeap.KERNEL32(00000008,?,?,00EF822A,?,?,?), ref: 00EF877F
Part of subcall function 00EF874A: HeapAlloc.KERNEL32(00000000,?,00EF822A,?,?,?), ref: 00EF8786
Part of subcall function 00EF874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EF879D

Part of subcall function 00EF87E7: GetProcessHeap.KERNEL32(00000008,00EF8240,00000000,00000000,?,00EF8240,?), ref: 00EF87F3
Part of subcall function 00EF87E7: HeapAlloc.KERNEL32(00000000,?,00EF8240,?), ref: 00EF87FA
Part of subcall function 00EF87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00EF8240,?), ref: 00EF880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EF8458
_memset.LIBCMT ref: 00EF846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EF848C
GetLengthSid.ADVAPI32(?), ref: 00EF849D
GetAce.ADVAPI32(?,00000000,?), ref: 00EF84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EF84F6
GetLengthSid.ADVAPI32(?), ref: 00EF8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00EF8522
HeapAlloc.KERNEL32(00000000), ref: 00EF8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EF854A
CopySid.ADVAPI32(00000000), ref: 00EF8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EF8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EF85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EF85BC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e5c9ecf56f2121d53d757f8016d9184a39d272cc3883cfc7c3fd31abb05402bd
Instruction ID: 5bbf89df05abec89b524589c6aa41fd9c85feec81719a1ca04d2ce7a70b1865d
Opcode Fuzzy Hash: e5c9ecf56f2121d53d757f8016d9184a39d272cc3883cfc7c3fd31abb05402bd
Instruction Fuzzy Hash: 5A614871A0020DABDF10DFA4DD45EBEBBB9FF05304F148169EA15BA291DB319A05DF60

Function 00F1762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F176A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F176AE
CreateCompatibleDC.GDI32(?), ref: 00F176BA
SelectObject.GDI32(00000000,?), ref: 00F176C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F1771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00F17757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F1777B
SelectObject.GDI32(00000006,?), ref: 00F17783
DeleteObject.GDI32(?), ref: 00F1778C
DeleteDC.GDI32(00000006), ref: 00F17793
ReleaseDC.USER32(00000000,?), ref: 00F1779E

Strings

(, xrefs: 00F17723

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: ef4c54b981e4063c117dd4d6718360c41459f01d53385589dc43b010eb73bb18
Instruction ID: 043df1b97ec4ef1930679c571401a3bdc3d49ae1beb19248f9488bfaf7f13584
Opcode Fuzzy Hash: ef4c54b981e4063c117dd4d6718360c41459f01d53385589dc43b010eb73bb18
Instruction Fuzzy Hash: 31516975904309EFCB25CFA8CC84EAEBBB9EF48310F14852DF94AA7210D731A845DB60

Function 00F0A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00F2FB78), ref: 00F0A0FC

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00F0A11E
__swprintf.LIBCMT ref: 00F0A177
__swprintf.LIBCMT ref: 00F0A190
_wprintf.LIBCMT ref: 00F0A246
_wprintf.LIBCMT ref: 00F0A264

Strings

"%s" (%d) : ==> %s:, xrefs: 00F0A25F
Error: , xrefs: 00F0A20E
"%s" (%d) : ==> %s:%s%s, xrefs: 00F0A241
^ ERROR, xrefs: 00F0A1E8
Line %d (File "%s"):, xrefs: 00F0A171, 00F0A18A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: ec34537111b3dbf0d0d39568eeebe7a97e1121c44f365887048ed8d0ddbbc8c7
Instruction ID: 29bca323fc2e6f793c6686949019f1ec533c3b9b7635f99ca33c72d81d3b3b07
Opcode Fuzzy Hash: ec34537111b3dbf0d0d39568eeebe7a97e1121c44f365887048ed8d0ddbbc8c7
Instruction Fuzzy Hash: A651A232904209BBCF15EBE0CD82EEEB7B8AF09300F1051A5F515760A1EB316F59EB61

Function 00EA6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00EC0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00EA6C6C,?,00008000), ref: 00EC0BB7

Part of subcall function 00EA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EA48A1,?,?,00EA37C0,?), ref: 00EA48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00EA6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00EA6E5A

Part of subcall function 00EA59CD: _wcscpy.LIBCMT ref: 00EA5A05

Part of subcall function 00EC387D: _iswctype.LIBCMT ref: 00EC3885

Strings

EA06, xrefs: 00EDE87B
AU3!, xrefs: 00EA6CC1
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00EDE84A
Unterminated string, xrefs: 00EDEC0D
Bad directive syntax error, xrefs: 00EDEBC6
>>>AUTOIT SCRIPT<<<, xrefs: 00EDE8BF
Error opening the file, xrefs: 00EDE866, 00EDE8E1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: c8d97b46cc38a7269bca7f8f52da4e9d3e5b2dffc2e2848231ce16f9322d53a9
Instruction ID: 40c80b3c8c56fe64faee02e218b5de3baab826e8ece1508ee03909286ea2b14a
Opcode Fuzzy Hash: c8d97b46cc38a7269bca7f8f52da4e9d3e5b2dffc2e2848231ce16f9322d53a9
Instruction Fuzzy Hash: 9202A3311083419FC724EF24C881AAFBBE5FF9A354F04591EF585AB2A1DB30E949DB42

Function 00EA45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EA45F9
GetMenuItemCount.USER32(00F66890), ref: 00EDD7CD
GetMenuItemCount.USER32(00F66890), ref: 00EDD87D
GetCursorPos.USER32(?), ref: 00EDD8C1
SetForegroundWindow.USER32(00000000), ref: 00EDD8CA
TrackPopupMenuEx.USER32(00F66890,00000000,?,00000000,00000000,00000000), ref: 00EDD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00EDD8E9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: d6bbb579a4282272c8c392b01457eadc468e907b3936ec6bd265da2b39037634
Instruction ID: b1eeea3799b2498b29d39ae9fa50be904cf369f3744c33a1a33351d78bec01e4
Opcode Fuzzy Hash: d6bbb579a4282272c8c392b01457eadc468e907b3936ec6bd265da2b39037634
Instruction Fuzzy Hash: C271F770605209BEEB318F64DC49FAABF64FF45368F141267F514BA2E0C7B16811EB90

Function 00F210A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F20038,?,?), ref: 00F210BC

Strings

HKEY_LOCAL_MACHINE, xrefs: 00F21125
HKEY_CLASSES_ROOT, xrefs: 00F2114F
HKLM, xrefs: 00F2113A
HKEY_CURRENT_CONFIG, xrefs: 00F21179
HKCC, xrefs: 00F2118A
HKCR, xrefs: 00F21164
HKEY_USERS, xrefs: 00F211BD
HKCU, xrefs: 00F211AC
HKEY_CURRENT_USER, xrefs: 00F2119B
HKU, xrefs: 00F211CE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: fd82a162945af6c4558b067d1582b97e492f2236f0b5fca9538122d68cdd45ed
Instruction ID: 8421440aee61fa9884394774362c3d4379f01b9064c6380beba7af0581513d89
Opcode Fuzzy Hash: fd82a162945af6c4558b067d1582b97e492f2236f0b5fca9538122d68cdd45ed
Instruction Fuzzy Hash: A8416D3150025ECBDF10EF90ED91AEB3764BF25310F104458FD926B292DB31AE1AEB50

Function 00F05569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Part of subcall function 00EA7A84: _memmove.LIBCMT ref: 00EA7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F055D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F055E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F055F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F0560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F0561C

Strings

play PlayMe wait, xrefs: 00F05606
close PlayMe, xrefs: 00F055E3, 00F05610
alias PlayMe, xrefs: 00F055AB
open , xrefs: 00F05581
play PlayMe, xrefs: 00F05617
status PlayMe mode, xrefs: 00F055CD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 7d84ea98492940cd9937c1daa4ea723dfedc1763e8c5a09863d9a234205fddc6
Instruction ID: eb9b1b4aa3eee0795f2db0bb993c050a428455b3314bccff062519912de88f7a
Opcode Fuzzy Hash: 7d84ea98492940cd9937c1daa4ea723dfedc1763e8c5a09863d9a234205fddc6
Instruction Fuzzy Hash: EC113430A9012979D720F661CC4ACFF7BBCEF86F00F000169B900A60C1EEA25D09E9A2

Function 00F048F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F0490E
gethostname.WSOCK32(?,00000100), ref: 00F04928
gethostbyname.WSOCK32(?), ref: 00F04935
_wcscpy.LIBCMT ref: 00F0495D
_memmove.LIBCMT ref: 00F04970
inet_ntoa.WSOCK32(?), ref: 00F0497B
_strcat.LIBCMT ref: 00F04989
_wcscpy.LIBCMT ref: 00F049A0
WSACleanup.WSOCK32 ref: 00F049AE
_wcscpy.LIBCMT ref: 00F049BC

Strings

0.0.0.0, xrefs: 00F04957

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 99c48d435e594381f804a1a9c684dd49ccc2c70e214873e31e14377453047da6
Instruction ID: 9a0dd427cc13f846aaf904ee835c326e52e7f0bb082bc393bf6da0cd3e60fb9a
Opcode Fuzzy Hash: 99c48d435e594381f804a1a9c684dd49ccc2c70e214873e31e14377453047da6
Instruction Fuzzy Hash: 8E11D571D04118ABCB20EB249D0AFDB77FC9B41760F0401B9F605A6091EF71AA86B6A1

Function 00F05217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F0521C

Part of subcall function 00EC0719: timeGetTime.WINMM(?,75A8B400,00EB0FF9), ref: 00EC071D

Sleep.KERNEL32(0000000A), ref: 00F05248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00F0526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F0528E
SetActiveWindow.USER32 ref: 00F052AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F052BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F052DA
Sleep.KERNEL32(000000FA), ref: 00F052E5
IsWindow.USER32 ref: 00F052F1
EndDialog.USER32(00000000), ref: 00F05302

Strings

BUTTON, xrefs: 00F05280

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 5436706e5410b794794ed6e0557a71f5c1722e63fc5f800b4395bed100815915
Instruction ID: 4016558ebb5f278b6418a8ad38e31f2a84da753191f0e33ab855f91a5646217e
Opcode Fuzzy Hash: 5436706e5410b794794ed6e0557a71f5c1722e63fc5f800b4395bed100815915
Instruction Fuzzy Hash: 0821927111470CAFE7206B20ED99F263B6AEF45B5EF081474F512811F1DBE19C19BA22

Function 00F0D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

CoInitialize.OLE32(00000000), ref: 00F0D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F0D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00F0D8FC
CoCreateInstance.OLE32(00F32D7C,00000000,00000001,00F5A89C,?), ref: 00F0D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F0D9B7
CoTaskMemFree.OLE32(?,?), ref: 00F0DA0F
_memset.LIBCMT ref: 00F0DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00F0DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F0DAAB
CoTaskMemFree.OLE32(00000000), ref: 00F0DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F0DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00F0DAEB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 1511c0e6c49dfdcd43db451651c70d15a8f67fc9a443701d156c7658f8f5e253
Instruction ID: abbaf0af9d3500dee4f861c495de4969d9f91b3a25d0b7cfb6a0e1567c76beb2
Opcode Fuzzy Hash: 1511c0e6c49dfdcd43db451651c70d15a8f67fc9a443701d156c7658f8f5e253
Instruction Fuzzy Hash: E9B10D75A00109AFDB14DFA4C888DAEBBF9FF49314B148469F909EB261DB30ED45DB50

Function 00F0052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F005A7
SetKeyboardState.USER32(?), ref: 00F00612
GetAsyncKeyState.USER32(000000A0), ref: 00F00632
GetKeyState.USER32(000000A0), ref: 00F00649
GetAsyncKeyState.USER32(000000A1), ref: 00F00678
GetKeyState.USER32(000000A1), ref: 00F00689
GetAsyncKeyState.USER32(00000011), ref: 00F006B5
GetKeyState.USER32(00000011), ref: 00F006C3
GetAsyncKeyState.USER32(00000012), ref: 00F006EC
GetKeyState.USER32(00000012), ref: 00F006FA
GetAsyncKeyState.USER32(0000005B), ref: 00F00723
GetKeyState.USER32(0000005B), ref: 00F00731

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b393090f16f4de7c0e5118fc6142614f88d043e7ea372a0d20cf02233a9682ba
Instruction ID: b5ca6bba72418d1f12dd080a4c2f6ae234f62724aa448520ee3bff2ca4ef8182
Opcode Fuzzy Hash: b393090f16f4de7c0e5118fc6142614f88d043e7ea372a0d20cf02233a9682ba
Instruction Fuzzy Hash: 3C51C830E0478829FB35DBA088557FABFB59F01390F0C4599D9C2561C2DE689B4CFB61

Function 00EFC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00EFC746
GetWindowRect.USER32(00000000,?), ref: 00EFC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00EFC7B6
GetDlgItem.USER32(?,00000002), ref: 00EFC7C1
GetWindowRect.USER32(00000000,?), ref: 00EFC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00EFC827
GetDlgItem.USER32(?,000003E9), ref: 00EFC835
GetWindowRect.USER32(00000000,?), ref: 00EFC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00EFC889
GetDlgItem.USER32(?,000003EA), ref: 00EFC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00EFC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00EFC8C1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 29c4eaeb147897010d737dd62db40824b4ff94383c74cf97eafdc40199e4c617
Instruction ID: 9d20ecbfbd74b89d5e991ee958aacf5d28cb85bd1cde0e4fe2af148d12e5be94
Opcode Fuzzy Hash: 29c4eaeb147897010d737dd62db40824b4ff94383c74cf97eafdc40199e4c617
Instruction Fuzzy Hash: FA514271B10209AFDB18CF69DD85AAEBBB6EB88710F24813DF615E7290D770AD058B10

Function 00EA201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EA2036,?,00000000,?,?,?,?,00EA16CB,00000000,?), ref: 00EA1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00EA20D3
KillTimer.USER32(-00000001,?,?,?,?,00EA16CB,00000000,?,?,00EA1AE2,?,?), ref: 00EA216E
DestroyAcceleratorTable.USER32(00000000), ref: 00EDBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EA16CB,00000000,?,?,00EA1AE2,?,?), ref: 00EDBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EA16CB,00000000,?,?,00EA1AE2,?,?), ref: 00EDBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EA16CB,00000000,?,?,00EA1AE2,?,?), ref: 00EDBF5A
DeleteObject.GDI32(00000000), ref: 00EDBF6C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: ad4ed4c937e994dcadd73241e6856cc46552ed73c8094f57b823029633026f7d
Instruction ID: 612687664d864a822dcbcda89db55ed3e7ba43de8bb7dff1ec9c71d836e48f4b
Opcode Fuzzy Hash: ad4ed4c937e994dcadd73241e6856cc46552ed73c8094f57b823029633026f7d
Instruction Fuzzy Hash: 2F616830201604DFCB359F28CD88B29B7F1FF59319F10652DE652BAA60C775B892EB90

Function 00EA21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00EA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EA25EC

GetSysColor.USER32(0000000F), ref: 00EA21D3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 68c179e4b55e8f04d551bc6d62b2de8079bb125c860349b14375a375b63f95e6
Instruction ID: 80333b1689ba861f177227250c8de45776d5c67a299e16fab88dd47733f97d73
Opcode Fuzzy Hash: 68c179e4b55e8f04d551bc6d62b2de8079bb125c860349b14375a375b63f95e6
Instruction Fuzzy Hash: C34190310001549BDB215F2CEC48BB93B75EB0B325F285269FE65AE1F2C7319C46EB61

Function 00F0AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00F2F910), ref: 00F0AB76
GetDriveTypeW.KERNEL32(00000061,00F5A620,00000061), ref: 00F0AC40
_wcscpy.LIBCMT ref: 00F0AC6A

Strings

removable, xrefs: 00F0ABA8
network, xrefs: 00F0ABD4
cdrom, xrefs: 00F0AB92
ramdisk, xrefs: 00F0ABEA
all, xrefs: 00F0AB7C
unknown, xrefs: 00F0AC01
fixed, xrefs: 00F0ABBE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: fab73f3e922e3e95f2938f9b0033882a308aae9a3a7e6fef6e1f09de4f574d7b
Instruction ID: 64657a5bfc1eae9047f096eaa6d9d008ecca5d2ca21649c860eae0637f77a940
Opcode Fuzzy Hash: fab73f3e922e3e95f2938f9b0033882a308aae9a3a7e6fef6e1f09de4f574d7b
Instruction Fuzzy Hash: 8351BE316083019BC710EF14C891EAAB7E5EF85310F14492DF5966B2E2DB31ED4AEA53

Function 00EA9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00EA99C2
__swprintf.LIBCMT ref: 00EA9A0C
__i64tow.LIBCMT ref: 00EDFA0F

Strings

%.15g, xrefs: 00EA9A06
True, xrefs: 00EDF9D0
0x%p, xrefs: 00EDF9F1
False, xrefs: 00EDF9D7

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: c265410a8ba9a9ba981f85de82fad1f5144e0e7d1fb0444a15a25c1cb9866730
Instruction ID: c6f2d58212dbe78e90897df57a48ab216b7638805c59c209b7c7073739e83ad0
Opcode Fuzzy Hash: c265410a8ba9a9ba981f85de82fad1f5144e0e7d1fb0444a15a25c1cb9866730
Instruction Fuzzy Hash: 8E412B71604205BFDB24DB74DC41FBB77E4EB89304F20546FE549FB292EA32A9429711

Function 00F273C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F273D9
CreateMenu.USER32 ref: 00F273F4
SetMenu.USER32(?,00000000), ref: 00F27403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F27490
IsMenu.USER32(?), ref: 00F274A6
CreatePopupMenu.USER32 ref: 00F274B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F274DD
DrawMenuBar.USER32 ref: 00F274E5

Strings

F, xrefs: 00F274D1
0, xrefs: 00F273CF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: ad0095473e22ab730bd300e5c0708d0705f98deaab93211e81d1150c6b7519f7
Instruction ID: b2fc0a4a8f6eb986e33e7467a25a601371a8725361ea16540fad57906bf339f6
Opcode Fuzzy Hash: ad0095473e22ab730bd300e5c0708d0705f98deaab93211e81d1150c6b7519f7
Instruction Fuzzy Hash: F6415675A00319EFDB20EF64E984E9ABBF9FF49310F144028E955A7360DB31A914EB91

Function 00F2772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F277CD
CreateCompatibleDC.GDI32(00000000), ref: 00F277D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F277E7
SelectObject.GDI32(00000000,00000000), ref: 00F277EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F277FA
DeleteDC.GDI32(00000000), ref: 00F27803
GetWindowLongW.USER32(?,000000EC), ref: 00F2780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00F27821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00F2782D

Strings

static, xrefs: 00F27765

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 2d343dc80918e753328af93cb0792891d70f64531f72a57b50e08b3eff051b41
Instruction ID: 584b1fbe70456964aa5d6604aaa6ff2f1e87f2d453ac1dca62b069b4179c640b
Opcode Fuzzy Hash: 2d343dc80918e753328af93cb0792891d70f64531f72a57b50e08b3eff051b41
Instruction Fuzzy Hash: 75316F31515229BBDF21AF64EC09FDA3B79FF09721F110224FA15A60A0C735D826EBA4

Function 00EC7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EC707B

Part of subcall function 00EC8D68: __getptd_noexit.LIBCMT ref: 00EC8D68

__gmtime64_s.LIBCMT ref: 00EC7114
__gmtime64_s.LIBCMT ref: 00EC714A
__gmtime64_s.LIBCMT ref: 00EC7167
__allrem.LIBCMT ref: 00EC71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EC71D9
__allrem.LIBCMT ref: 00EC71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EC720E
__allrem.LIBCMT ref: 00EC7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EC7243
__invoke_watson.LIBCMT ref: 00EC72B4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 83cffb1f3abaa293997bf84322df2cbeda32b2a87a2f2d78b44f69a732b351d2
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 0671C5B1A08716ABD7149E79CE42F9EB3E8EF10324F14522EF854F6391E771D9428B90

Function 00F02A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F02A31
GetMenuItemInfoW.USER32(00F66890,000000FF,00000000,00000030), ref: 00F02A92
SetMenuItemInfoW.USER32(00F66890,00000004,00000000,00000030), ref: 00F02AC8
Sleep.KERNEL32(000001F4), ref: 00F02ADA
GetMenuItemCount.USER32(?), ref: 00F02B1E
GetMenuItemID.USER32(?,00000000), ref: 00F02B3A
GetMenuItemID.USER32(?,-00000001), ref: 00F02B64
GetMenuItemID.USER32(?,?), ref: 00F02BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F02BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F02C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F02C24

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 88b60e84a24980fcc26ca849f1f728a061e0a5974738aa41a92c49eee2e375a0
Instruction ID: d8b8db283e7d44a6979d55123308c89f19bafdaa576ab7e52e479233d8cc2074
Opcode Fuzzy Hash: 88b60e84a24980fcc26ca849f1f728a061e0a5974738aa41a92c49eee2e375a0
Instruction Fuzzy Hash: F261A2B1A00249AFDF61CF64CD8CEAEBBB8EB41324F144469E84197291DB35AD05FB30

Function 00F27192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F27214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F27217
GetWindowLongW.USER32(?,000000F0), ref: 00F2723B
_memset.LIBCMT ref: 00F2724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F2725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F272D6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 41cb499327b1783b7c17bcd32876bc876e70f552d5ebe87b2d87de9ac1867964
Instruction ID: 2f25388a35a6580d6c614e49c553cf92c4f5f7001e0fda6f926eaa963051ffa6
Opcode Fuzzy Hash: 41cb499327b1783b7c17bcd32876bc876e70f552d5ebe87b2d87de9ac1867964
Instruction Fuzzy Hash: 0C615771A00218AFDB20DFA4DD81EEE77F8AF09710F140199FA14E72A1C774AD45EBA0

Function 00EF710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00EF7135
SafeArrayAllocData.OLEAUT32(?), ref: 00EF718E
VariantInit.OLEAUT32(?), ref: 00EF71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00EF71C0
VariantCopy.OLEAUT32(?,?), ref: 00EF7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00EF7227
VariantClear.OLEAUT32(?), ref: 00EF723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00EF7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EF7252
VariantClear.OLEAUT32(?), ref: 00EF7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EF726F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 772bb50d49cc8911efdea9f558fec7f4193232daf7c229583d330682d2443950
Instruction ID: 7e6584eccd8c2b7b8b97ce8f32c7f62a3b2acf60bf297a64054582f93fafcfe5
Opcode Fuzzy Hash: 772bb50d49cc8911efdea9f558fec7f4193232daf7c229583d330682d2443950
Instruction Fuzzy Hash: 5B416071A0011DAFDB10EF64DC449AEBBB8FF08354F008079FA55E7261CB70A94ADB90

Function 00F15A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F15AA6
inet_addr.WSOCK32(?,?,?), ref: 00F15AEB
gethostbyname.WSOCK32(?), ref: 00F15AF7
IcmpCreateFile.IPHLPAPI ref: 00F15B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F15B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F15B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F15C00
WSACleanup.WSOCK32 ref: 00F15C06

Strings

Ping, xrefs: 00F15B29

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: bdbe642d9d3c5c3ede411f0566010f9b307606c5edc714abb4b111ba8dba7028
Instruction ID: bb45530bbf357f9d8a3a6e4fa583ceefa509ea4318158c9473b69d1627f409b7
Opcode Fuzzy Hash: bdbe642d9d3c5c3ede411f0566010f9b307606c5edc714abb4b111ba8dba7028
Instruction Fuzzy Hash: 05518371604B00DFDB20DF24CC45B6AB7E4EF89B20F14496AF555EB2A1DB70E844EB51

Function 00F0B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F0B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F0B7B1
GetLastError.KERNEL32 ref: 00F0B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00F0B828

Strings

READY, xrefs: 00F0B801
NOTREADY, xrefs: 00F0B7E7
UNKNOWN, xrefs: 00F0B7E0
READONLY, xrefs: 00F0B7F3
INVALID, xrefs: 00F0B7FA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3b8501a12ce3c1c9eb41eca0202616ab7f095edf525cbec9abc7d63e9fca78bd
Instruction ID: 9dc9d9c1917abfca7472e0bd83a1317bbabc99b8f1eb416f5249e9f7e827d051
Opcode Fuzzy Hash: 3b8501a12ce3c1c9eb41eca0202616ab7f095edf525cbec9abc7d63e9fca78bd
Instruction Fuzzy Hash: 9A31B235A002099FCB10EF64CC85ABE7BF8EF49711F10812AE902EB2D1DB71A946F751

Function 00EF9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00EF94F6
GetDlgCtrlID.USER32 ref: 00EF9501
GetParent.USER32 ref: 00EF951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EF9520
GetDlgCtrlID.USER32(?), ref: 00EF9529
GetParent.USER32(?), ref: 00EF9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00EF9548

Strings

ListBox, xrefs: 00EF94B3
ComboBox, xrefs: 00EF947E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: fb4d408746a39f646ed02a3ace710a60cba8f7b314a14835d56a9cd355653518
Instruction ID: 7677034a6b0f8ebdcb2dee6beb3a5f0da47bbbbaf2ee28a0a04ebdb7d89c604a
Opcode Fuzzy Hash: fb4d408746a39f646ed02a3ace710a60cba8f7b314a14835d56a9cd355653518
Instruction Fuzzy Hash: 7321C474A00108BBCF15AB64CC85EFEBBB4EF49300F101165BA61A72A2DB75991DDB20

Function 00EF955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00EF95DF
GetDlgCtrlID.USER32 ref: 00EF95EA
GetParent.USER32 ref: 00EF9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EF9609
GetDlgCtrlID.USER32(?), ref: 00EF9612
GetParent.USER32(?), ref: 00EF962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00EF9631

Strings

ListBox, xrefs: 00EF959E
ComboBox, xrefs: 00EF9569

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ef58ff989dc473d880a3cfc733630548e96475a5ea5d17552825d0add1ad3bac
Instruction ID: a40e4c1d156fb7f50182a7549d0c189e4c6e619d2d730367745897c09656765b
Opcode Fuzzy Hash: ef58ff989dc473d880a3cfc733630548e96475a5ea5d17552825d0add1ad3bac
Instruction Fuzzy Hash: 1B21C875A00108BBDF15AB60CCC5EFEBBB4EF49300F101165FA51A72A2DB75951DDB20

Function 00EF9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00EF9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00EF9666
_wcscmp.LIBCMT ref: 00EF9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00EF96F3

Strings

largeicons, xrefs: 00EF9687
list, xrefs: 00EF96D5
smallicons, xrefs: 00EF96BB
details, xrefs: 00EF96A1
SHELLDLL_DefView, xrefs: 00EF9672

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 04bd3e409cfebb75310e44601383c6e74df592d9bdf02708105a64b0724d45eb
Instruction ID: 0fd338a6fa57c537e235f100e7c99b6224c5914ffcf943f629de19ae073518e1
Opcode Fuzzy Hash: 04bd3e409cfebb75310e44601383c6e74df592d9bdf02708105a64b0724d45eb
Instruction Fuzzy Hash: 7C110A7A24830BBAF6152630DC06FF6B7DCDB04765F21102AFF00F50D2FE92A9165959

Function 00F18BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F18BEC
CoInitialize.OLE32(00000000), ref: 00F18C19
CoUninitialize.OLE32 ref: 00F18C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00F18D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F18E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00F32C0C), ref: 00F18E84
CoGetObject.OLE32(?,00000000,00F32C0C,?), ref: 00F18EA7
SetErrorMode.KERNEL32(00000000), ref: 00F18EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F18F3A
VariantClear.OLEAUT32(?), ref: 00F18F4A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 9d3c3a49a41ffc15c58c9c82513ce550d58429d9c0af752eb09e8acca1087227
Instruction ID: 530be76d6b122e534bc209990ba939e2c3d32936be0a21c03304be8c51146ca0
Opcode Fuzzy Hash: 9d3c3a49a41ffc15c58c9c82513ce550d58429d9c0af752eb09e8acca1087227
Instruction Fuzzy Hash: F7C16571608305AFC700DF64C98496BBBE9FF89388F00492DF9899B251DB31ED46DB52

Function 00F04189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00F0419D
__swprintf.LIBCMT ref: 00F041AA

Part of subcall function 00EC38D8: __woutput_l.LIBCMT ref: 00EC3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00F041D4
LoadResource.KERNEL32(?,00000000), ref: 00F041E0
LockResource.KERNEL32(00000000), ref: 00F041ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00F0420D
LoadResource.KERNEL32(?,00000000), ref: 00F0421F
SizeofResource.KERNEL32(?,00000000), ref: 00F0422E
LockResource.KERNEL32(?), ref: 00F0423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00F0429B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: bcc31d0e5c669a8d15cf0c42e9e7a9d27b7de271b9a65c47f8feac53601febd7
Instruction ID: 30aa7f8e054a4b556c1cdcbada5350ef407698cabedca5fb199da33b872664be
Opcode Fuzzy Hash: bcc31d0e5c669a8d15cf0c42e9e7a9d27b7de271b9a65c47f8feac53601febd7
Instruction Fuzzy Hash: 5A31B0B1A0520AAFCB119F60DD44EBF7BBCEF05301F044565FA12E2190D774EA62BBA0

Function 00F016DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F01700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F00778,?,00000001), ref: 00F01714
GetWindowThreadProcessId.USER32(00000000), ref: 00F0171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F00778,?,00000001), ref: 00F0172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F0173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F00778,?,00000001), ref: 00F01755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F00778,?,00000001), ref: 00F01767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F00778,?,00000001), ref: 00F017AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F00778,?,00000001), ref: 00F017C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F00778,?,00000001), ref: 00F017CC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 307ea9ea2278c091c0ea468001f93956cd6bc7224761ec8ade90a2da31d1ccf7
Instruction ID: 9fccde5eb97402c44e236710d1e138fb6459a471bc1e177e0c71bba9d5cbf164
Opcode Fuzzy Hash: 307ea9ea2278c091c0ea468001f93956cd6bc7224761ec8ade90a2da31d1ccf7
Instruction Fuzzy Hash: C431BF75A00308BBEB21AF14DD84F693BB9FB15725F104028F800C62E0D7B4AD44BFA0

Function 00EAFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EAFC06
OleUninitialize.OLE32(?,00000000), ref: 00EAFCA5
UnregisterHotKey.USER32(?), ref: 00EAFDFC
DestroyWindow.USER32(?), ref: 00EE4A00
FreeLibrary.KERNEL32(?), ref: 00EE4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00EE4A92

Strings

close all, xrefs: 00EAFC01

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 94a5b9addb03b3a55203fa56e03e530aff06e87a9aba910b687e3c2502dd2e0c
Instruction ID: c5fdabf4d016a4a01d5675b4f543a4f3ce9db4faefd39e40160bbc5c143d1e8c
Opcode Fuzzy Hash: 94a5b9addb03b3a55203fa56e03e530aff06e87a9aba910b687e3c2502dd2e0c
Instruction Fuzzy Hash: 4BA19D71701216CFCB29EF55C994B69F3A0AF09714F1462BDE80ABB292DB30AD16CF54

Function 00EFA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00EFAA64), ref: 00EFA9A2

Strings

INSTANCE, xrefs: 00EFA8B0
TEXT, xrefs: 00EFA8D9
CLASSNN, xrefs: 00EFA744
REGEXPCLASS, xrefs: 00EFA767
NAME, xrefs: 00EFA7D4
CLASS, xrefs: 00EFA721

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 76184e7e56774371a8588d5b1aa74efffa2797f4023833eca95115b42fac9604
Instruction ID: a09634beb4cb2b1077391cfcfdacecf14a367bd3646ffab52e9dbe59b0d68083
Opcode Fuzzy Hash: 76184e7e56774371a8588d5b1aa74efffa2797f4023833eca95115b42fac9604
Instruction Fuzzy Hash: FA91B4B060020ADBCB08DF60D481BF9FBB4BF44344F54A139DA9EBB141DB706A5ADB91

Function 00EA2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00EA2EAE

Part of subcall function 00EA1DB3: GetClientRect.USER32(?,?), ref: 00EA1DDC
Part of subcall function 00EA1DB3: GetWindowRect.USER32(?,?), ref: 00EA1E1D
Part of subcall function 00EA1DB3: ScreenToClient.USER32(?,?), ref: 00EA1E45

GetDC.USER32 ref: 00EDCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00EDCF95
SelectObject.GDI32(00000000,00000000), ref: 00EDCFA3
SelectObject.GDI32(00000000,00000000), ref: 00EDCFB8
ReleaseDC.USER32(?,00000000), ref: 00EDCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00EDD04B

Strings

U, xrefs: 00EDCF20

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: e025c931e0ec1916b746f63b2c0a7902a917824cd8206e65c8ffd43e08226d41
Instruction ID: 96f0cd0b372bf1016b7528fc6bef6bdba034ac6a0aef1230f6fc51f4b6223f3a
Opcode Fuzzy Hash: e025c931e0ec1916b746f63b2c0a7902a917824cd8206e65c8ffd43e08226d41
Instruction Fuzzy Hash: 6471B730504209DFCF219F64CC849EA7BB6FF49354F14926AED55BA2A5C7319C82EB60

Function 00F2C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

Part of subcall function 00EA2344: GetCursorPos.USER32(?), ref: 00EA2357
Part of subcall function 00EA2344: ScreenToClient.USER32(00F667B0,?), ref: 00EA2374
Part of subcall function 00EA2344: GetAsyncKeyState.USER32(00000001), ref: 00EA2399
Part of subcall function 00EA2344: GetAsyncKeyState.USER32(00000002), ref: 00EA23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00F2C2E4
ImageList_EndDrag.COMCTL32 ref: 00F2C2EA
ReleaseCapture.USER32 ref: 00F2C2F0
SetWindowTextW.USER32(?,00000000), ref: 00F2C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00F2C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00F2C48F

Strings

@GUI_DRAGFILE, xrefs: 00F2C424
@GUI_DROPID, xrefs: 00F2C3E1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 8fca75ca57415fb4aa8b451053ae611b47ccb285843ac6bd6110662b4853329c
Instruction ID: 168b6703341162fd336d2727172f617838e4ea6a88ac50e61115eec9b3f22e6c
Opcode Fuzzy Hash: 8fca75ca57415fb4aa8b451053ae611b47ccb285843ac6bd6110662b4853329c
Instruction Fuzzy Hash: EF51AB30204304AFDB10EF24DC56F6A7BE5EF89310F00452DF9959B2E2DB71A949EB92

Function 00F18F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00F2F910), ref: 00F1903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00F2F910), ref: 00F19071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F191EB
SysFreeString.OLEAUT32(?), ref: 00F19215

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: f3443a06dff5e9121c2b2a661dcc84b59695887cb55bc777e96df11f96911f56
Instruction ID: 2ce26d5c7487943a645daf0c18dec284aab79b667609587ee55cb2e44fc2a39e
Opcode Fuzzy Hash: f3443a06dff5e9121c2b2a661dcc84b59695887cb55bc777e96df11f96911f56
Instruction Fuzzy Hash: 4CF13971A00109EFDB14DF94C898EEEB7B9FF49314F108059F516AB291CB71AE86DB90

Function 00F1F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F1F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F1FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F1FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F1FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F1FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F1FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F1FD90
CloseHandle.KERNEL32(?), ref: 00F1FDBF
CloseHandle.KERNEL32(?), ref: 00F1FE36

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: ed9a2e0119df38b20677f1936896f199ef9068651750307dc72e732699efd193
Instruction ID: 77ffce22ca4c53bd28a44ab6853accf0a6e0d8f4493cdc1ca17a175127a0a57f
Opcode Fuzzy Hash: ed9a2e0119df38b20677f1936896f199ef9068651750307dc72e732699efd193
Instruction Fuzzy Hash: 7CE1C531604341DFC714EF24C891BABBBE1AF89360F14846DF8999B2A2DB31EC45DB52

Function 00F04F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F048AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F038D3,?), ref: 00F048C7

Part of subcall function 00F048AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F038D3,?), ref: 00F048E0

Part of subcall function 00F04CD3: GetFileAttributesW.KERNEL32(?,00F03947), ref: 00F04CD4

lstrcmpiW.KERNEL32(?,?), ref: 00F04FE2
_wcscmp.LIBCMT ref: 00F04FFC
MoveFileW.KERNEL32(?,?), ref: 00F05017

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 2cdaaf9ae7119b231aabef0ecba6cf3e5f991122b169304f7432548c7495c7f2
Instruction ID: b5b83f23e092af667f935fe660f611975ffcd80e3b2039085187807e61689735
Opcode Fuzzy Hash: 2cdaaf9ae7119b231aabef0ecba6cf3e5f991122b169304f7432548c7495c7f2
Instruction Fuzzy Hash: AD5196B24083859BC720DB50CC819DFB3EC9F85310F00492EB289D7191EE75B2899B66

Function 00F288B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F2896E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c65b63bfea7e9ecc039c4dc7d272c4902febfebed0a40ff0dbb7bcb57daa4876
Instruction ID: dbef6c6a643ac6d00ddb363e3cc905b84e92bec7cb966b581c4860c9f6d605c3
Opcode Fuzzy Hash: c65b63bfea7e9ecc039c4dc7d272c4902febfebed0a40ff0dbb7bcb57daa4876
Instruction Fuzzy Hash: 3651E930901228BFDF309F68EC85BA93BA4FF053A0F504126F511EA5A1CF75A986FB51

Function 00EA2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00EDC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00EDC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00EDC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00EDC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00EDC5C0
DestroyIcon.USER32(00000000), ref: 00EDC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00EDC5EC
DestroyIcon.USER32(?), ref: 00EDC5FB

Part of subcall function 00F2A71E: DeleteObject.GDI32(00000000), ref: 00F2A757

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: c736d7518f9e45d0faff7a139a6a5c6ceb37dcc0eb900cb94dff4e8bf36d9718
Instruction ID: 0903634b37e54e3b83b052396fb332d22ba2903184084e21ac168556f71288d8
Opcode Fuzzy Hash: c736d7518f9e45d0faff7a139a6a5c6ceb37dcc0eb900cb94dff4e8bf36d9718
Instruction Fuzzy Hash: B9515A70600209AFDB24DF28DC45FAA7BB5EB49354F101529F912BB2A0DB70F991EB60

Function 00EF9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFAE77
Part of subcall function 00EFAE57: GetCurrentThreadId.KERNEL32 ref: 00EFAE7E
Part of subcall function 00EFAE57: AttachThreadInput.USER32(00000000,?,00EF9B65,?,00000001), ref: 00EFAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00EF9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00EF9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00EF9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EF9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00EF9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00EF9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EF9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00EF9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00EF9BDD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ec9616c36b7b47f356be228d7913715fab7f1710a338673a65497a76cfc26276
Instruction ID: 007eb9a1211d2deeb474292a57c960b9f9481319aedd523f890412df7e4b7a96
Opcode Fuzzy Hash: ec9616c36b7b47f356be228d7913715fab7f1710a338673a65497a76cfc26276
Instruction Fuzzy Hash: C411E57156021CBEF6206F60DC49F6A3F6DDB4C751F500435F348AB0A1CAF25C61EAA4

Function 00EF8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E0C
HeapAlloc.KERNEL32(00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EF8A84,00000B00,?,?), ref: 00EF8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E30
DuplicateHandle.KERNEL32(00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00EF8A84,00000B00,?,?), ref: 00EF8E43
GetCurrentProcess.KERNEL32(00EF8A84,00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E4B
DuplicateHandle.KERNEL32(00000000,?,00EF8A84,00000B00,?,?), ref: 00EF8E4E
CreateThread.KERNEL32(00000000,00000000,00EF8E74,00000000,00000000,00000000), ref: 00EF8E68

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6e9e438a3974303210619a70212c4fd6c21f6d69adae5f2668e79eb4974c4459
Instruction ID: 2d702c091b9e3fbf95cd6abf6786ca132ae4560251b35f648d8a5f5056d4049d
Opcode Fuzzy Hash: 6e9e438a3974303210619a70212c4fd6c21f6d69adae5f2668e79eb4974c4459
Instruction Fuzzy Hash: 8901BBB5650308FFE720ABA5DD4EF6B3BACEB89711F404421FA05DB1A1CA709815DB21

Function 00F19428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F1947C
VariantInit.OLEAUT32(?), ref: 00F1954D
VariantInit.OLEAUT32(?), ref: 00F1964E
VariantClear.OLEAUT32(?), ref: 00F19658
VariantClear.OLEAUT32(?), ref: 00F196B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00F194DD, 00F1960B, 00F196C3
Incorrect Object type in FOR..IN loop, xrefs: 00F19631

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: ab737215664fb5d86a7ead6b81b107ee0a92bc2bf51352f67ac1febf5d4c3682
Instruction ID: b3ae726a82e21ded11378f46bed75f7c992a771b93ced6f2b7ccba7bac3eb3d3
Opcode Fuzzy Hash: ab737215664fb5d86a7ead6b81b107ee0a92bc2bf51352f67ac1febf5d4c3682
Instruction Fuzzy Hash: 45919C71E04219ABDF20DFA5C854FEEBBB8EF85320F108159F505AB280D7B09985DBE0

Function 00F19A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00EF7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?,?,00EF799D), ref: 00EF766F
Part of subcall function 00EF7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?), ref: 00EF768A
Part of subcall function 00EF7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?), ref: 00EF7698
Part of subcall function 00EF7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?), ref: 00EF76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00F19B1B
_memset.LIBCMT ref: 00F19B28
_memset.LIBCMT ref: 00F19C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00F19C97
CoTaskMemFree.OLE32(?), ref: 00F19CA2

Strings

NULL Pointer assignment, xrefs: 00F19CF0

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 91819e744c9dc452544e09bee330341dbe8e113302c9841a8248e94e67ae45a7
Instruction ID: b768ef8f34897bdfcb328902598b20b95d50b7f0cdddff4a872c6eba01fb2c30
Opcode Fuzzy Hash: 91819e744c9dc452544e09bee330341dbe8e113302c9841a8248e94e67ae45a7
Instruction Fuzzy Hash: 01913A72D00219ABDB10DFA4DC91EDEBBB8AF09710F20416AF519B7281DB716A45DFA0

Function 00F26FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F27093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00F270A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F270C1
_wcscat.LIBCMT ref: 00F2711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00F27133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F27161

Strings

SysListView32, xrefs: 00F27065

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 5cce7e07b6abfc0dc457aa91131442d484a28566a9a10a58741cd2673faf0f62
Instruction ID: b806b4d8abc635ced0e8b0ae6b163ea8cf1605747c7ad6cd804da23dd6977cf6
Opcode Fuzzy Hash: 5cce7e07b6abfc0dc457aa91131442d484a28566a9a10a58741cd2673faf0f62
Instruction Fuzzy Hash: E8418271904318AFDB21DFA4DC85BEE77F8EF08360F10046AF944A7291D7719D89AB50

Function 00F1EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00F03E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00F03EB6
Part of subcall function 00F03E91: Process32FirstW.KERNEL32(00000000,?), ref: 00F03EC4
Part of subcall function 00F03E91: CloseHandle.KERNEL32(00000000), ref: 00F03F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F1ECB8
GetLastError.KERNEL32 ref: 00F1ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F1ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F1ED77
GetLastError.KERNEL32(00000000), ref: 00F1ED82
CloseHandle.KERNEL32(00000000), ref: 00F1EDB7

Strings

SeDebugPrivilege, xrefs: 00F1ECD6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 41e57137ff067ac912cacbb9e13bb193a427f1275da3066f32a914cd9b3287d8
Instruction ID: ee87292bfa35f97b41ac6b1f2578027fdb74a16f085ed577d483894b6eb67f1e
Opcode Fuzzy Hash: 41e57137ff067ac912cacbb9e13bb193a427f1275da3066f32a914cd9b3287d8
Instruction Fuzzy Hash: EA41AD716002009FDB20EF24DC95FBEB7E5AF45714F088059F942AF2D2DB75A848DB92

Function 00F03226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F032C5

Strings

blank, xrefs: 00F03247
warning, xrefs: 00F032AE
stop, xrefs: 00F03296
question, xrefs: 00F0327E
info, xrefs: 00F03266

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 553f8ff0ecd2f8b9645c02eb4faff50f88d175b122c9c5a94cd4d342f32d4431
Instruction ID: d01bf55963dfe4bd45c1cfa99e15c448d3dcb300092bdfbfc689fc16c7c8307e
Opcode Fuzzy Hash: 553f8ff0ecd2f8b9645c02eb4faff50f88d175b122c9c5a94cd4d342f32d4431
Instruction Fuzzy Hash: C8113A36609346BFE7015B65DC53E6AB7DCDF19370F20002EFA00A62C1E6B29B4179A6

Function 00F04534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F0454E
LoadStringW.USER32(00000000), ref: 00F04555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F0456B
LoadStringW.USER32(00000000), ref: 00F04572
_wprintf.LIBCMT ref: 00F04598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F045B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F04593

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 599c7a3f254da85cbae9234d3056246b7588d501e039dd6dd8c01e90365fd681
Instruction ID: 8bce0ef932cacf960b748b5d20610f7cf354cc272e1c38c690796fea3b5287ad
Opcode Fuzzy Hash: 599c7a3f254da85cbae9234d3056246b7588d501e039dd6dd8c01e90365fd681
Instruction Fuzzy Hash: B1012CF291020CBFE721A7A0DD89EE6767CEB08301F4005B5BB45E2051EA749E8A9B71

Function 00F2D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

GetSystemMetrics.USER32(0000000F), ref: 00F2D78A
GetSystemMetrics.USER32(0000000F), ref: 00F2D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F2D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F2DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F2DA24
ShowWindow.USER32(00000003,00000000), ref: 00F2DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00F2DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00F2DA8B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 6e723c47ae8cb482b1ae5d73cc544925e29deda6c781bda3cd590ea4043086ba
Instruction ID: 543ff0c60df7d8ac1f028ca0ef1069ab51f0254149109210cd3731c4659ec27d
Opcode Fuzzy Hash: 6e723c47ae8cb482b1ae5d73cc544925e29deda6c781bda3cd590ea4043086ba
Instruction Fuzzy Hash: B3B17A71A00229EFDF14CF68D985BBD7BB1FF44711F088069EC489B296D734A994EB90

Function 00EA2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00EDC417,00000004,00000000,00000000,00000000), ref: 00EA2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00EDC417,00000004,00000000,00000000,00000000,000000FF), ref: 00EA2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00EDC417,00000004,00000000,00000000,00000000), ref: 00EDC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00EDC417,00000004,00000000,00000000,00000000), ref: 00EDC4D6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3e31c79842dab3cabecd335af11062c0a258e147420ccc80c84350634753af5b
Instruction ID: 1079dec865884d96f7ea3e3ff14e983654cd91e7df607ef5637e091e26334518
Opcode Fuzzy Hash: 3e31c79842dab3cabecd335af11062c0a258e147420ccc80c84350634753af5b
Instruction Fuzzy Hash: 5A410B316146809AC7358B2C8D987B77BA2EF4F304F24A41EE257BE661C675B846E710

Function 00F07368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F0737F

Part of subcall function 00EC0FF6: std::exception::exception.LIBCMT ref: 00EC102C
Part of subcall function 00EC0FF6: __CxxThrowException@8.LIBCMT ref: 00EC1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F073B6
EnterCriticalSection.KERNEL32(?), ref: 00F073D2
_memmove.LIBCMT ref: 00F07420
_memmove.LIBCMT ref: 00F0743D
LeaveCriticalSection.KERNEL32(?), ref: 00F0744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F07461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F07480

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 4b5087d6f459f398ab4d396a8b7b1e5dc77a67f93035783828b3b9054fe50b9d
Instruction ID: 5bbb83ad9c606570c806cee997eb4db713cf4e3fc6be578b57461537fdf11008
Opcode Fuzzy Hash: 4b5087d6f459f398ab4d396a8b7b1e5dc77a67f93035783828b3b9054fe50b9d
Instruction Fuzzy Hash: 9831B031E00209EBDF10EF54DD85EAE7BB8EF45710B1440B9FD04AB286DB309A15EBA0

Function 00F26442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F2645A
GetDC.USER32(00000000), ref: 00F26462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F2646D
ReleaseDC.USER32(00000000,00000000), ref: 00F26479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F264B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F264C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F29299,?,?,000000FF,00000000,?,000000FF,?), ref: 00F26500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F26520

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 4c1cb22bd168fd57a472fa9e3069740efb0be642eeaec343df4efd0b51a367ec
Instruction ID: dfcfb2b58428e2a300a64dc9690d76e7e2954bea746d4f5858cbd8e2f4d87d6c
Opcode Fuzzy Hash: 4c1cb22bd168fd57a472fa9e3069740efb0be642eeaec343df4efd0b51a367ec
Instruction Fuzzy Hash: 16319F72211214BFEB208F50DC4AFEB3FA9EF09765F040065FE08DA191C6759C46DB64

Function 00EFC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00EFC087
_memcmp.LIBCMT ref: 00EFC0A9
_memcmp.LIBCMT ref: 00EFC0C1
_memcmp.LIBCMT ref: 00EFC0D4
_memcmp.LIBCMT ref: 00EFC0EE
_memcmp.LIBCMT ref: 00EFC101
_memcmp.LIBCMT ref: 00EFC119
_memcmp.LIBCMT ref: 00EFC134

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4924b5e252ccaab6218c8f5dda5437e46dcd45ce7a04a4168f7ade0ab9b5be8d
Instruction ID: 5d875aaf5143703ecad5ea98c64a9cc8d74ace3a867d65db45a51e0c6042725f
Opcode Fuzzy Hash: 4924b5e252ccaab6218c8f5dda5437e46dcd45ce7a04a4168f7ade0ab9b5be8d
Instruction Fuzzy Hash: 9B21867160120DB7D654A5219F52FBB339C9E113A8F346024FF05B6683FB52DD1291A6

Function 00F0ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

Part of subcall function 00EBFEC6: _wcscpy.LIBCMT ref: 00EBFEE9

_wcstok.LIBCMT ref: 00F0EEFF
_wcscpy.LIBCMT ref: 00F0EF8E
_memset.LIBCMT ref: 00F0EFC1

Strings

X, xrefs: 00F0EFFE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: a036a20c468d8bea397470623e3f89e440632ee8cbafae61db9e0736954261e3
Instruction ID: a2290ff05f8b6488ab9ed716e12b18e00645080491a22abd2c8d5f9793635049
Opcode Fuzzy Hash: a036a20c468d8bea397470623e3f89e440632ee8cbafae61db9e0736954261e3
Instruction Fuzzy Hash: CBC17071508701DFC724EF24C881A5EB7E4BF89310F14596DF899AB2A2DB70ED49DB82

Function 00F16E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00F16F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F16F35
WSAGetLastError.WSOCK32(00000000), ref: 00F16F48
htons.WSOCK32(?,?,?,00000000,?), ref: 00F16FFE
inet_ntoa.WSOCK32(?), ref: 00F16FBB

Part of subcall function 00EFAE14: _strlen.LIBCMT ref: 00EFAE1E
Part of subcall function 00EFAE14: _memmove.LIBCMT ref: 00EFAE40

_strlen.LIBCMT ref: 00F17058
_memmove.LIBCMT ref: 00F170C1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 9b210e0d98a43969449a4f91da75c53c4ea0877dd89a7216eadf66833c797be7
Instruction ID: 99d65909143b3aa1ca7d5ebcfaa1f007dc406a6b18b505597d7f7a348477ed84
Opcode Fuzzy Hash: 9b210e0d98a43969449a4f91da75c53c4ea0877dd89a7216eadf66833c797be7
Instruction Fuzzy Hash: 8C81D272508300AFD710EB24CC81FABB3F9AF89724F10461DF559AB292DB71AD45DB92

Function 00EA1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c97f1b3e801a6f4f766b3bc8ccb07e91e9af02388b340525d5cfebce2f2a41
Instruction ID: 22309a1420c50b2c94702abbeb2377b3a2a7e2dbd8394d998f54cc711d0425cd
Opcode Fuzzy Hash: 50c97f1b3e801a6f4f766b3bc8ccb07e91e9af02388b340525d5cfebce2f2a41
Instruction Fuzzy Hash: 7E718E30904119EFCB14CF98CC44ABEBBB9FF8A314F108199F915BA251D730AA12CB64

Function 00F2B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01175768), ref: 00F2B6A5
IsWindowEnabled.USER32(01175768), ref: 00F2B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00F2B795
SendMessageW.USER32(01175768,000000B0,?,?), ref: 00F2B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00F2B809
GetWindowLongW.USER32(01175768,000000EC), ref: 00F2B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F2B843

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 95a29da748f12e4a3a9b6df1ef697b97430c0a47af30bad7ab8f945fc621b5bf
Instruction ID: f42fded7ad93e2a4e96f13b759a5d631b7d42c98a0c0a09b0f2a384e7d2deb71
Opcode Fuzzy Hash: 95a29da748f12e4a3a9b6df1ef697b97430c0a47af30bad7ab8f945fc621b5bf
Instruction Fuzzy Hash: 7C719F34A00229AFDB20DF64D8A4FAA7BB9FF49320F1440A9ED5597361C731AD45FB50

Function 00F1F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F1F75C
_memset.LIBCMT ref: 00F1F825
ShellExecuteExW.SHELL32(?), ref: 00F1F86A

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

Part of subcall function 00EBFEC6: _wcscpy.LIBCMT ref: 00EBFEE9

GetProcessId.KERNEL32(00000000), ref: 00F1F8E1
CloseHandle.KERNEL32(00000000), ref: 00F1F910

Strings

@, xrefs: 00F1F839

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 5cb64cd948313dbc665e327c2029d3d902fa4b386c36f10df2cc9f7f92fcc2b8
Instruction ID: dc9755f883b321452d419dd40d8a2690bf3f216f5e5fb8769dbb701532bd3072
Opcode Fuzzy Hash: 5cb64cd948313dbc665e327c2029d3d902fa4b386c36f10df2cc9f7f92fcc2b8
Instruction Fuzzy Hash: 42619D75E006199FCB14EF54C981AAEBBF4FF49320B148469E846BB361CB31AD85CB90

Function 00F0145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F0149C
GetKeyboardState.USER32(?), ref: 00F014B1
SetKeyboardState.USER32(?), ref: 00F01512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F01540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F0155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F015A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F015C8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8bf6e46d8b0a26aa7f46512850cd3a720f2fc0fa728dd6d0974c9ad7cdcdcae5
Instruction ID: 0a200159f9fe8be6a3ce510e3d5e2a3e80df0d236e155455c91d6bd53837d956
Opcode Fuzzy Hash: 8bf6e46d8b0a26aa7f46512850cd3a720f2fc0fa728dd6d0974c9ad7cdcdcae5
Instruction Fuzzy Hash: 5D5104A0A047D53EFB3683348C05BBABEA97B46324F0C4589E1D54A8D2C3D9DC94F750

Function 00F01276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F012B5
GetKeyboardState.USER32(?), ref: 00F012CA
SetKeyboardState.USER32(?), ref: 00F0132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F01357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F01374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F013B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F013D9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: dc60db8995f077f20c3dcecb5f6b83533238ba2a539c47e78cd563c0c6920b3e
Instruction ID: 558111e7f51077a1bd096b2f46a90bf411dc4d1534f8faae4fa28e47638c08f1
Opcode Fuzzy Hash: dc60db8995f077f20c3dcecb5f6b83533238ba2a539c47e78cd563c0c6920b3e
Instruction Fuzzy Hash: 8E5105A0D047D97EFB3687248C45B7ABFA9BF06310F088589E1D4868D2D395EC98F760

Function 00F0589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F058AC
_wcsncpy.LIBCMT ref: 00F058E1
_wcsncpy.LIBCMT ref: 00F05913
_wcsncpy.LIBCMT ref: 00F05946
_wcsncpy.LIBCMT ref: 00F05988
_wcsncpy.LIBCMT ref: 00F059C2
_wcsncpy.LIBCMT ref: 00F059F1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 087607b0e93cbc69f0d2955c25ea66ddc8e1d8c6993563f0ced25de0b9e8e87f
Instruction ID: 46cb69751313a78d1668864d10e8f8b9a46db91da3bc553b9aedcbee1bb93233
Opcode Fuzzy Hash: 087607b0e93cbc69f0d2955c25ea66ddc8e1d8c6993563f0ced25de0b9e8e87f
Instruction Fuzzy Hash: BD41B3A9C2021876CF11EBB48886ECFB3E89F04710F50945AF518F3261E635E716D7A9

Function 00F038AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F048AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F038D3,?), ref: 00F048C7

Part of subcall function 00F048AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F038D3,?), ref: 00F048E0

lstrcmpiW.KERNEL32(?,?), ref: 00F038F3
_wcscmp.LIBCMT ref: 00F0390F
MoveFileW.KERNEL32(?,?), ref: 00F03927
_wcscat.LIBCMT ref: 00F0396F
SHFileOperationW.SHELL32(?), ref: 00F039DB

Strings

\*.*, xrefs: 00F03969

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a7689f31cdcdc4592efbcf8bb60cf5110c5fffd4bdd2a383d9782f116ca27df8
Instruction ID: 578adf67f37193c12f2bed856e265b20634ab579978dbc5fe9d968a522fe6e4c
Opcode Fuzzy Hash: a7689f31cdcdc4592efbcf8bb60cf5110c5fffd4bdd2a383d9782f116ca27df8
Instruction Fuzzy Hash: 4441B1B25083849ED751EF64C881ADFB7ECAF88340F00592EB489D3191EA75D689E752

Function 00F27500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F27519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F275C0
IsMenu.USER32(?), ref: 00F275D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F27620
DrawMenuBar.USER32 ref: 00F27633

Strings

0, xrefs: 00F2750D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 5d0b1e51b088cd45d9d89dee55eead4f1904eaf0150b78c828c9f5a15c69d9b7
Instruction ID: d2f7161bcbb21563a1459348b1f9437020220278aff3e9097e6a42d6c804e8fe
Opcode Fuzzy Hash: 5d0b1e51b088cd45d9d89dee55eead4f1904eaf0150b78c828c9f5a15c69d9b7
Instruction Fuzzy Hash: 12415871A04719AFDB20EF65E984E9ABBF8FF08320F048029F915A7250D730AD10EF90

Function 00F2122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00F2125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F21286
FreeLibrary.KERNEL32(00000000), ref: 00F2133D

Part of subcall function 00F2122D: RegCloseKey.ADVAPI32(?), ref: 00F212A3
Part of subcall function 00F2122D: FreeLibrary.KERNEL32(?), ref: 00F212F5
Part of subcall function 00F2122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00F21318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00F212E0

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: ec2f693a35e63f2d8006925057227ceeb831a0a93d3f4dec784e1922c3ecad90
Instruction ID: 59b2172d7a7adcf35edb40554fc27c668e2efb8346f546eba07ce8c6c1be3625
Opcode Fuzzy Hash: ec2f693a35e63f2d8006925057227ceeb831a0a93d3f4dec784e1922c3ecad90
Instruction Fuzzy Hash: 1B31F9B1D11119BFDB15DB90EC89EFFB7BCEB18310F10017AE501E2151EA749E4AAAA4

Function 00F2653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F2655B
GetWindowLongW.USER32(01175768,000000F0), ref: 00F2658E
GetWindowLongW.USER32(01175768,000000F0), ref: 00F265C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00F265F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00F2661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00F26630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00F2664A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 62e09366c2601191d1a1433ec0e0245a809ce61c2faf879fcd0574dc3f30b8c7
Instruction ID: 78b60cfb157f7237f9748929de6eb0db312f7d41a806da9d9b1dde10f08c0ccc
Opcode Fuzzy Hash: 62e09366c2601191d1a1433ec0e0245a809ce61c2faf879fcd0574dc3f30b8c7
Instruction Fuzzy Hash: E4310330A04164AFDB208F68EC86F553BE5FB4A724F180168F511CF2B5CB71AC44EB81

Function 00F16486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F180A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F180CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F164D9
WSAGetLastError.WSOCK32(00000000), ref: 00F164E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F16521
connect.WSOCK32(00000000,?,00000010), ref: 00F1652A
WSAGetLastError.WSOCK32 ref: 00F16534
closesocket.WSOCK32(00000000), ref: 00F1655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F16576

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 3c3bb20d8e491917c9766f2b83b4d988e2494b0c2492237bf0c3d160e5cef1f7
Instruction ID: 8495765dfb91895ad750f997bb67779ee025c50407804d10c40374b330f7357f
Opcode Fuzzy Hash: 3c3bb20d8e491917c9766f2b83b4d988e2494b0c2492237bf0c3d160e5cef1f7
Instruction Fuzzy Hash: 7C31A171600118ABDB109F24CC85BFE7BB9EB45724F044069F905EB291DB74AD49EB61

Function 00EFE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EFE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EFE120
SysAllocString.OLEAUT32(00000000), ref: 00EFE123
SysAllocString.OLEAUT32 ref: 00EFE144
SysFreeString.OLEAUT32 ref: 00EFE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00EFE167
SysAllocString.OLEAUT32(?), ref: 00EFE175

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c60169ce067e5506adfdbe2fe459f5431d9f79bef1300964c481f1ded6c28fda
Instruction ID: 6d27e978a986ccfcb0afdede17c40bd751f650022d561c935cd0a0fffe9fbfea
Opcode Fuzzy Hash: c60169ce067e5506adfdbe2fe459f5431d9f79bef1300964c481f1ded6c28fda
Instruction Fuzzy Hash: 7C21A73560110CAF9B20EFA9DC88DBB77ECEB09760B408135FA14DB270DA70EC419B60

Function 00EFFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00EFFB81
__wcsnicmp.LIBCMT ref: 00EFFBA2
__wcsnicmp.LIBCMT ref: 00EFFBBC

Strings

#notrayicon, xrefs: 00EFFB79
#requireadmin, xrefs: 00EFFB9C
#OnAutoItStartRegister, xrefs: 00EFFBB6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 5da15f4e627fe61a6bd2198b3cf7686f666bb9f2f8a9ac3bff67e94e39cc4300
Instruction ID: b3639dc5bee698481987341b3d476acf943abaeaf27f545e1d1a7c7e4f331b50
Opcode Fuzzy Hash: 5da15f4e627fe61a6bd2198b3cf7686f666bb9f2f8a9ac3bff67e94e39cc4300
Instruction Fuzzy Hash: 6D216732204228A6D230E634DD12FBBB3D8DF55354F14A039FA86B6141EB51ED82D295

Function 00F2783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EA1D73
Part of subcall function 00EA1D35: GetStockObject.GDI32(00000011), ref: 00EA1D87
Part of subcall function 00EA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EA1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F278A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F278AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F278B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F278C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F278D4

Strings

Msctls_Progress32, xrefs: 00F27872

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 8d0d39a10250b5c4016cb8d95bedcedabc594ff3addc5bbbbff007691e057c32
Instruction ID: 3c94c9e7433a5592dc55765cacb92a4b85933f01cac7f15470dd04eef3a93775
Opcode Fuzzy Hash: 8d0d39a10250b5c4016cb8d95bedcedabc594ff3addc5bbbbff007691e057c32
Instruction Fuzzy Hash: EE115EB2550229BFEF159E60DC85EE77F6DEF08768F114115BA04A6090CB72AC21EBA4

Function 00EC41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00EC4292,?), ref: 00EC41E3
GetProcAddress.KERNEL32(00000000), ref: 00EC41EA
EncodePointer.KERNEL32(00000000), ref: 00EC41F6
DecodePointer.KERNEL32(00000001,00EC4292,?), ref: 00EC4213

Strings

combase.dll, xrefs: 00EC41DE
RoInitialize, xrefs: 00EC41D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: eff6ce5c89db4d26e65979935b29a3c4cbae6e126100b223250a869138e80fe7
Instruction ID: 26bbb1176a1359218bc71bffcd367878cafe28a68b0212774f166987f8bf83b4
Opcode Fuzzy Hash: eff6ce5c89db4d26e65979935b29a3c4cbae6e126100b223250a869138e80fe7
Instruction Fuzzy Hash: AEE012B05A03089FEB216F70EC09B0439A4B716716F505534F421E50E0DBF55496BF00

Function 00EC429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00EC41B8), ref: 00EC42B8
GetProcAddress.KERNEL32(00000000), ref: 00EC42BF
EncodePointer.KERNEL32(00000000), ref: 00EC42CA
DecodePointer.KERNEL32(00EC41B8), ref: 00EC42E5

Strings

RoUninitialize, xrefs: 00EC42A7
combase.dll, xrefs: 00EC42B3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 8948beeac7f34b58ff96a9e58b8ccfe06fff72af352181b993f72cd8eb4f1fbf
Instruction ID: a4c2f980feaa4cec0c79cb13640f5843107e63eae89ee580b04e6966bfc715d1
Opcode Fuzzy Hash: 8948beeac7f34b58ff96a9e58b8ccfe06fff72af352181b993f72cd8eb4f1fbf
Instruction Fuzzy Hash: DAE04F78550308EBEB21AB20FD0DB003AB4B716746F100038F010E10F0CBB59545FB05

Function 00F0675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F068AD
_memmove.LIBCMT ref: 00F067E8

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

_memmove.LIBCMT ref: 00F0685B
_memmove.LIBCMT ref: 00F06942
_memmove.LIBCMT ref: 00F0695B
_memmove.LIBCMT ref: 00F06977

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction ID: 080c22ae3faaae3f06986f8069cc0a3eceff16576774d8298c873a48ecd59efb
Opcode Fuzzy Hash: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction Fuzzy Hash: 0661AC3150025AABDF11EF20CD82FFE37E4AF4A308F045559F855AB1D2DB35A952EB60

Function 00F2046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00F210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F20038,?,?), ref: 00F210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F20548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F20588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00F205AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F205D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F20617
RegCloseKey.ADVAPI32(00000000), ref: 00F20624

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7b4070d3dbe4ce2355ae9357427540f3c9cb8fc3e5325b7d971eff04cdc85857
Instruction ID: 8e6c8bb4d7d25e80b72b9f86878c04d5e3d628ce9be7e77e18c478cc7e1b58a1
Opcode Fuzzy Hash: 7b4070d3dbe4ce2355ae9357427540f3c9cb8fc3e5325b7d971eff04cdc85857
Instruction Fuzzy Hash: 60513A32608204AFC714EB14D885E6FBBE9FF89314F04496DF5859B1A2DB31E905EB52

Function 00F25A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00F25A82
GetMenuItemCount.USER32(00000000), ref: 00F25AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F25AE1
GetMenuItemID.USER32(?,?), ref: 00F25B50
GetSubMenu.USER32(?,?), ref: 00F25B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00F25BAF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 05bfde794331d60a167760f2f43c8cefd62841c0e41fca872b24a46306b1ed88
Instruction ID: f3c9808f702e4163d0a9c2f488b6cd1b76f2bc75c96de8dd35f4089091cf2204
Opcode Fuzzy Hash: 05bfde794331d60a167760f2f43c8cefd62841c0e41fca872b24a46306b1ed88
Instruction Fuzzy Hash: 31517236E00625EFCF11DF64D845AAEB7F4EF48720F104469E805BB351CB74AE41AB90

Function 00EFF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EFF3F7
VariantClear.OLEAUT32(00000013), ref: 00EFF469
VariantClear.OLEAUT32(00000000), ref: 00EFF4C4
_memmove.LIBCMT ref: 00EFF4EE
VariantClear.OLEAUT32(?), ref: 00EFF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00EFF569

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: babeacd5f3389de390304813ea0cab1067504b8cf0b250d09c02e70256153458
Instruction ID: 5638b32a0fd9b1d477c28411fcf1c2f9b3fb17be02c308aed0ad074f5a484492
Opcode Fuzzy Hash: babeacd5f3389de390304813ea0cab1067504b8cf0b250d09c02e70256153458
Instruction Fuzzy Hash: 1C516CB5A00209DFCB14DF58D880AAAB7B9FF4C314B158169EA59EB300D730E912CBA0

Function 00F026F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F02747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F02792
IsMenu.USER32(00000000), ref: 00F027B2
CreatePopupMenu.USER32 ref: 00F027E6
GetMenuItemCount.USER32(000000FF), ref: 00F02844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F02875

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 81bf6a826010fc29e90808626695766f728c7eceed25af2d25ae8a4f6d977100
Instruction ID: c15b70a4eeec1776438ac613cf196fc5750c4bb57b1ab2c3c30ca9ff0eb78348
Opcode Fuzzy Hash: 81bf6a826010fc29e90808626695766f728c7eceed25af2d25ae8a4f6d977100
Instruction Fuzzy Hash: 3F51A074A00209DBDF65CF68C88CBAEBBF4BF44324F14816AE8119B2D1D7708904FB61

Function 00EA1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00EA179A
GetWindowRect.USER32(?,?), ref: 00EA17FE
ScreenToClient.USER32(?,?), ref: 00EA181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EA182C
EndPaint.USER32(?,?), ref: 00EA1876

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 7dc5ad4c16367b4910c6788d84cf896b302a8c7c34ce8ef92543c6bd14462cae
Instruction ID: 340b8cd392381b508a855e1239e87452747a2b6d9419c9ac11e32ee18e6a53e9
Opcode Fuzzy Hash: 7dc5ad4c16367b4910c6788d84cf896b302a8c7c34ce8ef92543c6bd14462cae
Instruction Fuzzy Hash: 7A41A070504304AFD710DF24CC84BBA7BF8EF4A724F1406A9F5A4DB2A1D771A846EB61

Function 00F2B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00F667B0,00000000,01175768,?,?,00F667B0,?,00F2B862,?,?), ref: 00F2B9CC
EnableWindow.USER32(00000000,00000000), ref: 00F2B9F0
ShowWindow.USER32(00F667B0,00000000,01175768,?,?,00F667B0,?,00F2B862,?,?), ref: 00F2BA50
ShowWindow.USER32(00000000,00000004,?,00F2B862,?,?), ref: 00F2BA62
EnableWindow.USER32(00000000,00000001), ref: 00F2BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00F2BAA9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3ab4d4dda80fffd482a54a2a0ba5568644427df156f31cca99f7dfc4e3564961
Instruction ID: 90e0535f72c772a53b4ec4199192f07b8bfa33b99bb23e3cd6f8d4d081f08cc7
Opcode Fuzzy Hash: 3ab4d4dda80fffd482a54a2a0ba5568644427df156f31cca99f7dfc4e3564961
Instruction Fuzzy Hash: 50416130A01255AFDB21CF14E489B957BE0FF05321F1842B9EE489F6A2C735A846EF51

Function 00F173B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00F15134,?,?,00000000,00000001), ref: 00F173BF

Part of subcall function 00F13C94: GetWindowRect.USER32(?,?), ref: 00F13CA7

GetDesktopWindow.USER32 ref: 00F173E9
GetWindowRect.USER32(00000000), ref: 00F173F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F17422

Part of subcall function 00F054E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F0555E

GetCursorPos.USER32(?), ref: 00F1744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F174AC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 722f0a079a2d046cf6df904984a54392540a8103d1366a267e8d13364dd3e8a8
Instruction ID: d5902f8e62b6552ace7b99a60470d77337dc3c128648ab212546bc6bb540b878
Opcode Fuzzy Hash: 722f0a079a2d046cf6df904984a54392540a8103d1366a267e8d13364dd3e8a8
Instruction Fuzzy Hash: A931E472508319ABD720EF14DC49F9BBBE9FF88314F000929F58997191C774E949DB92

Function 00EF8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EF8608
Part of subcall function 00EF85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EF8612
Part of subcall function 00EF85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EF8621
Part of subcall function 00EF85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EF8628
Part of subcall function 00EF85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EF863E

GetLengthSid.ADVAPI32(?,00000000,00EF8977), ref: 00EF8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00EF8DB8
HeapAlloc.KERNEL32(00000000), ref: 00EF8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00EF8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00EF8977), ref: 00EF8DEC
HeapFree.KERNEL32(00000000), ref: 00EF8DF3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 0105d9de2c9cf0b14f1b2b324aede1167a58c12c6ef77d1a182d8d085ae00bd1
Instruction ID: 27f642b319d00fa9cffb0656ff99711b0755a39a57bad6b635f1db4b22287abb
Opcode Fuzzy Hash: 0105d9de2c9cf0b14f1b2b324aede1167a58c12c6ef77d1a182d8d085ae00bd1
Instruction Fuzzy Hash: 1B11DC31A10609FFDB208FA4CE09BBE7BBDEF40319F104169E945A3251CB329905DB60

Function 00EF8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00EF8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00EF8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00EF8B40
CloseHandle.KERNEL32(00000004), ref: 00EF8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EF8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00EF8B8E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 041a0b4ae2c19b8e3ca536ec04950b4ae6eb72b20739c2616b60986801db454f
Instruction ID: 12d6735781137672a9b6dbd01be214a635338737cc1d3a5b93223f5e1a7433c7
Opcode Fuzzy Hash: 041a0b4ae2c19b8e3ca536ec04950b4ae6eb72b20739c2616b60986801db454f
Instruction Fuzzy Hash: AA1159B650020DABDF11CFA4ED49FEA7BB9EF08308F045065FE04A2160C7768D65EB60

Function 00F2C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00EA12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EA134D
Part of subcall function 00EA12F3: SelectObject.GDI32(?,00000000), ref: 00EA135C
Part of subcall function 00EA12F3: BeginPath.GDI32(?), ref: 00EA1373
Part of subcall function 00EA12F3: SelectObject.GDI32(?,00000000), ref: 00EA139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00F2C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00F2C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F2C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00F2C1F6
EndPath.GDI32(00000000), ref: 00F2C206
StrokePath.GDI32(00000000), ref: 00F2C216

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c6bbf927972b2d4039ce3df4cbc1791184906b4dd218158964dd6df0a46d2bde
Instruction ID: c7524dccba0cacbec6fcd49012f244fbce3008b06cd270dea6c0caa82091b215
Opcode Fuzzy Hash: c6bbf927972b2d4039ce3df4cbc1791184906b4dd218158964dd6df0a46d2bde
Instruction Fuzzy Hash: 7911097640014CBFDF119F90DC88EAA7FADEF08364F048025FA189A1A2C7719D59EBA0

Function 00EC03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EC03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00EC03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EC03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EC03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00EC03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EC0401

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 9deea4011f739d4143985fad328eb295970122d7ca335b633a5affed5c8a9160
Instruction ID: 7969da629bb0a6ae369634138289467189d1f18bf6ee0d89ef833170e8429339
Opcode Fuzzy Hash: 9deea4011f739d4143985fad328eb295970122d7ca335b633a5affed5c8a9160
Instruction Fuzzy Hash: 32016CB09027597DE3008F5A8C85B52FFB8FF19354F00411BA15C47941C7F5A868CBE5

Function 00F0568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F0569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F056B1
GetWindowThreadProcessId.USER32(?,?), ref: 00F056C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F056CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F056D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F056E0

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0b2979714afbc1c0fb693f14ad49f9fdd7fdd26771ef901ae4bfe8df4e21d2f0
Instruction ID: 675405cb78c683aaf03f4ebd82076cfdd0b0c71193e0aa042c32d35525c1280b
Opcode Fuzzy Hash: 0b2979714afbc1c0fb693f14ad49f9fdd7fdd26771ef901ae4bfe8df4e21d2f0
Instruction Fuzzy Hash: AEF01D3265115CBBE7315BA2DC0EEAB7E7CEBCAB11F000179FA05D109096A11A16A6B5

Function 00F074D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F074E5
EnterCriticalSection.KERNEL32(?,?,00EB1044,?,?), ref: 00F074F6
TerminateThread.KERNEL32(00000000,000001F6,?,00EB1044,?,?), ref: 00F07503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00EB1044,?,?), ref: 00F07510

Part of subcall function 00F06ED7: CloseHandle.KERNEL32(00000000,?,00F0751D,?,00EB1044,?,?), ref: 00F06EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F07523
LeaveCriticalSection.KERNEL32(?,?,00EB1044,?,?), ref: 00F0752A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ffc2f4afac1d59da66a1fd3ecf2730f451f653df8c12b238f3b45f949aa139a6
Instruction ID: b3a24cab78d45308b751edaa6310f8df2867d98e72ad8a9989f50b659a31938f
Opcode Fuzzy Hash: ffc2f4afac1d59da66a1fd3ecf2730f451f653df8c12b238f3b45f949aa139a6
Instruction Fuzzy Hash: CEF05E3A960716EBDB212B64FE8C9EB773AEF46312B040571F202910F4CB755816EB51

Function 00EF8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00EF8E7F
UnloadUserProfile.USERENV(?,?), ref: 00EF8E8B
CloseHandle.KERNEL32(?), ref: 00EF8E94
CloseHandle.KERNEL32(?), ref: 00EF8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00EF8EA5
HeapFree.KERNEL32(00000000), ref: 00EF8EAC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: aceecb122acdc633c70f121b36b15eeb831631d8f126c21e84af43ba452f5ad8
Instruction ID: c04601e063a4a1f35b3b2d5978abcad581684aa7a75491607d730203a7c30928
Opcode Fuzzy Hash: aceecb122acdc633c70f121b36b15eeb831631d8f126c21e84af43ba452f5ad8
Instruction Fuzzy Hash: 55E0C236014009FBDA115FE1ED0C91ABB79FB89322B508230F21981070CB32983AEB50

Function 00F18902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F18928
CharUpperBuffW.USER32(?,?), ref: 00F18A37
VariantClear.OLEAUT32(?), ref: 00F18BAF

Part of subcall function 00F07804: VariantInit.OLEAUT32(00000000), ref: 00F07844
Part of subcall function 00F07804: VariantCopy.OLEAUT32(00000000,?), ref: 00F0784D
Part of subcall function 00F07804: VariantClear.OLEAUT32(00000000), ref: 00F07859

Strings

Incorrect Parameter format, xrefs: 00F18960, 00F18B22
AUTOIT.ERROR, xrefs: 00F18A3D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 925d2f9ec86997efa06ebecf3ed95a50a233eb307ffe970267504e29780fb851
Instruction ID: f27c4a0f4d13d9876713b88fc7919657717f54fe4797cd69c9392bccf587f5b6
Opcode Fuzzy Hash: 925d2f9ec86997efa06ebecf3ed95a50a233eb307ffe970267504e29780fb851
Instruction Fuzzy Hash: EF917D716083019FC710DF24C5809AABBE4EFC9754F14496EF88A9B362DB31E946DB52

Function 00F02F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBFEC6: _wcscpy.LIBCMT ref: 00EBFEE9

_memset.LIBCMT ref: 00F03077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F030A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F03159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F03187

Strings

0, xrefs: 00F03063

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 55d7650e98df960de34677af54366e7cd2ce41f8af212aca8889f72490c3642e
Instruction ID: c37a9fe172d66a88e432411ca7bc3074f1db4f44c0c572bd13a1680741be6759
Opcode Fuzzy Hash: 55d7650e98df960de34677af54366e7cd2ce41f8af212aca8889f72490c3642e
Instruction Fuzzy Hash: D451D131E093019AD7259F28C845B6BBBE8EF89364F04092EF895E31D1DB70CE45B792

Function 00EFDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00EFDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00EFDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00EFDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00EFDB8E

Strings

DllGetClassObject, xrefs: 00EFDB01

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 86fd524b1350cdeb8423aba1e42adb16c7614db4bdcb9be5a384168b1f65551d
Instruction ID: 656650cfc08ae9be39e7330789a297ed143572c608dea51dc9d4703737441c94
Opcode Fuzzy Hash: 86fd524b1350cdeb8423aba1e42adb16c7614db4bdcb9be5a384168b1f65551d
Instruction Fuzzy Hash: B941827160420CEFDB15CF54CC84AAABFBAEF44350F1591A9AE05AF205D7B1DE44DBA0

Function 00F02C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F02CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F02CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00F02D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F66890,00000000), ref: 00F02D5A

Strings

0, xrefs: 00F02CA4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 16b84120010b72df850b90a5c69a6f301432384c7abe830faa850c6ff39ba625
Instruction ID: 4ecf440da3f0f5bd1ca0e4964ef3a06064e1c2afced52d27000c032bbe708bd5
Opcode Fuzzy Hash: 16b84120010b72df850b90a5c69a6f301432384c7abe830faa850c6ff39ba625
Instruction Fuzzy Hash: 3041C1316063029FD720DF24CC89B1ABBE8EF85320F04462EF965972D1D770E905EBA2

Function 00F1DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F1DAD9

Part of subcall function 00EA79AB: _memmove.LIBCMT ref: 00EA79F9

Strings

cdecl, xrefs: 00F1DB30
stdcall, xrefs: 00F1DB5B
winapi, xrefs: 00F1DB4A
none, xrefs: 00F1DBB4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: c25cf097db0ad8ff4fba532d2450fcc2c46cf8605cd2c39cdf187dc1ab7c297b
Instruction ID: 30da5b958328aaa6176eee9b8094edcecc110fc49036e1424aba1335faff5cba
Opcode Fuzzy Hash: c25cf097db0ad8ff4fba532d2450fcc2c46cf8605cd2c39cdf187dc1ab7c297b
Instruction Fuzzy Hash: 6D31C871904619DFCF10DF54CC809EEB7F4FF45320B108669E866AB6D1DB71A946DB80

Function 00EF9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00EF93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00EF9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00EF9439

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Strings

ListBox, xrefs: 00EF93B5
ComboBox, xrefs: 00EF9380

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: c35758bec980d45f85466d99f4d59f80df5bc3f221a0234b884399841a5c7e7a
Instruction ID: 828e1c3ac9a8c22e743a9ad2a243c5be97e42454497fcb43fefded85b5134e8a
Opcode Fuzzy Hash: c35758bec980d45f85466d99f4d59f80df5bc3f221a0234b884399841a5c7e7a
Instruction Fuzzy Hash: 9E21F671A00108BFDB14AB70DC85DFFB7B8DF06350B145129FA65B71E2DB355A4E9610

Function 00F11B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F11B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F11B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F11B96
InternetCloseHandle.WININET(00000000), ref: 00F11BDD

Part of subcall function 00F12777: GetLastError.KERNEL32(?,?,00F11B0B,00000000,00000000,00000001), ref: 00F1278C
Part of subcall function 00F12777: SetEvent.KERNEL32(?,?,00F11B0B,00000000,00000000,00000001), ref: 00F127A1

Strings

, xrefs: 00F11B87

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f43d97e4d29e45cd8c6380fafcc9e64be769c4a5f971caa24732f2b5aa46c302
Instruction ID: bd3bb63b985d9cf86e395744f11b8689a95be8b7df025b5e21739f925018fa95
Opcode Fuzzy Hash: f43d97e4d29e45cd8c6380fafcc9e64be769c4a5f971caa24732f2b5aa46c302
Instruction Fuzzy Hash: AA218EB150420CBFEB21DF609C85FFB76FCFB89B58F10412AF605A6240EA249D45A7A1

Function 00F26656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EA1D73
Part of subcall function 00EA1D35: GetStockObject.GDI32(00000011), ref: 00EA1D87
Part of subcall function 00EA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EA1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F266D0
LoadLibraryW.KERNEL32(?), ref: 00F266D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F266EC
DestroyWindow.USER32(?), ref: 00F266F4

Strings

SysAnimate32, xrefs: 00F266AB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 086f1eedc6a0bc10159c9267dfe21eaf11cf3cecb40decf541f8ce307a8fd5f3
Instruction ID: a0b52922027f659368e4941ea70239b549ee779bd42319967a86775ee0a82ed2
Opcode Fuzzy Hash: 086f1eedc6a0bc10159c9267dfe21eaf11cf3cecb40decf541f8ce307a8fd5f3
Instruction Fuzzy Hash: F3219D7160021AABEF104F64FC80EBB3BADEB59378F104629F911DA1A0DB71DC51B760

Function 00F0703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F0705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F07091
GetStdHandle.KERNEL32(0000000C), ref: 00F070A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F070DD

Strings

nul, xrefs: 00F070D8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: fd0f2d46907be48d3ce55a6d14af85ae0d300b15c741bce4bd72b0e54fe1c81d
Instruction ID: c7df248da07ba5f108a706bc79be05f9501cc23c93badf8945f9373205e69981
Opcode Fuzzy Hash: fd0f2d46907be48d3ce55a6d14af85ae0d300b15c741bce4bd72b0e54fe1c81d
Instruction Fuzzy Hash: EC216B75E04309ABDB30AF28DC05A9A77B8AF45720F204B69F8A1D72D0E770A851FB50

Function 00F0710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F0712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F0715D
GetStdHandle.KERNEL32(000000F6), ref: 00F0716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F071A8

Strings

nul, xrefs: 00F071A3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 080eeb767731580f751e289fa589705b73bc56100a390a411165638157d628d5
Instruction ID: b13ff0e540b543645d8c32d9b096d48c180fd3a2a8391b9f72eeddf276e26e07
Opcode Fuzzy Hash: 080eeb767731580f751e289fa589705b73bc56100a390a411165638157d628d5
Instruction Fuzzy Hash: 9321A475E043099BDB20AF689C04A9AB7A8AF55730F200659FDA0D32D0D770A851B751

Function 00F0AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F0AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F0AF13
__swprintf.LIBCMT ref: 00F0AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00F2F910), ref: 00F0AF6A

Strings

%lu, xrefs: 00F0AF26

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: bb23b992690567d89d748595545326ab4d01651a892c968eabb30492a268c25b
Instruction ID: 7a8fa3ea0a132efcaf2ffc23fd576dc86fb7e1c6f2fe7eb95a5b79b220a72333
Opcode Fuzzy Hash: bb23b992690567d89d748595545326ab4d01651a892c968eabb30492a268c25b
Instruction Fuzzy Hash: 09214435A00209AFCB10DF64CD85DAE7BF8EF49705B104069F909EB251DB31EA45DB61

Function 00EFA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

Part of subcall function 00EFA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00EFA399
Part of subcall function 00EFA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFA3AC
Part of subcall function 00EFA37C: GetCurrentThreadId.KERNEL32 ref: 00EFA3B3
Part of subcall function 00EFA37C: AttachThreadInput.USER32(00000000), ref: 00EFA3BA

GetFocus.USER32 ref: 00EFA554

Part of subcall function 00EFA3C5: GetParent.USER32(?), ref: 00EFA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00EFA59D
EnumChildWindows.USER32(?,00EFA615), ref: 00EFA5C5
__swprintf.LIBCMT ref: 00EFA5DF

Strings

%s%d, xrefs: 00EFA5D9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 9567be4e94508b30b5b352763fc268013ca9acebb9b9f4ff8b16765fa63c2bf4
Instruction ID: 079d7df773410172d62716dbf54ce0c858775206b87d099c406185b5b63ea200
Opcode Fuzzy Hash: 9567be4e94508b30b5b352763fc268013ca9acebb9b9f4ff8b16765fa63c2bf4
Instruction Fuzzy Hash: D6116DB160420DABDF11BF64DC85FFA37B8AF49700F085075BA0CBE192CA71594A9B76

Function 00F02017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F02048

Strings

KEYS, xrefs: 00F0205F
REMOVE, xrefs: 00F0204E
EXISTS, xrefs: 00F02070
APPEND, xrefs: 00F02081

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 1e34fd0f875807d392321a21dd2c08f5ac1914047c0d851153b0f1f45e9bc41d
Instruction ID: c80a7d3e8e0c0f21662c03ef3f6600add5832294c5d76911b28ac71ac8fe5ee6
Opcode Fuzzy Hash: 1e34fd0f875807d392321a21dd2c08f5ac1914047c0d851153b0f1f45e9bc41d
Instruction Fuzzy Hash: 2F113930910209CFCF40EFA4D9519AEB7B4FF16304B1085A9DC56A7292EB336E1AEB50

Function 00F1EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F1EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F1EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F1F07E
CloseHandle.KERNEL32(?), ref: 00F1F0FF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 41b525ea16a5c3006472636b09728b8370a74161deabc5a606e939bb0c78e301
Instruction ID: 67858de2fda68d330bb6cbcb7444259dcebd934af0294fbc509de3dfe168eb21
Opcode Fuzzy Hash: 41b525ea16a5c3006472636b09728b8370a74161deabc5a606e939bb0c78e301
Instruction Fuzzy Hash: 1D819371A043009FD720DF28CC86F6AB7E5AF8C720F14881DF999EB292DB71AC458B51

Function 00F202C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00F210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F20038,?,?), ref: 00F210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F20388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F203C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F2040E
RegCloseKey.ADVAPI32(?,?), ref: 00F2043A
RegCloseKey.ADVAPI32(00000000), ref: 00F20447

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: fa3179d39b5d3acc63d2fc3f6dc4e783033721502d4dfba2c4636f87a9a0c610
Instruction ID: a1790492b236f7ecf6f7183a113018f83ed17cbf42ad8fc16abe5d20166e57f0
Opcode Fuzzy Hash: fa3179d39b5d3acc63d2fc3f6dc4e783033721502d4dfba2c4636f87a9a0c610
Instruction Fuzzy Hash: 98513A32608204AFD714EB54DC81E6AB7E8FF88714F04992EB5959B2A2DB30E905DB52

Function 00F1DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F1DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00F1DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F1DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00F1DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F1DD35

Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F07B20,?,?,00000000), ref: 00EA5B8C
Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F07B20,?,?,00000000,?,?), ref: 00EA5BB0

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 6ce396430e1b15e67a046cfb7c113f8f7e991afd7aff0bef12b2b26226b8328e
Instruction ID: 31d709d1546cf61ef2ec0746ebdaa6edea1eb4a475bd9a1055de2673539d24e3
Opcode Fuzzy Hash: 6ce396430e1b15e67a046cfb7c113f8f7e991afd7aff0bef12b2b26226b8328e
Instruction Fuzzy Hash: 85510775A00609DFCB00EF68C4849ADF7F4FF5D320B1484A9E819AB362DB70AD85DB91

Function 00F0E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F0E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F0E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F0E8F2

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F0E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F0E91F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: a36d631b07189e1de102ff0bf09aefbcdca1cc25135597ee64da671cb86ff6bd
Instruction ID: ab6be0f09ac9ab219002bcf715b594b005f329af3791a8424d75b0dbc34b1d5e
Opcode Fuzzy Hash: a36d631b07189e1de102ff0bf09aefbcdca1cc25135597ee64da671cb86ff6bd
Instruction Fuzzy Hash: BD513F35A00205EFCF15DF64C981A6EBBF5EF4D310B1490A9E809AB3A2DB31ED15DB50

Function 00F2A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8489f6f0f6da9507007c7e7656e0e5b4cdf50c30594b620cc88fcff208d3f29e
Instruction ID: 7b7d5e6d062405fed997cfd7fc02bdd7b16d22e5f899c0fcb58f0bb8688b3518
Opcode Fuzzy Hash: 8489f6f0f6da9507007c7e7656e0e5b4cdf50c30594b620cc88fcff208d3f29e
Instruction Fuzzy Hash: 2541E235D00228AFD720DF38EC48FA9BBA8EB09320F140165F855E72E1D771AD41FA92

Function 00EA2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00EA2357
ScreenToClient.USER32(00F667B0,?), ref: 00EA2374
GetAsyncKeyState.USER32(00000001), ref: 00EA2399
GetAsyncKeyState.USER32(00000002), ref: 00EA23A7

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: a129eac47a4985e5ff261c6353ea925bb47339fdbab7400d60489cb246aa1e24
Instruction ID: 87dfb999034d47383ce7a54c0cab8fea10797c7c65e7256181e9212f3a28165a
Opcode Fuzzy Hash: a129eac47a4985e5ff261c6353ea925bb47339fdbab7400d60489cb246aa1e24
Instruction Fuzzy Hash: 1F41823150411AFBDF159FA8CC44AE9BB74FF0A364F20432AF524B62A0C7346D55DB91

Function 00EF6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00EF69A9
TranslateMessage.USER32(?), ref: 00EF69D2
DispatchMessageW.USER32(?), ref: 00EF69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF69EB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: abbf31175743ee3209ff1e7d1aa4f15812271a58755af477f4e94fee265f4fd0
Instruction ID: e71f46d66c90b927728aec90754d9b3ae05c3dd04a35c4f1a7bbf1836077b215
Opcode Fuzzy Hash: abbf31175743ee3209ff1e7d1aa4f15812271a58755af477f4e94fee265f4fd0
Instruction Fuzzy Hash: E231D67150064EABDB20CF74CC44FB67BBCEB52308F149179E621E3061D7B59889E7A0

Function 00EF8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00EF8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00EF8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00EF8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00EF8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00EF8FDA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: f884d1669bddb015239f8f3ba4d1450fb13d46232c422aa537f838e2ce7ecd11
Instruction ID: a77b6b9b2474847035ae9814e21d21db40890e133442c45c3b4f803d4e755beb
Opcode Fuzzy Hash: f884d1669bddb015239f8f3ba4d1450fb13d46232c422aa537f838e2ce7ecd11
Instruction Fuzzy Hash: 6531C07260021DEFDF14CF68DE4DAAE7BB6EB04315F104229FA25E61D0C7B09914DB91

Function 00EFB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00EFB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00EFB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00EFB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00EFB742
_wcsstr.LIBCMT ref: 00EFB74C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: e7f1ddc24acf47077f4759371ac74422ee480966f69b05ce1c2077b26d9beac7
Instruction ID: e3843403dfed809e24a5fce39b698be31ee02ede5fe60d17e6d395c3d0c955c5
Opcode Fuzzy Hash: e7f1ddc24acf47077f4759371ac74422ee480966f69b05ce1c2077b26d9beac7
Instruction Fuzzy Hash: 71210731204208BAEB256B39DD49E7B7BACDF49750F10917EFD05EA1A1EB61DC419260

Function 00F2B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

GetWindowLongW.USER32(?,000000F0), ref: 00F2B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00F2B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F2B489
GetSystemMetrics.USER32(00000004), ref: 00F2B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00F11184,00000000), ref: 00F2B4D0

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: dd04d91980922d8dcbdcae26fb06229e8c108878e75ed8140ef29364777129bc
Instruction ID: 441a3a03c5802817c1b75ea522df41005676d1e53c7458b143ef0238a430b345
Opcode Fuzzy Hash: dd04d91980922d8dcbdcae26fb06229e8c108878e75ed8140ef29364777129bc
Instruction Fuzzy Hash: 19215171910666AFCB20EF78AC84A6677A4EB05730B144639ED25D71E2E7309811EB90

Function 00EF97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EF9802

Part of subcall function 00EA7D2C: _memmove.LIBCMT ref: 00EA7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EF9834
__itow.LIBCMT ref: 00EF984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EF9874
__itow.LIBCMT ref: 00EF9885

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 2bcaaf56b16ab83d320c0a6e19e2259e0487d14dcf79180a058113bf60e8780e
Instruction ID: a694a6ac6a2249b1c1d3d662d6a871ecc989a02b886e546868d744f64c35b484
Opcode Fuzzy Hash: 2bcaaf56b16ab83d320c0a6e19e2259e0487d14dcf79180a058113bf60e8780e
Instruction Fuzzy Hash: DD21D631A0024CABDB249A658C8AFFE3BE8DF4A754F045039FA44BB242D6709D459791

Function 00EA12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EA134D
SelectObject.GDI32(?,00000000), ref: 00EA135C
BeginPath.GDI32(?), ref: 00EA1373
SelectObject.GDI32(?,00000000), ref: 00EA139C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f84416989dc6ba881d63d99428032f017038da7d414b426a46962fb615f1f754
Instruction ID: c1cdd78b0e5be76fd47d7824ea20943c67de984f4f7103c4c06dde29595a3492
Opcode Fuzzy Hash: f84416989dc6ba881d63d99428032f017038da7d414b426a46962fb615f1f754
Instruction Fuzzy Hash: 25213C7081020CEBDF119F35DC047AD7BB8EF05325F158266E821EB5A0D7B1A99AFB90

Function 00EFC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00EFC176
_memcmp.LIBCMT ref: 00EFC194
_memcmp.LIBCMT ref: 00EFC1A7
_memcmp.LIBCMT ref: 00EFC1BF
_memcmp.LIBCMT ref: 00EFC1D7

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fe75a96e5081d1422c84d76f52c06154b7dcea54dfc6d12cb1db51bbc4ecf179
Instruction ID: 5cbf1ca83d6c6166177a9f7f09812886bfa535bfd3aa38406b5569ef03a32ff4
Opcode Fuzzy Hash: fe75a96e5081d1422c84d76f52c06154b7dcea54dfc6d12cb1db51bbc4ecf179
Instruction Fuzzy Hash: 5A01B97160510D7BD204A6205E52FBB73AC9B513A8F345055FE04B7283E751EF3192E1

Function 00F04D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F04D5C
__beginthreadex.LIBCMT ref: 00F04D7A
MessageBoxW.USER32(?,?,?,?), ref: 00F04D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F04DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F04DAC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: d6fe441e6795c0ca3deccaaf7aeaba4de98f8e8d809d8fa7a91f8576ad35c33e
Instruction ID: a2a0cf7eaf8a50b84690aad3258c4ed71b626ade3840fe35267df684b889a75b
Opcode Fuzzy Hash: d6fe441e6795c0ca3deccaaf7aeaba4de98f8e8d809d8fa7a91f8576ad35c33e
Instruction Fuzzy Hash: 151108B290420DBBCB119BA8DC04A9B7FACEB49324F144369F924D3291D6B19D05A7A1

Function 00EF874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EF8766
GetLastError.KERNEL32(?,00EF822A,?,?,?), ref: 00EF8770
GetProcessHeap.KERNEL32(00000008,?,?,00EF822A,?,?,?), ref: 00EF877F
HeapAlloc.KERNEL32(00000000,?,00EF822A,?,?,?), ref: 00EF8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EF879D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 07e0d9b8586dbd17f31be27c4af62b302c623b35857f88317c2bafbe4237034b
Instruction ID: 7d51779415b08f2ed17d95035bb06dfd94ce6ad7d75a9d2301cf8a8f8b5951d4
Opcode Fuzzy Hash: 07e0d9b8586dbd17f31be27c4af62b302c623b35857f88317c2bafbe4237034b
Instruction Fuzzy Hash: A3014B71610208EFDB205FA6DD89D6B7FBCEF89755760043AF949D2260DA318C16DA60

Function 00F054E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F05502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F05510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F05518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F05522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F0555E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 9699ea3fed84f2cbda5863b007d8a0b9d59fff206c99c1310166b2827aa625b8
Instruction ID: 6d8c952155083f60eeaac140a6812da29a902e27bc1f904a44ffa38dc1e0ff93
Opcode Fuzzy Hash: 9699ea3fed84f2cbda5863b007d8a0b9d59fff206c99c1310166b2827aa625b8
Instruction Fuzzy Hash: C2016D36D10A1DDBCF10DFE8EC596EEBB78FB09B15F440066E901B2180DB709665EBA1

Function 00EF7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?,?,00EF799D), ref: 00EF766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?), ref: 00EF768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?), ref: 00EF7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?), ref: 00EF76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00EF758C,80070057,?,?), ref: 00EF76B4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 6d7d35af7ea3a778f29a0069c16c02b9fcff34486a508dd50d0a0016fce6cc14
Instruction ID: f1194cf74e73fd8659845ba116595d4d6eccc1440c91b0b1d533d2154bb9a63c
Opcode Fuzzy Hash: 6d7d35af7ea3a778f29a0069c16c02b9fcff34486a508dd50d0a0016fce6cc14
Instruction Fuzzy Hash: FF01D4B261060CBBDB208F18DC04BAABFBCEB44751F150038FE44E2211E735DD0197A0

Function 00EF85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EF8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EF8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EF8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EF8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EF863E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1b2d371558c05519ff92892410e3d097ab35fa7c215f93ccb8ef0f3747c714c2
Instruction ID: 104e0edbded421c298cf8b99b7b075b00e0c3c400874ff17bcb5ead8898a1ab2
Opcode Fuzzy Hash: 1b2d371558c05519ff92892410e3d097ab35fa7c215f93ccb8ef0f3747c714c2
Instruction Fuzzy Hash: B0F06231211208AFEB204FA5DD8DE7B3BBCEF89758B405435FA45D6150CB719C46EA60

Function 00EF8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EF8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF869F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 82e8e29b4e6532a01f376be4d8cadf0552b064230a783226ce08da4957bdea4e
Instruction ID: cfeb26d84cd7559b35530a9a95f67a3c15928aca5fb08d91803fba4c6c82e4a3
Opcode Fuzzy Hash: 82e8e29b4e6532a01f376be4d8cadf0552b064230a783226ce08da4957bdea4e
Instruction Fuzzy Hash: 06F06271210308AFEB215FA5EC88E773BBCEF89758B100035FA45D6150CB71DD46EA60

Function 00EFC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00EFC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00EFC6D1
MessageBeep.USER32(00000000), ref: 00EFC6E9
KillTimer.USER32(?,0000040A), ref: 00EFC705
EndDialog.USER32(?,00000001), ref: 00EFC71F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 4e1db6967be02f66e0152e73b54bd578f216f7e065fd1670097c8746be05344a
Instruction ID: 6743fa3ba899332d1e9d54904ecaae16e8b84745234860df7318275132dd1dba
Opcode Fuzzy Hash: 4e1db6967be02f66e0152e73b54bd578f216f7e065fd1670097c8746be05344a
Instruction Fuzzy Hash: D801443051470C97EB316B20DD4EFA67BB8FB04B05F101569B642B14E1DBE469599E80

Function 00EA13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00EA13BF
StrokeAndFillPath.GDI32(?,?,00EDBAD8,00000000,?), ref: 00EA13DB
SelectObject.GDI32(?,00000000), ref: 00EA13EE
DeleteObject.GDI32 ref: 00EA1401
StrokePath.GDI32(?), ref: 00EA141C

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ced03b799c3386a88e5e1d2ce3e624968485e59721b1bde2efe893e2f47fcb04
Instruction ID: 1739120ac8ed3bcf7cdbd19f49758b6c11ae4bffdfe572edc5775c7b8be31ba2
Opcode Fuzzy Hash: ced03b799c3386a88e5e1d2ce3e624968485e59721b1bde2efe893e2f47fcb04
Instruction Fuzzy Hash: 60F0B63001420CABDB219F7AED087583BB5AB46326F049264E439DA0F1C775599AFF50

Function 00F0C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F0C69D
CoCreateInstance.OLE32(00F32D6C,00000000,00000001,00F32BDC,?), ref: 00F0C6B5

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

CoUninitialize.OLE32 ref: 00F0C922

Strings

.lnk, xrefs: 00F0C631, 00F0C659, 00F0C663

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 1e4e4880bd356815db6ec8c083785903f2386629d2b1c075f70538213821ac64
Instruction ID: d4c646bde6c21d3baafc00b7586758d2d188ea39a9174d2b09f2b55764014a2b
Opcode Fuzzy Hash: 1e4e4880bd356815db6ec8c083785903f2386629d2b1c075f70538213821ac64
Instruction Fuzzy Hash: 24A13D71204205AFD700EF54CC81EABB7E8EF99714F00595DF196AB1A2EB70EA49CB52

Function 00EB2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00EC0FF6: std::exception::exception.LIBCMT ref: 00EC102C
Part of subcall function 00EC0FF6: __CxxThrowException@8.LIBCMT ref: 00EC1041

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EA7BB1: _memmove.LIBCMT ref: 00EA7C0B

__swprintf.LIBCMT ref: 00EB302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00EB2EC6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 69010df3fcb41b1262a216b6ca31a79b8ec9625f419728063a692ea796e83b1f
Instruction ID: 6befc885e9802cfa6f4c15b1ebbc8797aeb2c0b15537d4e53f9e49aed302dc97
Opcode Fuzzy Hash: 69010df3fcb41b1262a216b6ca31a79b8ec9625f419728063a692ea796e83b1f
Instruction Fuzzy Hash: 5291AF712083459FC718EF24D986DAFB7E4EF99750F00691DF481AB2A1DB20EE44CB52

Function 00F0BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EA48A1,?,?,00EA37C0,?), ref: 00EA48CE

CoInitialize.OLE32(00000000), ref: 00F0BC26
CoCreateInstance.OLE32(00F32D6C,00000000,00000001,00F32BDC,?), ref: 00F0BC3F
CoUninitialize.OLE32 ref: 00F0BC5C

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

Strings

.lnk, xrefs: 00F0BC08, 00F0BC16

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 612e1271b52ccdebeb9e888a639b0984aaa8d27db5a812c9fa6bae1db532cb8e
Instruction ID: 13b5b792af3acc942695c1acf013deb6bbdd7dd9b12fccc8f843e932aab99dbf
Opcode Fuzzy Hash: 612e1271b52ccdebeb9e888a639b0984aaa8d27db5a812c9fa6bae1db532cb8e
Instruction Fuzzy Hash: BAA135756043019FCB14DF14C884D6ABBE5FF89324F148998F899AB3A2CB31ED45DB91

Function 00EC524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EC52DD

Part of subcall function 00ED0340: __87except.LIBCMT ref: 00ED037B

Strings

pow, xrefs: 00EC52B5, 00EC52D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 6232bd4ff8b9fb0eb9673f091a9bc076153b93e35885257f32e14216e0f55a26
Instruction ID: 383dd538288f8ed6a6f99aa12f994b8a5e087018bdf21b78c030db84a2eed427
Opcode Fuzzy Hash: 6232bd4ff8b9fb0eb9673f091a9bc076153b93e35885257f32e14216e0f55a26
Instruction Fuzzy Hash: EA518B62A0C70586C7147718CA01BAE3BE0DB00354F287D5EF4E5623EAEE769CC7AA45

Function 00EC023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00EC0277
#, xrefs: 00EC0280

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 4497affbae459de984a2f964af09ab3046e149c232450a30b626ce315bf26d41
Instruction ID: 6d49441568f099251a37ca4b189715a2c9e39f26c4bd66d2f4290b8fc0ea961b
Opcode Fuzzy Hash: 4497affbae459de984a2f964af09ab3046e149c232450a30b626ce315bf26d41
Instruction Fuzzy Hash: 99513676106649CFCF15DF28C888AFA7BA4EF2A314F145059EE91BB2A0D7369D43C760

Function 00EB3297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EB33D7
_memmove.LIBCMT ref: 00EB3470
_free.LIBCMT ref: 00EB3496
_memmove.LIBCMT ref: 00EB3549

Strings

Oa, xrefs: 00EB3482

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa
API String ID: 2620147621-3945284152
Opcode ID: e623a754bebc824dc79015c262aa4094242cd6b989dfa1ade4fbfab84abdd47e
Instruction ID: 390b2f44257454361cab6e01ff2ba19504d85682f1e5de28fed3a88ed545050f
Opcode Fuzzy Hash: e623a754bebc824dc79015c262aa4094242cd6b989dfa1ade4fbfab84abdd47e
Instruction Fuzzy Hash: 75515BB16093419FDB24CF28C442B6BBBE5BF89314F04592DE989A7361DB31D941CB92

Function 00EB62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EB63A8
_memmove.LIBCMT ref: 00EB6446
_memset.LIBCMT ref: 00EB646A

Strings

ERCP, xrefs: 00EB6313

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 8c1766b14deb41bee38f4424b6ad33565c32a4ead510f120f0b00cc13ccf9896
Instruction ID: 465b9e7287f46245f58019f1e10c230adb4a91e82fd8adafbf114f0bcd3c5871
Opcode Fuzzy Hash: 8c1766b14deb41bee38f4424b6ad33565c32a4ead510f120f0b00cc13ccf9896
Instruction Fuzzy Hash: 8651AE71900709DBDB24CF65C881BEBBBF4FF04318F20956EEA5AEA241E7759684CB40

Function 00F27BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F2F910,00000000,?,?,?,?), ref: 00F27C4E
GetWindowLongW.USER32 ref: 00F27C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F27C7B

Strings

SysTreeView32, xrefs: 00F27C20

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 5e2f6bcb186c215455b5543e8180ea3717bb3660317e3ae97ff7ab178e919270
Instruction ID: f723999b33fdaaa4919e71683296cf45d469ea389b48e4d7f4acc6ea30566ab5
Opcode Fuzzy Hash: 5e2f6bcb186c215455b5543e8180ea3717bb3660317e3ae97ff7ab178e919270
Instruction Fuzzy Hash: 6E31E13164421AABDB219F38EC41BEA77A9EF49334F204725F975E32E0C731E855AB50

Function 00F27648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F276D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F276E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F27708

Strings

SysMonthCal32, xrefs: 00F2769B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 4917adeb79908945f81786361337e6ee9d92480b5ad5ff6534dcf8200cc70782
Instruction ID: 4c75956351674dbb7e02fcc166892fde7df73e1a35b927887b7ca0a0a5891108
Opcode Fuzzy Hash: 4917adeb79908945f81786361337e6ee9d92480b5ad5ff6534dcf8200cc70782
Instruction Fuzzy Hash: 5121E532510229BBDF11DF54DC46FEA3F79EF48724F110214FE156B1D0D6B1A855ABA0

Function 00F26F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F26FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F26FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F26FDF

Strings

Listbox, xrefs: 00F26F77

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: e9dd7ab1afada6f8575ab67de1bf46d2270cee2211fe6dd4460b33cf3be642d0
Instruction ID: 2835d780bb94c6485e645058a35761a1ad3e22757fbfc3a8e6faa35470bbf207
Opcode Fuzzy Hash: e9dd7ab1afada6f8575ab67de1bf46d2270cee2211fe6dd4460b33cf3be642d0
Instruction Fuzzy Hash: CC21A732A111287FDF118F54EC85FAB3BBAEF89764F018124FA14DB190D671AC51E7A0

Function 00F2797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F279E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F279F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F27A03

Strings

msctls_trackbar32, xrefs: 00F279B8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 580527ce8ca6dc0c40cbcaf1f7cf0f903ecc34aa55b35dd0dbe35bee2cc0a0ed
Instruction ID: 0f39338ce547b36fbe41fceff8b2592d96dbd8d5ee329be8dbb46a6a25d37337
Opcode Fuzzy Hash: 580527ce8ca6dc0c40cbcaf1f7cf0f903ecc34aa55b35dd0dbe35bee2cc0a0ed
Instruction Fuzzy Hash: 4211E732654318BADF10AF74DC05FEB77A9EF89774F010519FA41A60A0D671E851EB60

Function 00EA4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EA4C2E), ref: 00EA4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EA4CB5

Strings

kernel32.dll, xrefs: 00EA4C9E
GetNativeSystemInfo, xrefs: 00EA4CAF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: f701c42b186494a413047cca77bf57544fb6c8211159bf9e63178aae61c17828
Instruction ID: dc2cc0712680bb587f3eb76a1c0032b01ee0e5555ec80a3244185e98f7e6c39f
Opcode Fuzzy Hash: f701c42b186494a413047cca77bf57544fb6c8211159bf9e63178aae61c17828
Instruction Fuzzy Hash: 10D05B70520737CFD7305F31DE18606B6F5AF49B55B21C83ED885DA190D7B0D485D651

Function 00EA4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EA4CE1,?), ref: 00EA4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00EA4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00EA4DAE
kernel32.dll, xrefs: 00EA4D9D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 05d75eeafc3ce83ca4085092d4d8af99f97b175799ed2582b5befba48b76d974
Instruction ID: 57146eb63728f03f2038227d9d6356d09ff70ec4d015680cca4fd69c8bf17801
Opcode Fuzzy Hash: 05d75eeafc3ce83ca4085092d4d8af99f97b175799ed2582b5befba48b76d974
Instruction Fuzzy Hash: 5DD01771960723CFD7309F31E808A4676E4AF4A75DB11883AD8C6EA190E7B0E885DA51

Function 00EA4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EA4D2E,?,00EA4F4F,?,00F662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EA4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00EA4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00EA4D7B
kernel32.dll, xrefs: 00EA4D6A

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 585b14d7f9f8a7d359343e5c161ea9359c29aa067b86996e1bbbc5d0d4a56895
Instruction ID: 0f9d86e01e4420f8efc3e29fcc2c2b586297603b8b29cdabf351ecf67ac2a9eb
Opcode Fuzzy Hash: 585b14d7f9f8a7d359343e5c161ea9359c29aa067b86996e1bbbc5d0d4a56895
Instruction Fuzzy Hash: 30D01270520713CFD7305F31D80861676E8AF59756B51883A9486DA290E7B0E484DA51

Function 00F21072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00F212C1), ref: 00F21080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F21092

Strings

RegDeleteKeyExW, xrefs: 00F2108C
advapi32.dll, xrefs: 00F2107B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d1bc083e5bb3efba68da9b276777c62b5217c8f58f175f077c8ed67d5986895b
Instruction ID: 44fc7401c2792c26df84c22bddd03d206026f98e55fbfb43bf4898446ceffa4b
Opcode Fuzzy Hash: d1bc083e5bb3efba68da9b276777c62b5217c8f58f175f077c8ed67d5986895b
Instruction Fuzzy Hash: D6D01230910722CFD7309F35D81852676F4AF15762F118C3AA885DA550D770C4C4E751

Function 00F193F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00F19009,?,00F2F910), ref: 00F19403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F19415

Strings

GetModuleHandleExW, xrefs: 00F1940F
kernel32.dll, xrefs: 00F193FE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 889862624fd05c7ba42f5bacacba557e50d53b65d3d148626ef932327ba5920b
Instruction ID: ad04ab6a8b3a1aaa93540ad5da5a8b1eb898314b52869edf0fb3cfe627dff069
Opcode Fuzzy Hash: 889862624fd05c7ba42f5bacacba557e50d53b65d3d148626ef932327ba5920b
Instruction Fuzzy Hash: AAD0C730924327CFC7308F30DA0824376E4AF08362B00C83AA882C6550E6B0E8C8EA91

Function 00EE1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00EE1B42
__swprintf.LIBCMT ref: 00EE1B73

Strings

WIN_XPe, xrefs: 00EE1BB2
%.3d, xrefs: 00EE1B4D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 50b689cd31bfc0e7e9cabda965f5683061e57f2c9a501acb48e8ee408c0e00a5
Instruction ID: 22af564cbbb0471ace01a75f127ac6a8f986011c41e505df8dfaed90da2c5083
Opcode Fuzzy Hash: 50b689cd31bfc0e7e9cabda965f5683061e57f2c9a501acb48e8ee408c0e00a5
Instruction Fuzzy Hash: A8D012B580415DEACB589AA19C44DFA737CA708301F5025D2B902B1040F3359BD5AB22

Function 00EF76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0739d75cf469e5e8675fc496c5829f5ec0f6c150d315af783063e19121320913
Instruction ID: 03c3651ed6cf92ceb44ed3124e4c6ddf57ac7a6306d6f6bdd480ff89612ae5e6
Opcode Fuzzy Hash: 0739d75cf469e5e8675fc496c5829f5ec0f6c150d315af783063e19121320913
Instruction Fuzzy Hash: A6C18E74A0421AEFCB14DF94C884EBEB7B5FF88714B119599E985EB250D730DD81CB90

Function 00F1E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F1E3D2
CharLowerBuffW.USER32(?,?), ref: 00F1E415

Part of subcall function 00F1DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F1DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00F1E615
_memmove.LIBCMT ref: 00F1E628

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: b1d1fc7a778b7b37aa8a95a1fac9d44c7c42ec634b3b5ded2699ffe683e721e3
Instruction ID: 13c60bacdc901393827e281e68a5edd67d78b5ce20c91a43cfac00d636a5ff8e
Opcode Fuzzy Hash: b1d1fc7a778b7b37aa8a95a1fac9d44c7c42ec634b3b5ded2699ffe683e721e3
Instruction Fuzzy Hash: 45C15C71A083419FC714DF28C480A5ABBE5FF89714F14896EF899DB351D731E986CB82

Function 00F183A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F183D8
CoUninitialize.OLE32 ref: 00F183E3

Part of subcall function 00EFDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00EFDAC5

VariantInit.OLEAUT32(?), ref: 00F183EE
VariantClear.OLEAUT32(?), ref: 00F186BF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 0d2af537e53357d76246713622ef298e6ed310979d7f31c7d03f944b545229b5
Instruction ID: 0ae6059802bb8f79f7ffd1e73490618eeb247364340ff0df0713127e6460bd91
Opcode Fuzzy Hash: 0d2af537e53357d76246713622ef298e6ed310979d7f31c7d03f944b545229b5
Instruction Fuzzy Hash: 4EA135356047019FCB10DF14C981B6ABBE5BF89364F184459F99AAB3A2CB30FD45DB82

Function 00EF7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F32C7C,?), ref: 00EF7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F32C7C,?), ref: 00EF7C4A
CLSIDFromProgID.OLE32(?,?,00000000,00F2FB80,000000FF,?,00000000,00000800,00000000,?,00F32C7C,?), ref: 00EF7C6F
_memcmp.LIBCMT ref: 00EF7C90

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 8765eb2e71a747e899758b5daf83e7d91c2e03dafb4160699831040e80e95576
Instruction ID: 913dafff2b685871f6216c6eade14b229e2a9773a3ac71c11d525985d9e9bd88
Opcode Fuzzy Hash: 8765eb2e71a747e899758b5daf83e7d91c2e03dafb4160699831040e80e95576
Instruction Fuzzy Hash: F9810B75A00109EFCB04DF94C984EEEB7BAFF89315F244198E555BB250DB71AE06CB60

Function 00EF6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EF6E04
SysAllocString.OLEAUT32(00000000), ref: 00EF6EAD
VariantCopy.OLEAUT32 ref: 00EF6EDC
VariantClear.OLEAUT32(?), ref: 00EF6F03

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 6bc9622ee1d88066bf416bff62949500ed22ede4a6a16d01eab52b6f16a317c7
Instruction ID: d06d6b65df8db659ad020803b0362f3b6ac6f0d7368c546652bdfb8538c5b009
Opcode Fuzzy Hash: 6bc9622ee1d88066bf416bff62949500ed22ede4a6a16d01eab52b6f16a317c7
Instruction Fuzzy Hash: D851AA317043099BDB30AF65D891A7EF3E5AF49310F20A82FE696EB291DF7098449B11

Function 00F29A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0117E868,?), ref: 00F29AD2
ScreenToClient.USER32(00000002,00000002), ref: 00F29B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00F29B72

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 108fcc94b92341a1928885f73bc85a5dad3f142156878159c1adbfecc2ada6f6
Instruction ID: 5fe8e6d893d05afde0df6833ead3b2a6f0d6a2ee9bde232c85c414a9c6c0a93e
Opcode Fuzzy Hash: 108fcc94b92341a1928885f73bc85a5dad3f142156878159c1adbfecc2ada6f6
Instruction Fuzzy Hash: D2513134A04219EFCF14DF68E9819AE7BB5FF85320F148169F8659B290D770AE41EB90

Function 00F16CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F16CE4
WSAGetLastError.WSOCK32(00000000), ref: 00F16CF4

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F16D58
WSAGetLastError.WSOCK32(00000000), ref: 00F16D64

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 2d3376771f32edcd8ee28d634d7821120999cc06b783ef747a886770b95bd405
Instruction ID: f1d2718806040ef8b6c27c233af6ef234c7546a956c80701e0cd2fde2263ee1a
Opcode Fuzzy Hash: 2d3376771f32edcd8ee28d634d7821120999cc06b783ef747a886770b95bd405
Instruction Fuzzy Hash: 9641B375B40200AFEB20AF24DC86F7A77E59B49B14F448018FA59AF2D3DB71AC019791

Function 00F1672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00F2F910), ref: 00F167BA
_strlen.LIBCMT ref: 00F167EC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 9efdf06510c9af7e01d6d3233a3b7ffc1572bc75cb8d1866a175ebfeaffc8c1c
Instruction ID: d9efaf03848949bea5384739d3bd6a1abd282a400e1506df9369b142b79c55fe
Opcode Fuzzy Hash: 9efdf06510c9af7e01d6d3233a3b7ffc1572bc75cb8d1866a175ebfeaffc8c1c
Instruction Fuzzy Hash: 4E41C431A00504ABCB14EB64DCC1FFEB3E9AF48324F148169F819EB292DB30AD85D750

Function 00F0BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F0BB09
GetLastError.KERNEL32(?,00000000), ref: 00F0BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F0BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F0BB80

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 5bbe776742e94b9a8d824031c40a11eacb34c9084013b3b706bf05532c633251
Instruction ID: 566d70a4ac38410ee6dd2c7fb72fd67039972cc2b14b4bd34995a849d36678cd
Opcode Fuzzy Hash: 5bbe776742e94b9a8d824031c40a11eacb34c9084013b3b706bf05532c633251
Instruction Fuzzy Hash: C9411B39600611DFCB10DF15C584A59BBE1AF8E320B099498EC4AAF3A2CB34FD01EB91

Function 00F28AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F28B4D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 3a584840f946659fa269251e7ea7fd4cfbeff14d84303d645a496a59754f5bb0
Instruction ID: 4aacf7c3c6686e9a6d7c9d576eecb98b0e12c88831d53d630f6bb7f1cc8b91b0
Opcode Fuzzy Hash: 3a584840f946659fa269251e7ea7fd4cfbeff14d84303d645a496a59754f5bb0
Instruction Fuzzy Hash: 85310B75A02228BFEF309F18EC45FA93764EB493A0F14451AFA11D72A1CF34A942BB41

Function 00F2ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F2AE1A
GetWindowRect.USER32(?,?), ref: 00F2AE90
PtInRect.USER32(?,?,00F2C304), ref: 00F2AEA0
MessageBeep.USER32(00000000), ref: 00F2AF11

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 43022402a1ce2f46a38ee6502e6385d778ef03326b2eeabb85b5b16ed66c7462
Instruction ID: e02de877a68a65c93379d89d7b3c544f03f16e3c5dbca2f4775ca2b35dff93aa
Opcode Fuzzy Hash: 43022402a1ce2f46a38ee6502e6385d778ef03326b2eeabb85b5b16ed66c7462
Instruction Fuzzy Hash: A141A570A00529DFCB11CF69E984B59BBF5FF88350F1581A9E424DB255D770E802EF92

Function 00F00FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F01037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00F01053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00F010B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00F0110B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: fcc376fba1082d11a5382b6c33431c506b1fdef02c45232dbd9544b17cc1d8c0
Instruction ID: bb032b32ef2a643232d58998ec7d74d3e1c509a5c87115a061a40099096a6dd0
Opcode Fuzzy Hash: fcc376fba1082d11a5382b6c33431c506b1fdef02c45232dbd9544b17cc1d8c0
Instruction Fuzzy Hash: 4C313331E4068CAEFB348B658C05BFABBA9BF45320F48432AE5C1521D1C77989C5B761

Function 00F01121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00F01176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F01192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F011F1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00F01243

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 34aa425906aa5f4750e7e0904d0bd8d2ea588c5839c0b7a24e1bf0f8a35ea9bf
Instruction ID: deeb213d0a1acf8fb24400ee788de04c2d95f1bf570d5b858eb57e1bc5694ba7
Opcode Fuzzy Hash: 34aa425906aa5f4750e7e0904d0bd8d2ea588c5839c0b7a24e1bf0f8a35ea9bf
Instruction Fuzzy Hash: FB310530E4060CAAFF388B658C05BFABBBEBB49324F18431AE581921D1C3398995B751

Function 00ED6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00ED644B
__isleadbyte_l.LIBCMT ref: 00ED6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00ED64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00ED64DD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 727bb1b5c13b800b13da8b8ea0655a5f7c63772e74c4dd3a36697456af67adb6
Instruction ID: ac844503037148cd847319936a36d2c9b15c56aea53ae4a9d4f6c628bb185022
Opcode Fuzzy Hash: 727bb1b5c13b800b13da8b8ea0655a5f7c63772e74c4dd3a36697456af67adb6
Instruction Fuzzy Hash: FA31CF31600246AFDB218F75C945BAA7BB9FF40314F15942AE864A72A1EB31D892DB90

Function 00F25175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F25189

Part of subcall function 00F0387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F03897
Part of subcall function 00F0387D: GetCurrentThreadId.KERNEL32 ref: 00F0389E
Part of subcall function 00F0387D: AttachThreadInput.USER32(00000000,?,00F052A7), ref: 00F038A5

GetCaretPos.USER32(?), ref: 00F2519A
ClientToScreen.USER32(00000000,?), ref: 00F251D5
GetForegroundWindow.USER32 ref: 00F251DB

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 859034cdadf084fedaa8654d56bbe6aa7eac4e221bb8b6283db949c373a3d9e6
Instruction ID: 48b9556f814a09cbc05de9510111f747ac190f01bef4397093f7c19db1ca643a
Opcode Fuzzy Hash: 859034cdadf084fedaa8654d56bbe6aa7eac4e221bb8b6283db949c373a3d9e6
Instruction Fuzzy Hash: 36310E72900108AFDB10EFA5CC859EFB7FDEF99300F10506AE415E7252EA75AE45DBA0

Function 00F2C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

GetCursorPos.USER32(?), ref: 00F2C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00EDBBFB,?,?,?,?,?), ref: 00F2C7D7
GetCursorPos.USER32(?), ref: 00F2C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00EDBBFB,?,?,?), ref: 00F2C85E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 26906fdc6571f70ed2013b79b2647d117e965a792d926a4d87f408e141ea3198
Instruction ID: 2004d67d62ae3eb917a74a98001dc7e92e8076bf1babead986d9836e4802603f
Opcode Fuzzy Hash: 26906fdc6571f70ed2013b79b2647d117e965a792d926a4d87f408e141ea3198
Instruction Fuzzy Hash: 58318535900028AFCB25CF58D898EEE7BB6EF49320F444169F9059B261C7315D51EFA0

Function 00EC0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00EC0BF2

Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F07B20,?,?,00000000), ref: 00EA5B8C
Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F07B20,?,?,00000000,?,?), ref: 00EA5BB0

_fprintf.LIBCMT ref: 00EC0C29
OutputDebugStringW.KERNEL32(?), ref: 00EF6331

Part of subcall function 00EC4CDA: _flsall.LIBCMT ref: 00EC4CF3

__setmode.LIBCMT ref: 00EC0C5E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 1a41e3230253f5d7229571fa09c5a481e2dff3e80faff4cc8bff5c50cf45b1ea
Instruction ID: 8dab8d02e864b0f5e9bf5ed98629a26040c3eef1db6e714af4d02e065421d111
Opcode Fuzzy Hash: 1a41e3230253f5d7229571fa09c5a481e2dff3e80faff4cc8bff5c50cf45b1ea
Instruction Fuzzy Hash: 5E113A72904208BBCB04B7B49D43EFEBBA99F86320F14211EF204B71D2DE225D475795

Function 00EF8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EF8669
Part of subcall function 00EF8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8673
Part of subcall function 00EF8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8682
Part of subcall function 00EF8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF8689
Part of subcall function 00EF8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EF869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00EF8BEB
_memcmp.LIBCMT ref: 00EF8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EF8C44
HeapFree.KERNEL32(00000000), ref: 00EF8C4B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4e205a2e3718b70bc63a1301470fded32366abf1eeb493b54596463cc7a709b7
Instruction ID: bee56d64cf2614d57cd7f62769b16ab773e3bb88bc4d7f353fe2a1087122d258
Opcode Fuzzy Hash: 4e205a2e3718b70bc63a1301470fded32366abf1eeb493b54596463cc7a709b7
Instruction Fuzzy Hash: AD218971E0120CABCB10CFA4CA45BFEB7B8EF50348F1440A9E654AB241DB31AA06DB61

Function 00F11A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F11A97

Part of subcall function 00F11B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F11B40
Part of subcall function 00F11B21: InternetCloseHandle.WININET(00000000), ref: 00F11BDD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 5d5f6e6ab4083238f9a8b9bfa8c1bcd6fe9d6c06d502be21caf94c8102b7e2fd
Instruction ID: 09b19c2f1739bd4f879ebd82dfa4cd39a09eba788dc1e094a46fe110caa58fe7
Opcode Fuzzy Hash: 5d5f6e6ab4083238f9a8b9bfa8c1bcd6fe9d6c06d502be21caf94c8102b7e2fd
Instruction Fuzzy Hash: 6D21C236204604BFEB219F608C00FFBBBB9FF84710F10002AFA4196550E7359865B790

Function 00EFE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00EFE1C4,?,?,?,00EFEFB7,00000000,000000EF,00000119,?,?), ref: 00EFF5BC
Part of subcall function 00EFF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00EFF5E2
Part of subcall function 00EFF5AD: lstrcmpiW.KERNEL32(00000000,?,00EFE1C4,?,?,?,00EFEFB7,00000000,000000EF,00000119,?,?), ref: 00EFF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00EFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00EFE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00EFE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00EFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00EFE237

Strings

cdecl, xrefs: 00EFE22E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1e0d73efbb6a09f0bb1dfdebb3b50f69010b62edb18d9e658a6ec9fd0c3150e4
Instruction ID: 16031dc204b2907cb159729bc0ae694143a07e1c28ffa892f4d7dcd04b6865a1
Opcode Fuzzy Hash: 1e0d73efbb6a09f0bb1dfdebb3b50f69010b62edb18d9e658a6ec9fd0c3150e4
Instruction Fuzzy Hash: CA118136200349EFDB25AF64D845E7A77B8FF85354B80602AE906DB270FB71A85197A0

Function 00ED5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00ED5351

Part of subcall function 00EC594C: __FF_MSGBANNER.LIBCMT ref: 00EC5963
Part of subcall function 00EC594C: __NMSG_WRITE.LIBCMT ref: 00EC596A
Part of subcall function 00EC594C: RtlAllocateHeap.NTDLL(01160000,00000000,00000001,00000000,?,?,?,00EC1013,?), ref: 00EC598F

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 03166e4c8d0ea14753802231eca21c3e0d2f20c0c236b4cc9d0ad7c04dbf4dff
Instruction ID: 7c87d2ea73650017c1ddc95d48c602348fad44e63b8dd695f4228dd34624361d
Opcode Fuzzy Hash: 03166e4c8d0ea14753802231eca21c3e0d2f20c0c236b4cc9d0ad7c04dbf4dff
Instruction Fuzzy Hash: 9211C433504A19AFCB312F70AE04B6D3BE8DF107E4B10642FF945BA294DEB689439790

Function 00EA4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EA4560

Part of subcall function 00EA410D: _memset.LIBCMT ref: 00EA418D
Part of subcall function 00EA410D: _wcscpy.LIBCMT ref: 00EA41E1
Part of subcall function 00EA410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EA41F1

KillTimer.USER32(?,00000001,?,?), ref: 00EA45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EA45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EDD6CE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: e622574d94591fa933824d346f6dbb0c9099fa3c078040a8aa06d2f3dab6c0a0
Instruction ID: 4c367c06d572f4c377a83ab43f6543d524e461c122f95e4ac9ef56394d5b44ce
Opcode Fuzzy Hash: e622574d94591fa933824d346f6dbb0c9099fa3c078040a8aa06d2f3dab6c0a0
Instruction Fuzzy Hash: 5321DDB09087449FEB328B24DC55BE7BFECDF45308F04109EE69D6A281C7B46A899B51

Function 00F1667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F07B20,?,?,00000000), ref: 00EA5B8C
Part of subcall function 00EA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F07B20,?,?,00000000,?,?), ref: 00EA5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00F166AC
WSAGetLastError.WSOCK32(00000000), ref: 00F166B7
_memmove.LIBCMT ref: 00F166E4
inet_ntoa.WSOCK32(?), ref: 00F166EF

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 438687b3128e848069ee8382a7c5ed3589127a15429d0e8dd2a0b16417ead4d2
Instruction ID: d759ad36a705febef5c4f350f7bee7ff48f99feb9de3fa5ac510ce091dc87eac
Opcode Fuzzy Hash: 438687b3128e848069ee8382a7c5ed3589127a15429d0e8dd2a0b16417ead4d2
Instruction Fuzzy Hash: 96116036900508AFCB00EBA4DD86DEEB7F8AF09310B144069F506BB1A2DF30AE45DB61

Function 00EF9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00EF9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EF9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EF906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EF9086

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 738b3cd10647010c6cf422603da507e66a04512307d5203e9594bf7c38cc9815
Instruction ID: 64fefe8071163372bb07a074a4ec9b29f4d2fd823d4caf1077da03a38ff4c0f3
Opcode Fuzzy Hash: 738b3cd10647010c6cf422603da507e66a04512307d5203e9594bf7c38cc9815
Instruction Fuzzy Hash: 36115E79900218FFDB10DFA5CC84FADBBB4FB48310F2040A5EA04B7290DA726E10DB90

Function 00EA1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00EA2612: GetWindowLongW.USER32(?,000000EB), ref: 00EA2623

DefDlgProcW.USER32(?,00000020,?), ref: 00EA12D8
GetClientRect.USER32(?,?), ref: 00EDB84B
GetCursorPos.USER32(?), ref: 00EDB855
ScreenToClient.USER32(?,?), ref: 00EDB860

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5e2e20f9d3b1bf76a1b574b18a8b6f77eafcf5914d4ab0b7b41025b403e8702d
Instruction ID: 06a0c819afdbe7db9e4761bfb9bbeb355c44e67ca25939f82d16ebee63d2d8a7
Opcode Fuzzy Hash: 5e2e20f9d3b1bf76a1b574b18a8b6f77eafcf5914d4ab0b7b41025b403e8702d
Instruction Fuzzy Hash: 1A110D3951001DAFCB10DFA4D985AEE7BB8EB0A301F5004A5F911EB151D730BA56ABB5

Function 00F01652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F001FD,?,00F01250,?,00008000), ref: 00F0166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00F001FD,?,00F01250,?,00008000), ref: 00F01694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F001FD,?,00F01250,?,00008000), ref: 00F0169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00F001FD,?,00F01250,?,00008000), ref: 00F016D1

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d80b134943553bf60ed659ccad1c826bdd24ded82131f531cff419c032bcc6a6
Instruction ID: 9466b4a0603682ff1cf47ed4e9e195470ec014ce3ff70a941bce67cd282bfd59
Opcode Fuzzy Hash: d80b134943553bf60ed659ccad1c826bdd24ded82131f531cff419c032bcc6a6
Instruction Fuzzy Hash: 78113932C1052DEBCF109FA5DD48BEEBB78FF09751F45406AE940B6280CB329561BB96

Function 00ED7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00ED722B

Part of subcall function 00ED7912: __fltout2.LIBCMT ref: 00ED793B

__cftog_l.LIBCMT ref: 00ED7251
__cftoe_l.LIBCMT ref: 00ED7283

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 71f705dd27a79da86b9624d904b061a4c0a10f531f51fde03837e0b9f60602a9
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0201437604418ABBCF125F84CC018EE3F62FF59355B559516FE5868231E237C972AB81

Function 00F2B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F2B59E
ScreenToClient.USER32(?,?), ref: 00F2B5B6
ScreenToClient.USER32(?,?), ref: 00F2B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F2B5F5

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: a41bae7e811d35ded3ffc1a273ea83516d4b272d55171d9c433cc087c7cde8c6
Instruction ID: 519d114e4a5742031dd1e843243c620234131489c168242ab68c83fc30518783
Opcode Fuzzy Hash: a41bae7e811d35ded3ffc1a273ea83516d4b272d55171d9c433cc087c7cde8c6
Instruction Fuzzy Hash: B91163B9D0020DEFDB11CFA9D8849EEFBB9FB08310F108166E914E3220D731AA559F91

Function 00F2B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F2B8FE
_memset.LIBCMT ref: 00F2B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00F67F20,00F67F64), ref: 00F2B93C
CloseHandle.KERNEL32 ref: 00F2B94E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 4248858fe2f19b3a142e98012c7e40eb3013fe9fe4a6efa51e5d5516fae84dd7
Instruction ID: 6d7a788b4add74df36962205a48b7f89a225204408c1f95e51e3446236d5591f
Opcode Fuzzy Hash: 4248858fe2f19b3a142e98012c7e40eb3013fe9fe4a6efa51e5d5516fae84dd7
Instruction Fuzzy Hash: 51F05EB25543187BF2207771AC16FBB3A9CEB09358F004030FA18E5192D7B24D01A7E8

Function 00F06E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00F06E88

Part of subcall function 00F0794E: _memset.LIBCMT ref: 00F07983

_memmove.LIBCMT ref: 00F06EAB
_memset.LIBCMT ref: 00F06EB8
LeaveCriticalSection.KERNEL32(?), ref: 00F06EC8

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 907904f541573b0c3831dff9db405cdbca5846f409c5079be99f6abc36355da8
Instruction ID: a054d3bef124f8d21ab8a37ff121d50de44b6488973ed5e4e2103444e8fb9eba
Opcode Fuzzy Hash: 907904f541573b0c3831dff9db405cdbca5846f409c5079be99f6abc36355da8
Instruction Fuzzy Hash: 9DF0543A100204ABCF116F55DC85F89BB69EF45360B04C065FE085E25BC736E912EBB4

Function 00F2C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00EA12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EA134D
Part of subcall function 00EA12F3: SelectObject.GDI32(?,00000000), ref: 00EA135C
Part of subcall function 00EA12F3: BeginPath.GDI32(?), ref: 00EA1373
Part of subcall function 00EA12F3: SelectObject.GDI32(?,00000000), ref: 00EA139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F2C030
LineTo.GDI32(00000000,?,?), ref: 00F2C03D
EndPath.GDI32(00000000), ref: 00F2C04D
StrokePath.GDI32(00000000), ref: 00F2C05B

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d7af8153c8de1f3a22a714517d738a9de07f4c13256a937b55b6aaea957d2e63
Instruction ID: b44cacb4d9d4e706b2005ba4edea8a8fc13d47baf0288e4767926df0aed621b6
Opcode Fuzzy Hash: d7af8153c8de1f3a22a714517d738a9de07f4c13256a937b55b6aaea957d2e63
Instruction Fuzzy Hash: 9BF0893100525DF7DB229F65AC09FCE3FA5AF06721F144010FA11A50E287B55565FFD9

Function 00EFA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00EFA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFA3AC
GetCurrentThreadId.KERNEL32 ref: 00EFA3B3
AttachThreadInput.USER32(00000000), ref: 00EFA3BA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: fdc8d2b75ee7c80daca1e1bc59a9b0469b97d81f9c9af95d73fdd0e43c00281c
Instruction ID: 164409d1d7211c2874aa705e3e0d648a86d3bd97af61d2dad742deb3ff8d789a
Opcode Fuzzy Hash: fdc8d2b75ee7c80daca1e1bc59a9b0469b97d81f9c9af95d73fdd0e43c00281c
Instruction Fuzzy Hash: 09E0397154222CBADB201FA2DD0CEEB3F6CEF167A1F048034F60898060C6759545EBA1

Function 00EA2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EA2231
SetTextColor.GDI32(?,000000FF), ref: 00EA223B
SetBkMode.GDI32(?,00000001), ref: 00EA2250
GetStockObject.GDI32(00000005), ref: 00EA2258
GetWindowDC.USER32(?,00000000), ref: 00EDC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00EDC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00EDC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00EDC112
GetPixel.GDI32(00000000,?,?), ref: 00EDC132
ReleaseDC.USER32(?,00000000), ref: 00EDC13D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 49410b7dda74247e185fbffcd5d6364ff59e734e1c01dc64a4a09745be7408e3
Instruction ID: a7ee8c4953b65c71d2bb7726fb14e6b1779e8b11a0d11b2471508d5df099f41f
Opcode Fuzzy Hash: 49410b7dda74247e185fbffcd5d6364ff59e734e1c01dc64a4a09745be7408e3
Instruction Fuzzy Hash: A3E03031510148EADB215F64EC09BD83B20EB05336F148376FA69980E187714596EB11

Function 00EF8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00EF8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00EF882E), ref: 00EF8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00EF882E), ref: 00EF8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00EF882E), ref: 00EF8C7E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 372f1ca78ea5ec8431f75f206153b66866fe1ffb335dc996c4ac32d5f822fa4f
Instruction ID: 0ce2c18de19cde96e0391f79aaa762a7d06babafebc66afc5acf5c18605545ae
Opcode Fuzzy Hash: 372f1ca78ea5ec8431f75f206153b66866fe1ffb335dc996c4ac32d5f822fa4f
Instruction Fuzzy Hash: 19E02632612214DBD7309FB06E0DF563BBCEF10792F054838B241DA080DB34844ADB21

Function 00EE2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00EE2187
GetDC.USER32(00000000), ref: 00EE2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EE21B1
ReleaseDC.USER32(?), ref: 00EE21D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e775f7a8a73d1606378c812147c1bd2ddb31b3ba7669c7b68f5e1d3da2f5c7b4
Instruction ID: c19e4286bae6f741234282f1c878f22aacf9a77b0e9dc7f16cd1ffeba0ea6a10
Opcode Fuzzy Hash: e775f7a8a73d1606378c812147c1bd2ddb31b3ba7669c7b68f5e1d3da2f5c7b4
Instruction Fuzzy Hash: A6E01AB5810208EFDB219FB0C908A9D7FF5EB4C350F10842AF95AE7220DB389146AF40

Function 00EE219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00EE219B
GetDC.USER32(00000000), ref: 00EE21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EE21B1
ReleaseDC.USER32(?), ref: 00EE21D2

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: b227b51393b6bdc68e3e65506a8fd7d073fdc0e796eea5bb5564f17ec045ac0b
Instruction ID: 7dd7d26f5f4f2a7033c3c1d481f8a59d1f333e90bad7a64e49a04a8beb38c096
Opcode Fuzzy Hash: b227b51393b6bdc68e3e65506a8fd7d073fdc0e796eea5bb5564f17ec045ac0b
Instruction Fuzzy Hash: 9FE01A75810208AFCB219FB0C90869D7FF1EB4C310F108025F95AE7220DB389146AF40

Function 00EFB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00EFB981

Strings

AutoIt3GUI, xrefs: 00EFB8F9
Container, xrefs: 00EFB8FE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 2bbc52da084bba9d05f530fd7712960fa8498ccca52c03129a4641bdbbf53e6c
Instruction ID: f6be55810e36bef212654a7a1d0cc5434824762bd14c8908c8faa1300e3d3c1d
Opcode Fuzzy Hash: 2bbc52da084bba9d05f530fd7712960fa8498ccca52c03129a4641bdbbf53e6c
Instruction Fuzzy Hash: 299159706006059FDB64CF28C884A7ABBF9FF48710F14956EFA4ADB291DBB1E841CB50

Function 00F0B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBFEC6: _wcscpy.LIBCMT ref: 00EBFEE9

Part of subcall function 00EA9997: __itow.LIBCMT ref: 00EA99C2
Part of subcall function 00EA9997: __swprintf.LIBCMT ref: 00EA9A0C

__wcsnicmp.LIBCMT ref: 00F0B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F0B361

Strings

LPT, xrefs: 00F0B292

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: c6ce168c20962f76bfc57d13a8b367e79a95b06e015e5a8f6368eaea33d9d2cf
Instruction ID: 6090e4864f5e3548ee829dd108315156f3b3ffe6fa89cf8a6b7dd2395af69b38
Opcode Fuzzy Hash: c6ce168c20962f76bfc57d13a8b367e79a95b06e015e5a8f6368eaea33d9d2cf
Instruction Fuzzy Hash: DE616E76E00219EFCB14DF94C885EAEB7F4AF49310F15406AF946AB291DB70AE44EB50

Function 00EE8A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE8B1E
_memmove.LIBCMT ref: 00EE8B78

Strings

Oa, xrefs: 00EE8BF2, 00EEE39A, 00EEE3B6

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _memmove
String ID: Oa
API String ID: 4104443479-3945284152
Opcode ID: 5bd5230f5123346f3e0a6e5bbca1cb499f3528fce77ef25e7a715c2f744c5273
Instruction ID: 93b27bcee04f230ee1a60aaeb67d720f5cea1af00efb92de560c7f47fad443ad
Opcode Fuzzy Hash: 5bd5230f5123346f3e0a6e5bbca1cb499f3528fce77ef25e7a715c2f744c5273
Instruction Fuzzy Hash: BC518FB490064DDFCB64CF69C980AEEBBF1FF45308F10552AE85AE7241EB31A955CB50

Function 00EB2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00EB2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00EB2AE1

Strings

@, xrefs: 00EB2AD5

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 18307ef0da1afdc50bf6dc28da9f34ef0ff6b8a37f636273d470f92b9893fee9
Instruction ID: 0c528b97af4bdb7efc7f8f94fcdbc6afbc25d1add3c5c66b5859f0d190d30b5c
Opcode Fuzzy Hash: 18307ef0da1afdc50bf6dc28da9f34ef0ff6b8a37f636273d470f92b9893fee9
Instruction Fuzzy Hash: DD5149715187489BD320AF10D885BAFB7F8FFC9310F42485DF1D9651A2EB30A929CB16

Function 00F099BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00EA506B: __fread_nolock.LIBCMT ref: 00EA5089

_wcscmp.LIBCMT ref: 00F09AAE
_wcscmp.LIBCMT ref: 00F09AC1

Strings

FILE, xrefs: 00F099FA

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 0d5875c3b60faf4fb2ab60e025b3b31b8efadfb0ce040bfbffd2a7d0f3f4343f
Instruction ID: 7ef086452b8a4a0572796601e99b9b5cd2482929e309dbe3dfce78e186361d3f
Opcode Fuzzy Hash: 0d5875c3b60faf4fb2ab60e025b3b31b8efadfb0ce040bfbffd2a7d0f3f4343f
Instruction Fuzzy Hash: 4441DC72A04619BADF209AA4DC85FEF77FDDF49710F00407AF900BB1C1D6B5AA05A7A1

Function 00F12882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F12892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F128C8

Strings

|, xrefs: 00F12899

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: c62af2e367e04dd973e19d7855a113d85b9c7eb4fc545ba9444cbaa6011901d7
Instruction ID: e35ae364377b2ca7a2cdb2f11869d9090e898c4e94a0839e87102b3774fec050
Opcode Fuzzy Hash: c62af2e367e04dd973e19d7855a113d85b9c7eb4fc545ba9444cbaa6011901d7
Instruction Fuzzy Hash: 0C313971800119AFCF05EFA5DC85EEEBFB9FF09310F005069F854BA166DA315A56EBA0

Function 00F26CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00F26D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F26DC2

Strings

static, xrefs: 00F26D22

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 663e806abce609c0013c71ebd660c9b0716b69a12501f2be86bac10d00e6eb16
Instruction ID: 891fd134a57951418ddd0e4ea315068883ecf80d22a2da5e6b6a53e54b6459a7
Opcode Fuzzy Hash: 663e806abce609c0013c71ebd660c9b0716b69a12501f2be86bac10d00e6eb16
Instruction Fuzzy Hash: BD319E71610218AADB109F74DC80AFB77B9FF48720F509629F9A5D7190DA31AC92EB60

Function 00F02D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F02E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F02E3B

Strings

0, xrefs: 00F02DF9

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 63e0c82f636b2f4aa698ed7fa41abc46286d68db054da1f3877d5974858fd6cd
Instruction ID: d637590363b807a0f27c5f382ef7de87bb2d8131a7dd43e29689461048eae5e9
Opcode Fuzzy Hash: 63e0c82f636b2f4aa698ed7fa41abc46286d68db054da1f3877d5974858fd6cd
Instruction Fuzzy Hash: F231D531A40309ABEB648F58C949BAEBBF9FF05360F14406EED85A61E1D7709944FB60

Function 00F26943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F269D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F269DB

Strings

Combobox, xrefs: 00F2699D

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 45241956cf3a7e37f474dac6284793a7c098a067b4a072875d361d2758916274
Instruction ID: e3fad8268556b605509bc8466a6a4aa7bce5e95353029a6df474d149e8f52304
Opcode Fuzzy Hash: 45241956cf3a7e37f474dac6284793a7c098a067b4a072875d361d2758916274
Instruction Fuzzy Hash: BE11C471B002197FEF119F14EC90FFB376AEB893A4F110124F958DB290DA759C91A7A0

Function 00F26E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00EA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EA1D73
Part of subcall function 00EA1D35: GetStockObject.GDI32(00000011), ref: 00EA1D87
Part of subcall function 00EA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EA1D91

GetWindowRect.USER32(00000000,?), ref: 00F26EE0
GetSysColor.USER32(00000012), ref: 00F26EFA

Strings

static, xrefs: 00F26EBD

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4e6ecb6a1d271e1dffc8568d2fcee090f56a7a4500a94df4a6088c6e7521ab6d
Instruction ID: 0ae12dc126e3ce5e113eece8ca943cde513a0b5fd2ba0ce0cdc25af74ad7eaa8
Opcode Fuzzy Hash: 4e6ecb6a1d271e1dffc8568d2fcee090f56a7a4500a94df4a6088c6e7521ab6d
Instruction Fuzzy Hash: 94215972A2021AAFDF04DFA8DD45AEA7BB8FB08314F104628FD55D3250E734E861AB50

Function 00F26B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00F26C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F26C20

Strings

edit, xrefs: 00F26BF5

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3df43ac00b849cb61a42e7abc70daf6642ae760323b74091ce904b24c18e8a9a
Instruction ID: 340adc332d17fd8111c30232ebe041cda8b7240d4893fbcde07acf247155d685
Opcode Fuzzy Hash: 3df43ac00b849cb61a42e7abc70daf6642ae760323b74091ce904b24c18e8a9a
Instruction Fuzzy Hash: 3411EC71901228ABEB109E64EC41EFB3B69EB44378F200724F960D71E0C735DC91BB20

Function 00F02E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F02F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F02F30

Strings

0, xrefs: 00F02F07

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: aa9531e86f4a69fae2b1d297e4a4aa6e15327d7ed5008f72a05054b6af676387
Instruction ID: 829dcabc8a808e04dc1b2d37cfcb84ab2dcbdfff0f315277cad39f987d48369f
Opcode Fuzzy Hash: aa9531e86f4a69fae2b1d297e4a4aa6e15327d7ed5008f72a05054b6af676387
Instruction Fuzzy Hash: E911D032E01119ABCB60DBA8DC08B9973B9EB01361F1840A5FC54E72E0D7B0AE04B7A1

Function 00F124CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F12520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F12549

Strings

<local>, xrefs: 00F12511

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6827a631b28f16302a0a6806978100d0dbd77b0c4a45dbb857dc7214d153d201
Instruction ID: fc247047fdebe31e5a43bdefab73880e83585642ece1027692ecc4a59c5582b9
Opcode Fuzzy Hash: 6827a631b28f16302a0a6806978100d0dbd77b0c4a45dbb857dc7214d153d201
Instruction Fuzzy Hash: B311A071901225BADB648F918CD9EFBFF69FB16761F10812AF90546040E27069A5FAE0

Function 00F180A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00F180C8,?,00000000,?,?), ref: 00F18322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F180CB
htons.WSOCK32(00000000,?,00000000), ref: 00F18108

Strings

255.255.255.255, xrefs: 00F180E3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 801e318b9557e7eeb0393bbc46348c7e2f1316015c1d04d010bc7a2ee3d40341
Instruction ID: 7a5531ee849a1187015e8c448c9b1f02b86adb8de79fe1b074b402a9794dd8df
Opcode Fuzzy Hash: 801e318b9557e7eeb0393bbc46348c7e2f1316015c1d04d010bc7a2ee3d40341
Instruction Fuzzy Hash: 1E110836600209ABCB20AF64CD46FFDB774FF04360F108527F911AB291DB32A856D751

Function 00EF92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00EF9355

Strings

ListBox, xrefs: 00EF931F
ComboBox, xrefs: 00EF92F4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9447752cd0d3d1a37e8dd794bf44a66d06a67f6a591a7c3a7f34048cc3844226
Instruction ID: 1223d17f377fd77b8b0df465528c2ed7348039384f88bcbf65aed8470f9dd295
Opcode Fuzzy Hash: 9447752cd0d3d1a37e8dd794bf44a66d06a67f6a591a7c3a7f34048cc3844226
Instruction Fuzzy Hash: 92012D71A45218ABCF04EB64CC91DFE77A9FF06310B141619FA72772D2EF31690C9650

Function 00EF91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00EF924D

Strings

ListBox, xrefs: 00EF9217
ComboBox, xrefs: 00EF91EC

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ec7c600462a6af9b87c273d84a3decfd6a6530eaf4fc33c494cf7e59a43ee52a
Instruction ID: 710f18964f487fccec9f190de3f715a189587c71e1713852ae35374073eca0ad
Opcode Fuzzy Hash: ec7c600462a6af9b87c273d84a3decfd6a6530eaf4fc33c494cf7e59a43ee52a
Instruction Fuzzy Hash: 9801D471B41108BBDB18EBA0C892EFF73E89F0A300F142019BA5677292EA106F0C9261

Function 00EF9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7F41: _memmove.LIBCMT ref: 00EA7F82

Part of subcall function 00EFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00EFB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00EF92D0

Strings

ListBox, xrefs: 00EF929C
ComboBox, xrefs: 00EF9271

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1bf88088640d7aee82b1ee75c3d4c76ef2ab3b1c539e49f73eb02279035caff6
Instruction ID: f3c2844965fb54a6bf4345dc0760acaf7e63dfad4a03445f13fd84730e32975e
Opcode Fuzzy Hash: 1bf88088640d7aee82b1ee75c3d4c76ef2ab3b1c539e49f73eb02279035caff6
Instruction Fuzzy Hash: DD01A771A4510CBBDF14EBA4C982EFF77EC9F15300F1421167A5277592EA116F0C9271

Function 00F051CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F051E8
_wcscmp.LIBCMT ref: 00F051FA

Strings

#32770, xrefs: 00F051F4

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 61fb8a39f120803d53e9cd83dc76fcaaa3e01f57010df082a34c7fab4bfc5ef1
Instruction ID: 3c3f0eda2fcef0e151e446e14740af88ad8b88765c8c4b12d643e4523c1638ff
Opcode Fuzzy Hash: 61fb8a39f120803d53e9cd83dc76fcaaa3e01f57010df082a34c7fab4bfc5ef1
Instruction Fuzzy Hash: 16E0613290032C17D320AA959C05F97F7FCEF44731F00016BFD10D3040D56099098BD1

Function 00EF81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00EF81CA

Part of subcall function 00EC3598: _doexit.LIBCMT ref: 00EC35A2

Strings

AutoIt, xrefs: 00EF81BE
Error allocating memory., xrefs: 00EF81C3

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 86079617616db42f8b085007ddcc137b7e587c6f0fdbd45be8b0a2f5dc7204a3
Instruction ID: 6526b1e236e48fb130fb434f072af322c345818b4d557c0d9c75656f784f8899
Opcode Fuzzy Hash: 86079617616db42f8b085007ddcc137b7e587c6f0fdbd45be8b0a2f5dc7204a3
Instruction Fuzzy Hash: B6D05B323C535C32D21432B46D07FC97AC84B05B56F105029BF08755D38DD29DC362EA

Function 00EDB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EDB564: _memset.LIBCMT ref: 00EDB571

Part of subcall function 00EC0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00EDB540,?,?,?,00EA100A), ref: 00EC0B89

IsDebuggerPresent.KERNEL32(?,?,?,00EA100A), ref: 00EDB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00EA100A), ref: 00EDB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00EDB54E

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 8dd10bdad4b4d096916d3672641c617a1302dea6337b1cd94f1305d09593ffdd
Instruction ID: b7fb1a5745e7ce94fe2d351bd603e8433f39676ab8ceba82219c9acc93da6bac
Opcode Fuzzy Hash: 8dd10bdad4b4d096916d3672641c617a1302dea6337b1cd94f1305d09593ffdd
Instruction Fuzzy Hash: 2EE06D70600314CBD760DF28E5047427BE4EB05704F018A3DE886D6351E7B8E80ADBA1

Function 00F25BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F25BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F25C08

Part of subcall function 00F054E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F0555E

Strings

Shell_TrayWnd, xrefs: 00F25BEE

Memory Dump Source

Source File: 00000000.00000002.2034977566.0000000000EA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.2034959415.0000000000EA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035019596.0000000000F55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035059268.0000000000F5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035074676.0000000000F68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4af5b543399746698d78ff9c87c5427c7d0f04535e1e356fd433839394193417
Instruction ID: e9a71d6dfd05cc18c3c0681c3d6164ba8cefacbb666b2611df20e4dfeaac9b5a
Opcode Fuzzy Hash: 4af5b543399746698d78ff9c87c5427c7d0f04535e1e356fd433839394193417
Instruction Fuzzy Hash: 08D0A931398310BAE334AB30AC0BFD33A20AB00F01F000834BB06AA0D0C8E49805EA00

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KaGeys.exe.log

C:\Users\user\AppData\Local\Temp\asset

C:\Users\user\AppData\Local\Temp\autC01D.tmp

C:\Users\user\AppData\Local\Temp\autC05C.tmp

C:\Users\user\AppData\Local\Temp\tapestring

C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

Function 00EA3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00EA4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 00EA4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00F093DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00EA3031 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 61
windowregistryCOMMON

Function 00EA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00EA71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00EA3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00EA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00EA3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 011125D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre