Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
09j4wHYrHs.exe

Overview

General Information

Sample name:09j4wHYrHs.exe
renamed because original name is a hash value
Original sample name:c26ffcfad1b175fecb51e9b9724f63cbbd5e789ca9d075d7b9c5d88ae914078b.exe
Analysis ID:1467012
MD5:b3370422cd4262297843df6f6b16d273
SHA1:092f1aac2c72ead151585cd11712b4fa32ed4d39
SHA256:c26ffcfad1b175fecb51e9b9724f63cbbd5e789ca9d075d7b9c5d88ae914078b
Tags:exe
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Detected potential crypto function
PE file contains an invalid checksum
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • 09j4wHYrHs.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\09j4wHYrHs.exe" MD5: B3370422CD4262297843DF6F6B16D273)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 09j4wHYrHs.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: 09j4wHYrHs.exeReversingLabs: Detection: 91%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
Machine Learning detection for sample
Source: 09j4wHYrHs.exeJoe Sandbox ML: detected
Source: 09j4wHYrHs.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 09j4wHYrHs.exe, 00000000.00000002.1718562336.000000000043D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718060726.000000000042D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718115281.0000000000438000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://payments.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000002.1718562336.000000000043D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718060726.000000000042D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718115281.0000000000438000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sandbox.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: 09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: C:\Users\user\Desktop\09j4wHYrHs.exeCode function: 0_2_004019880_2_00401988
Source: C:\Users\user\Desktop\09j4wHYrHs.exeCode function: 0_2_004019EB0_2_004019EB
Source: 09j4wHYrHs.exe, 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamescsearch.exe vs 09j4wHYrHs.exe
Source: 09j4wHYrHs.exeBinary or memory string: OriginalFilenamescsearch.exe vs 09j4wHYrHs.exe
Source: 09j4wHYrHs.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal68.spyw.winEXE@1/2@0/0
Source: C:\Users\user\Desktop\09j4wHYrHs.exeFile created: C:\Users\user\Desktop\config.xmlJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeMutant created: NULL
Source: C:\Users\user\Desktop\09j4wHYrHs.exeFile created: C:\Users\user\AppData\Local\Temp\~DFAC1AC9EB40B6FD0C.TMPJump to behavior
Source: 09j4wHYrHs.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\09j4wHYrHs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Process Where Name = 'chrome.exe'
Source: C:\Users\user\Desktop\09j4wHYrHs.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 09j4wHYrHs.exeReversingLabs: Detection: 91%
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: msvbvm60.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: vb6zz.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
Source: 09j4wHYrHs.exeStatic PE information: real checksum: 0x108c5 should be: 0xe347
Source: C:\Users\user\Desktop\09j4wHYrHs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\09j4wHYrHs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PreferencesJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: C:\Users\user\Desktop\09j4wHYrHs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Masquerading		1
OS Credential Dumping		2
System Information Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
DLL Side-Loading		LSASS MemoryApplication Window DiscoveryRemote Desktop Protocol1
Data from Local System		Junk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
09j4wHYrHs.exe92%ReversingLabsWin32.Adware.RedCap
09j4wHYrHs.exe100%AviraTR/VB_AGen.itpsl
09j4wHYrHs.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
https://www.ecosia.org/newtab/0%URL Reputationsafe
https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%Avira URL Cloudsafe
https://drive-daily-1.corp.google.com/0%Avira URL Cloudsafe
https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
https://duckduckgo.com/?q=0%Avira URL Cloudsafe
https://drive-daily-4.corp.google.com/0%Avira URL Cloudsafe
https://drive-autopush.corp.google.com/0%Avira URL Cloudsafe
https://drive-daily-2.corp.google.com/0%Avira URL Cloudsafe
https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
https://payments.google.com/0%Avira URL Cloudsafe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
https://docs.google.com/0%Avira URL Cloudsafe
https://drive-daily-6.corp.google.com/0%Avira URL Cloudsafe
https://drive-daily-5.corp.google.com/0%Avira URL Cloudsafe
https://drive-staging.corp.google.com/0%Avira URL Cloudsafe
https://drive.google.com/0%Avira URL Cloudsafe
https://www.google.com/0%Avira URL Cloudsafe
https://drive-daily-0.corp.google.com/0%Avira URL Cloudsafe
https://sandbox.google.com/0%Avira URL Cloudsafe
https://drive-preprod.corp.google.com/0%Avira URL Cloudsafe
https://drive-daily-3.corp.google.com/0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtab09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/ac/?q=09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/?q=09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-2.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-autopush.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-4.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://payments.google.com/09j4wHYrHs.exe, 00000000.00000002.1718562336.000000000043D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718060726.000000000042D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718115281.0000000000438000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.ecosia.org/newtab/09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-1.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://docs.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ac.ecosia.org/autocomplete?q=09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-staging.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-6.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-0.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-preprod.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://sandbox.google.com/09j4wHYrHs.exe, 00000000.00000002.1718562336.000000000043D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718060726.000000000042D000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1718115281.0000000000438000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=09j4wHYrHs.exe, 00000000.00000003.1717928032.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.00000000004B5000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1715347162.000000000047F000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000002.1718666692.00000000004B6000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1716891894.0000000000482000.00000004.00000020.00020000.00000000.sdmp, 09j4wHYrHs.exe, 00000000.00000003.1717607037.00000000004B5000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-3.corp.google.com/09j4wHYrHs.exe, 00000000.00000003.1717545447.0000000000441000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467012
Start date and time:2024-07-03 16:26:05 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 2m 1s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:1
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:09j4wHYrHs.exe
renamed because original name is a hash value
Original Sample Name:c26ffcfad1b175fecb51e9b9724f63cbbd5e789ca9d075d7b9c5d88ae914078b.exe
Detection:MAL
Classification:mal68.spyw.winEXE@1/2@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 9
  • Number of non-executed functions: 11
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Warnings

  • VT rate limit hit for: 09j4wHYrHs.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DFAC1AC9EB40B6FD0C.TMP

Download File
Process:C:\Users\user\Desktop\09j4wHYrHs.exe
File Type:Composite Document File V2 Document, Cannot read section info
Category:dropped
Size (bytes):6144
Entropy (8bit):2.59212770002593
Encrypted:false
SSDEEP:24:rwrubDvqLJ/K93+OO2C9HpAgf3omT7zlzGl7wUpT1GsjW9YmAS7Wipgp:rwcjqLBK9xw9Jv3D2wWT4nASqipgp
MD5:E07BBD02C35E67ADE9520EBEDD272472
SHA1:D9BDAEB17B2CDE97D8669BDA7138D433FFF8186E
SHA-256:124B6C25408C231EF87C812D7B9AC0EFB45FAC76887E9469212B40ED566DCCFC
SHA-512:09E3D4622AF1EDB14CB06CEA66C08FFD09D0F0AB5F00E5554A14D82A3B709DC79E46F4C2EDCBFF448ECD2CE00BE8E1A3D7F5C89B1E125B0888321FFB432789AE
Malicious:false
Reputation:low
Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\config.xml

Download File
Process:C:\Users\user\Desktop\09j4wHYrHs.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):36
Entropy (8bit):3.147869792568112
Encrypted:false
SSDEEP:3:fKpr+YfrYn:ipr+YfrY
MD5:AE4858DB9BCD6FC5109F24803E14075C
SHA1:DD78B1548A7B5597E22FA98EF8EDFE2E7C6118ED
SHA-256:58D7D23DE9252D80EC36106CF4E50A3A3095B1A63E00BB44CCFC354B547D80D5
SHA-512:8E9F88352797EF792AD7B520DE70C1A216C4B585A0951DD4C858C2F5E08920E679E20CFFB9BF6EB2F8E1792E4C40100B3F39DD35C2938E796EB1FFB3EC447BDA
Malicious:false
Reputation:low
Preview:<no>1<\no><noc>0<\noc><nos>0<\nos>..

Static File Info

General

File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):4.600770612695514
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.15%
  • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:09j4wHYrHs.exe
File size:49'665 bytes
MD5:b3370422cd4262297843df6f6b16d273
SHA1:092f1aac2c72ead151585cd11712b4fa32ed4d39
SHA256:c26ffcfad1b175fecb51e9b9724f63cbbd5e789ca9d075d7b9c5d88ae914078b
SHA512:5ac971db6f50f25dddbab16b253c5573d6ba8950860b12639f0c1738de9824f627ca295b6fd3fc2384d4733167aa05c2df00e6bbb3d480a2f179b1497b076b7f
SSDEEP:384:Yphk1qGvq/a/ryIstUT4FPwk5wAjFwyXILah1/VBjzYwXfA/ae/UcD6:Yc1qGAWrGOkFTxKe/VBjzYUqxL6
TLSH:E323F617A2E0F93AD265CBF92E2A03FC04AABD3474D4DD07F5841A066AB6D43E953317
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L...;..a.....................0....................@................

File Icon

Icon Hash:07992c26b01966d0

Static PE Info

General

Entrypoint:0x401988
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:0x61AF803B [Tue Dec 7 15:39:39 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:7677763f7529dbafb8cbd5551d80cbc1

Entrypoint Preview

Instruction
push 00402CA8h
call 00007F7971110E65h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
lahf
outsb
mov eax, D82FDC56h
dec esp
xchg eax, edi
or ebx, dword ptr [ecx]
int1
push es
inc ecx
xor byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+53h], ah
popad
jc 00007F7971110ED5h
push 00000000h
add bh, bh
int3
xor dword ptr [eax], eax
add esp, ebp
loope 00007F7971110E83h
mul ah
cwde
insb
dec edi
test byte ptr [eax], bl
jnbe 00007F7971110E5Eh
mov al, EFh
loopne 00007F7971110EDBh
aas
push edi
xor bl, bl
push ebp

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x86f40x28.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0xa0000x1821.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
IMAGE_DIRECTORY_ENTRY_IAT0x10000x174.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x7d480x8000d43c19c12cd75dcbfed0d75204da1128False0.372802734375data5.464787776086042IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x90000xb780x1000620f0b67a91f7f74151bc5be745b7110False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0xa0000x18210x2000c53d144c8093906bd1def9a1951838c9False0.243896484375data3.1157592549729243IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_ICON0xa34c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.23850844277673547
RT_GROUP_ICON0xa3380x14data1.2
RT_VERSION0xa1300x208dataEnglishUnited States0.4980769230769231
RT_MANIFEST0xb3f40x42dXML 1.0 document, ASCII text, with very long lines (1069), with no line terminatorsEnglishUnited States0.5126286248830683

Imports

DLLImport
MSVBVM60.DLL__vbaStrI2, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, __vbaStrErrVarCopy, _adj_fprem1, __vbaStrCat, __vbaForEachCollAd, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaExitProc, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR4, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGet3, __vbaObjVar, __vbaI2I4, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, __vbaNew, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, __vbaPrintFile, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaVarCat, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaVarLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, _CItan, __vbaNextEachCollAd, _CIexp, __vbaFreeStr, __vbaFreeObj

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

General

Target ID:0
Start time:10:27:00
Start date:03/07/2024
Path:C:\Users\user\Desktop\09j4wHYrHs.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\09j4wHYrHs.exe"
Imagebase:0x400000
File size:49'665 bytes
MD5 hash:B3370422CD4262297843DF6F6B16D273
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:17.8%
    Dynamic/Decrypted Code Coverage:12%
    Signature Coverage:0.6%
    Total number of Nodes:332
    Total number of Limit Nodes:27
    execution_graph 958 407280 959 407286 __vbaFreeStr 958->959 960 40728e __vbaFreeVar 958->960 959->960 900 4075c2 __vbaFreeStrList __vbaFreeObj __vbaFreeVar 901 4086c4 902 4086c8 __vbaExitProc __vbaFreeStr 901->902 964 404784 45 API calls 965 404b03 964->965 966 404ae8 __vbaNew2 964->966 967 404b61 965->967 968 404b41 __vbaHresultCheckObj 965->968 966->965 969 404bb7 967->969 970 404b97 __vbaHresultCheckObj 967->970 968->967 971 404bbe 12 API calls 969->971 970->971 972 404cf0 __vbaNew2 971->972 973 404d0b 971->973 972->973 974 404d69 973->974 975 404d49 __vbaHresultCheckObj 973->975 976 404dbf 974->976 977 404d9f __vbaHresultCheckObj 974->977 975->974 978 404dc6 12 API calls 976->978 977->978 979 404f13 978->979 980 404ef8 __vbaNew2 978->980 981 404f71 979->981 982 404f51 __vbaHresultCheckObj 979->982 980->979 983 404fc7 981->983 984 404fa7 __vbaHresultCheckObj 981->984 982->981 985 404fce 12 API calls 983->985 984->985 986 405100 __vbaNew2 985->986 987 40511b 985->987 986->987 988 405179 987->988 989 405159 __vbaHresultCheckObj 987->989 990 4051cf 988->990 991 4051af __vbaHresultCheckObj 988->991 989->988 992 4051d6 12 API calls 990->992 991->992 993 405323 992->993 994 405308 __vbaNew2 992->994 995 405381 993->995 996 405361 __vbaHresultCheckObj 993->996 994->993 997 4053d7 995->997 998 4053b7 __vbaHresultCheckObj 995->998 996->995 999 4053de 20 API calls 997->999 998->999 1000 4055d6 999->1000 1001 405605 1000->1001 1002 4055e5 __vbaHresultCheckObj 1000->1002 1003 405637 1001->1003 1004 40561c __vbaNew2 1001->1004 1002->1001 1005 405695 1003->1005 1006 405675 __vbaHresultCheckObj 1003->1006 1004->1003 1007 4056eb 1005->1007 1008 4056cb __vbaHresultCheckObj 1005->1008 1006->1005 1009 4056f2 6 API calls 1007->1009 1008->1009 1010 4057a3 1009->1010 1011 407605 __vbaChkstk 1012 40764c __vbaOnError #648 __vbaFreeVar 1011->1012 1013 4076b5 1012->1013 1014 40769d __vbaNew2 1012->1014 1015 4076f5 1013->1015 1016 4076de __vbaHresultCheckObj 1013->1016 1014->1013 1017 407730 1015->1017 1018 407719 __vbaHresultCheckObj 1015->1018 1016->1015 1019 407734 10 API calls 1017->1019 1018->1019 1020 4077d9 1019->1020 903 405746 904 405750 __vbaFreeStr 903->904 905 405758 __vbaFreeStr __vbaFreeObj __vbaFreeVarList 903->905 904->905 906 4073c6 907 4073d4 __vbaFreeStrList 906->907 908 4073cc __vbaFreeVar 906->908 908->907 733 401988 #100 734 4019ca 733->734 1021 405c09 __vbaFreeStr __vbaFreeVarList 735 405fcb __vbaChkstk 736 40601e __vbaOnError 735->736 737 406043 __vbaNew2 736->737 738 40605e 736->738 737->738 739 4060bc 738->739 740 40609c __vbaHresultCheckObj 738->740 741 406115 739->741 742 4060f5 __vbaHresultCheckObj 739->742 740->739 743 40611c __vbaFreeObj 741->743 742->743 744 406149 743->744 745 40613d __vbaEnd 743->745 746 406174 744->746 747 406159 __vbaNew2 744->747 745->744 748 4061d2 746->748 749 4061b2 __vbaHresultCheckObj 746->749 747->746 750 406228 748->750 751 406208 __vbaHresultCheckObj 748->751 749->748 752 40622f __vbaStrCat __vbaStrMove 750->752 751->752 753 40625c 752->753 754 40628b 753->754 755 40626b __vbaHresultCheckObj 753->755 756 406292 7 API calls 754->756 755->756 858 408669 __vbaStrCopy __vbaOnError #579 __vbaI2I4 756->858 758 406349 __vbaFreeStr __vbaFreeVarList 759 406383 758->759 760 406385 __vbaEnd 758->760 761 406391 6 API calls 759->761 760->761 860 4080c7 8 API calls 761->860 763 406433 9 API calls 764 4080c7 20 API calls 763->764 765 406509 __vbaStrMove __vbaFreeStr __vbaFreeVarList __vbaInStr 764->765 766 4068a4 6 API calls 765->766 767 40655e __vbaInStr __vbaInStr 765->767 768 4080c7 20 API calls 766->768 769 406592 __vbaFreeStr 767->769 770 4065b3 767->770 773 406946 __vbaStrMove __vbaFreeStr __vbaFreeVarList __vbaInStr 768->773 769->770 771 4065c3 __vbaFreeStr __vbaEnd 770->771 772 4065f5 770->772 785 40689f __vbaFreeStr 771->785 774 4071c4 __vbaErrorOverflow 772->774 775 40660b 772->775 776 406cc9 __vbaStrCopy 773->776 777 40699d 773->777 780 4071c9 __vbaInStr 774->780 781 406621 __vbaNew2 775->781 782 40663c 775->782 864 405a87 14 API calls 776->864 783 4069da 777->783 792 4069c6 __vbaFreeStr __vbaEnd 777->792 794 407227 __vbaLenBstr 780->794 795 407279 780->795 781->782 800 40669a 782->800 801 40667a __vbaHresultCheckObj 782->801 783->774 784 4069f0 783->784 787 406a21 784->787 788 406a06 __vbaNew2 784->788 786 406cf6 __vbaFreeStr 790 406d17 __vbaEnd 786->790 791 406d28 786->791 808 406a5f __vbaHresultCheckObj 787->808 817 406a7f 787->817 788->787 790->785 796 406d65 791->796 805 406d51 __vbaFreeStr __vbaEnd 791->805 792->783 798 407236 __vbaInStr 794->798 799 4072bd __vbaErrorOverflow 794->799 796->774 797 406d7b 796->797 802 406d91 __vbaNew2 797->802 803 406dac 797->803 798->795 804 40724d 798->804 806 4072c2 6 API calls 799->806 812 4066f0 800->812 813 4066d0 __vbaHresultCheckObj 800->813 801->800 802->803 816 406dea __vbaHresultCheckObj 803->816 819 406e0a 803->819 804->799 809 407258 #631 __vbaStrMove __vbaFreeVar 804->809 805->796 895 403ef0 806->895 808->817 809->795 814 4066f7 27 API calls 812->814 813->814 822 406827 814->822 816->819 820 406ad5 817->820 821 406ab5 __vbaHresultCheckObj 817->821 833 406e60 819->833 834 406e40 __vbaHresultCheckObj 819->834 825 406adc 27 API calls 820->825 821->825 826 406856 822->826 827 406836 __vbaHresultCheckObj 822->827 835 406c0c 825->835 830 40685d __vbaFreeStrList __vbaEnd 826->830 827->830 830->785 838 406e67 27 API calls 833->838 834->838 836 406c3b 835->836 837 406c1b __vbaHresultCheckObj 835->837 839 406c42 __vbaFreeStrList 836->839 837->839 869 407411 __vbaChkstk 838->869 887 40785b __vbaChkstk __vbaOnError __vbaOnError #535 839->887 842 406fc6 845 406fcd __vbaFreeStrList 842->845 843 406fa6 __vbaHresultCheckObj 843->845 846 407013 __vbaNew2 845->846 847 40702e 845->847 846->847 849 40708c 847->849 850 40706c __vbaHresultCheckObj 847->850 851 4070e2 849->851 852 4070c2 __vbaHresultCheckObj 849->852 850->849 853 4070e9 __vbaStrCat __vbaStrMove 851->853 852->853 879 408550 7 API calls 853->879 859 4086c8 __vbaExitProc __vbaFreeStr 858->859 859->758 861 4081d3 __vbaI2I4 __vbaFileClose __vbaStrCopy 860->861 862 40817e 8 API calls 860->862 863 40821c __vbaFreeStr 861->863 862->861 863->763 865 405bf9 864->865 866 405bd0 __vbaNextEachCollAd 865->866 867 405c02 __vbaFreeObjList __vbaFreeObj 865->867 866->865 867->786 870 407458 __vbaOnError #648 __vbaFreeVar 869->870 871 4074c1 870->871 872 4074a9 __vbaNew2 870->872 873 407501 871->873 874 4074ea __vbaHresultCheckObj 871->874 872->871 875 407525 __vbaHresultCheckObj 873->875 876 40753c 873->876 874->873 877 407540 10 API calls 875->877 876->877 878 406f97 877->878 878->842 878->843 897 403c34 879->897 888 407b03 887->888 889 4078e5 887->889 888->888 889->888 890 40796b __vbaExitProc 889->890 892 407907 __vbaSetSystemError #598 #535 __vbaFpR4 889->892 894 407957 #535 889->894 893 406c97 __vbaFreeVar __vbaEnd 890->893 892->889 892->894 893->785 894->889 896 403ef9 895->896 898 403c3d 897->898 1022 40320b 1023 4071c9 __vbaInStr 1022->1023 1025 407227 __vbaLenBstr 1023->1025 1028 407279 1023->1028 1026 407236 __vbaInStr 1025->1026 1027 4072bd __vbaErrorOverflow 1025->1027 1026->1028 1029 40724d 1026->1029 1030 4072c2 6 API calls 1027->1030 1029->1027 1032 407258 #631 __vbaStrMove __vbaFreeVar 1029->1032 1031 403ef0 1030->1031 1033 407357 __vbaSetSystemError __vbaFreeStrList 1031->1033 1032->1028 1043 403d20 1033->1043 1044 403d29 1043->1044 909 405a50 __vbaFreeVar 910 4083d8 __vbaFreeStr 1045 403218 1046 4072c2 6 API calls 1045->1046 1047 403ef0 1046->1047 1048 407357 __vbaSetSystemError __vbaFreeStrList 1047->1048 1049 403d20 1048->1049 1050 407381 __vbaSetSystemError 1049->1050 1051 407386 __vbaLenBstr 1050->1051 1052 407395 1051->1052 1053 4073ba 1051->1053 1058 408363 __vbaChkstk __vbaOnError 1052->1058 1062 407b08 __vbaChkstk __vbaOnError 1053->1062 1057 4073bf 1143 403db0 1058->1143 1063 4080c2 __vbaErrorOverflow 1062->1063 1064 407b6e __vbaI4Str 1062->1064 1066 4080c7 8 API calls 1063->1066 1145 403d54 1064->1145 1068 4081d3 __vbaI2I4 __vbaFileClose __vbaStrCopy 1066->1068 1069 40817e 8 API calls 1066->1069 1071 40821c __vbaFreeStr 1068->1071 1069->1068 1071->1057 1144 403db9 1143->1144 1146 403d5d 1145->1146 911 407ae0 __vbaFreeStr __vbaFreeObj 1147 408522 __vbaFreeStr __vbaFreeVar 912 407970 #685 __vbaObjSet 913 407998 912->913 914 4079a3 __vbaHresultCheckObj 913->914 915 4079ba 913->915 916 4079be __vbaInStr __vbaFreeStr __vbaFreeObj 914->916 915->916 917 4079f2 #685 __vbaObjSet 916->917 918 407a49 #685 __vbaObjSet 916->918 919 407a1b 917->919 920 407a71 918->920 923 407a26 __vbaHresultCheckObj 919->923 924 407a3d 919->924 921 407a93 920->921 922 407a7c __vbaHresultCheckObj 920->922 925 407a97 __vbaFreeStr __vbaFreeObj #685 __vbaObjSet 921->925 922->925 926 407a41 __vbaFreeObj 923->926 924->926 927 407acb __vbaFreeObj 925->927 926->918 928 407ad3 __vbaExitProc 927->928 929 407af1 928->929 930 405f72 931 405f84 __vbaFreeStrList __vbaFreeVar 930->931 932 405f7c __vbaFreeStr 930->932 932->931 933 405c75 __vbaChkstk 934 405cbc 11 API calls 933->934 935 405d9f 934->935 936 405dc2 935->936 937 405da8 __vbaHresultCheckObj 935->937 938 405dc6 __vbaStrCopy __vbaFreeStrList __vbaI4Str __vbaStrCopy __vbaStrCopy 936->938 937->938 939 405e4c 938->939 940 405e55 __vbaHresultCheckObj 939->940 941 405e6f 939->941 942 405e73 __vbaStrCopy __vbaFreeStrList __vbaI4Str __vbaStrCopy __vbaStrCopy 940->942 941->942 943 405ef9 942->943 944 405f02 __vbaHresultCheckObj 943->944 945 405f1c 943->945 946 405f20 __vbaStrCopy __vbaFreeStrList __vbaI4Str __vbaFileClose 944->946 945->946 947 405fa3 946->947 948 4083f6 __vbaChkstk __vbaOnError 956 403e00 948->956 957 403e09 956->957 1150 407e3c 1151 407e43 1150->1151 1152 407e58 __vbaI4Str 1151->1152 1153 40785b 10 API calls 1151->1153 1154 403d54 1152->1154 1153->1152 1155 407e70 __vbaSetSystemError __vbaVarDup 1154->1155 1187 408239 13 API calls 1155->1187 1157 407ea7 __vbaFreeVar 1158 40785b 10 API calls 1157->1158 1159 407ec8 __vbaI4Str 1158->1159 1160 403d54 1159->1160 1161 407ee0 __vbaSetSystemError __vbaVarDup 1160->1161 1162 408239 14 API calls 1161->1162 1163 407f17 __vbaFreeVar 1162->1163 1164 40785b 10 API calls 1163->1164 1165 407f38 __vbaI4Str 1164->1165 1166 403d54 1165->1166 1167 407f50 __vbaSetSystemError __vbaVarDup 1166->1167 1168 408239 14 API calls 1167->1168 1169 407f87 __vbaFreeVar 1168->1169 1170 40785b 10 API calls 1169->1170 1171 407fa8 __vbaI4Str 1170->1171 1172 403d54 1171->1172 1173 407fc0 __vbaSetSystemError __vbaVarDup 1172->1173 1174 408239 14 API calls 1173->1174 1175 407ff7 __vbaFreeVar 1174->1175 1176 40785b 10 API calls 1175->1176 1177 408018 __vbaI4Str 1176->1177 1189 403e44 1177->1189 1188 408349 __vbaFreeObj 1187->1188 1188->1157 1190 403e4d 1189->1190 1191 40713d __vbaFreeStrList __vbaFreeObj __vbaFreeVarList 1192 4057bf 6 API calls 1193 40587c 1192->1193 1194 405887 __vbaHresultCheckObj 1193->1194 1195 40589e 1193->1195 1194->1195 1196 4058e0 1195->1196 1197 4058c9 __vbaHresultCheckObj 1195->1197 1198 405922 1196->1198 1199 40590b __vbaHresultCheckObj 1196->1199 1197->1196 1200 405964 1198->1200 1201 40594d __vbaHresultCheckObj 1198->1201 1199->1198 1202 405968 __vbaChkstk 1200->1202 1201->1202 1203 405999 1202->1203 1204 4059a4 __vbaHresultCheckObj 1203->1204 1205 4059bb 1203->1205 1206 4059bf __vbaChkstk 1204->1206 1205->1206 1207 4059f4 1206->1207 1208 405a16 1207->1208 1209 4059ff __vbaHresultCheckObj 1207->1209 1210 405a1a __vbaObjSetAddref __vbaCastObj __vbaObjSet 1208->1210 1209->1210 1211 405a59 __vbaFreeObj __vbaFreeObj 1210->1211

    Callgraph

    • Executed
    • Not Executed
    • Opacity -> Relevance
    • Disassembly available
    callgraph 0 Function_00408340 1 Function_004075C2 2 Function_00403E44 3 Function_00403CC4 4 Function_004086C4 5 Function_00405746 6 Function_004073C6 7 Function_004080C7 8 Function_004034C8 9 Function_004031CA 10 Function_00405FCB 10->7 11 Function_00408550 10->11 20 Function_0040785B 10->20 24 Function_00408363 10->24 27 Function_00408669 10->27 30 Function_00403EF0 10->30 47 Function_00405A87 10->47 49 Function_00407B08 10->49 52 Function_00407411 10->52 58 Function_00403D20 10->58 11->3 42 Function_00403C80 11->42 71 Function_00403C34 11->71 12 Function_00405A50 13 Function_00408352 14 Function_00403D54 15 Function_004031D7 16 Function_00408658 17 Function_00405C58 18 Function_004083D8 19 Function_004077DA 55 Function_00403E98 20->55 21 Function_004086DB 22 Function_00407AE0 23 Function_004083E2 68 Function_00403DB0 24->68 25 Function_004031E4 26 Function_004075E6 28 Function_00405A6A 29 Function_004019EB 31 Function_00407970 32 Function_00407AF2 33 Function_00405F72 34 Function_004073F4 35 Function_00405C75 36 Function_004083F6 43 Function_00403E00 36->43 75 Function_00403F38 36->75 37 Function_00401178 38 Function_004077F9 39 Function_004031FE 40 Function_0040337F 41 Function_00407280 44 Function_00408201 45 Function_00404784 46 Function_00407605 48 Function_00401988 49->2 49->14 49->20 49->58 76 Function_00408239 49->76 50 Function_00405C09 51 Function_0040320B 51->24 51->30 51->49 51->58 53 Function_00402B97 54 Function_00403218 54->24 54->30 54->49 54->58 56 Function_00407298 57 Function_00403F1F 59 Function_00408522 60 Function_00403724 61 Function_004057A4 62 Function_00405FA4 63 Function_00403225 64 Function_00408225 65 Function_004071A5 66 Function_004080A9 67 Function_00402C2B 69 Function_00403232 70 Function_004080B3 72 Function_00402935 73 Function_004077B6 74 Function_004033B7 77 Function_00407E3C 77->2 77->14 77->20 77->58 77->76 78 Function_0040853C 79 Function_00402ABD 80 Function_0040713D 81 Function_0040323F 82 Function_004057BF

    Executed Functions

    Function 00401988 Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1527COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 268 401988-4019c8 #100 269 4019ca 268->269 270 401a2d-401a4d 268->270 271 4019cd-4019d6 269->271 275 401a51-4020e7 270->275 273 4019d8-4019df 271->273 274 4019e9 271->274 273->271 276 4019e1-4019e3 273->276 274->270 280 4020e9-40211b 275->280 281 40211c-40241f 275->281 278 4019e5-4019e7 276->278 279 401a4e-401a4f 276->279 278->274 279->275 280->281 282 402421-402452 281->282 283 402454-40261f 281->283 282->283
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: #100
    • String ID: VB5!6&*
    • API String ID: 1341478452-3593831657
    • Opcode ID: e3899db1e9f94d3c5760ad6605d842873b2a13482bca0c5bca6400bc9a926a63
    • Instruction ID: b261412ace654c9648bdbaa0e3a3741ea254ec7922d48ff1d615b184f41861de
    • Opcode Fuzzy Hash: e3899db1e9f94d3c5760ad6605d842873b2a13482bca0c5bca6400bc9a926a63
    • Instruction Fuzzy Hash: 5B8213328092B18FDF52DFB588A4643BBB1AF4F31070B54DAC881BF06AD6657815DB93
    Function 00405FCB Relevance: 374.0, APIs: 193, Strings: 20, Instructions: 1284COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 0 405fcb-406041 __vbaChkstk __vbaOnError 2 406043-40605c __vbaNew2 0->2 3 40605e 0->3 4 406068-40609a 2->4 3->4 6 4060bc 4->6 7 40609c-4060ba __vbaHresultCheckObj 4->7 8 4060c3-4060f3 6->8 7->8 10 406115 8->10 11 4060f5-406113 __vbaHresultCheckObj 8->11 12 40611c-40613b __vbaFreeObj 10->12 11->12 13 406149-406157 12->13 14 40613d-406144 __vbaEnd 12->14 15 406174 13->15 16 406159-406172 __vbaNew2 13->16 14->13 17 40617e-4061b0 15->17 16->17 19 4061d2 17->19 20 4061b2-4061d0 __vbaHresultCheckObj 17->20 21 4061d9-406206 19->21 20->21 23 406228 21->23 24 406208-406226 __vbaHresultCheckObj 21->24 25 40622f-406269 __vbaStrCat __vbaStrMove 23->25 24->25 27 40628b 25->27 28 40626b-406289 __vbaHresultCheckObj 25->28 29 406292-406381 __vbaFreeStrList __vbaFreeObj __vbaVarDup #666 __vbaVarCat * 2 __vbaStrVarVal call 408669 __vbaFreeStr __vbaFreeVarList 27->29 28->29 32 406383 29->32 33 406385-40638c __vbaEnd 29->33 34 406391-406558 __vbaVarDup #666 __vbaVarCat * 2 __vbaStrVarMove __vbaStrMove call 4080c7 __vbaStrMove __vbaFreeStr __vbaFreeVarList __vbaVarDup #666 __vbaVarCat * 2 __vbaStrVarMove __vbaStrMove call 4080c7 __vbaStrMove __vbaFreeStr __vbaFreeVarList __vbaInStr 32->34 33->34 39 4068a4-406997 __vbaVarDup #666 __vbaVarCat * 2 __vbaStrVarMove __vbaStrMove call 4080c7 __vbaStrMove __vbaFreeStr __vbaFreeVarList __vbaInStr 34->39 40 40655e-406590 __vbaInStr * 2 34->40 49 406cc9-406d15 __vbaStrCopy call 405a87 __vbaFreeStr 39->49 50 40699d-4069ab 39->50 42 406592-4065ae __vbaFreeStr 40->42 43 4065b3-4065c1 40->43 42->43 44 4065c3-4065f0 __vbaFreeStr __vbaEnd 43->44 45 4065f5-406605 43->45 59 40689f 44->59 47 4071c4-407225 __vbaErrorOverflow __vbaInStr 45->47 48 40660b-40661f 45->48 71 407227-407230 __vbaLenBstr 47->71 72 407279-407297 47->72 54 406621-40663a __vbaNew2 48->54 55 40663c 48->55 66 406d17-406d23 __vbaEnd 49->66 67 406d28-406d36 49->67 56 4069da-4069ea 50->56 57 4069ad-4069d5 __vbaFreeStr __vbaEnd 50->57 60 406646-406678 54->60 55->60 56->47 58 4069f0-406a04 56->58 57->56 62 406a21 58->62 63 406a06-406a1f __vbaNew2 58->63 65 40712e-4071a4 __vbaFreeStr 59->65 79 40669a 60->79 80 40667a-406698 __vbaHresultCheckObj 60->80 69 406a2b-406a5d 62->69 63->69 66->65 74 406d65-406d75 67->74 75 406d38-406d60 __vbaFreeStr __vbaEnd 67->75 91 406a7f 69->91 92 406a5f-406a7d __vbaHresultCheckObj 69->92 77 407236-40724b __vbaInStr 71->77 78 4072bd-407381 __vbaErrorOverflow __vbaStrI2 __vbaStrMove __vbaStrToAnsi * 4 call 403ef0 __vbaSetSystemError __vbaFreeStrList call 403d20 __vbaSetSystemError 71->78 74->47 76 406d7b-406d8f 74->76 75->74 82 406d91-406daa __vbaNew2 76->82 83 406dac 76->83 77->72 85 40724d-407256 77->85 106 407386-407393 __vbaLenBstr 78->106 86 4066a1-4066ce 79->86 80->86 90 406db6-406de8 82->90 83->90 85->78 93 407258-407274 #631 __vbaStrMove __vbaFreeVar 85->93 99 4066f0 86->99 100 4066d0-4066ee __vbaHresultCheckObj 86->100 103 406e0a 90->103 104 406dea-406e08 __vbaHresultCheckObj 90->104 95 406a86-406ab3 91->95 92->95 93->72 108 406ad5 95->108 109 406ab5-406ad3 __vbaHresultCheckObj 95->109 101 4066f7-406834 __vbaStrCat #529 __vbaFreeStr __vbaFreeObj __vbaFreeVar __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove 99->101 100->101 114 406856 101->114 115 406836-406854 __vbaHresultCheckObj 101->115 107 406e11-406e3e 103->107 104->107 111 407395-4073b8 call 408363 __vbaStrMove __vbaFreeStr #598 106->111 112 4073ba-4073f3 call 407b08 106->112 122 406e60 107->122 123 406e40-406e5e __vbaHresultCheckObj 107->123 113 406adc-406c19 __vbaStrCat #529 __vbaFreeStr __vbaFreeObj __vbaFreeVar __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove 108->113 109->113 111->106 125 406c3b 113->125 126 406c1b-406c39 __vbaHresultCheckObj 113->126 119 40685d-40689a __vbaFreeStrList __vbaEnd 114->119 115->119 119->59 128 406e67-406fa4 __vbaStrCat #529 __vbaFreeStr __vbaFreeObj __vbaFreeVar __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrI4 __vbaStrMove __vbaStrCat __vbaStrMove __vbaStrCat __vbaStrMove call 407411 122->128 123->128 129 406c42-406cc4 __vbaFreeStrList call 40785b __vbaFreeVar __vbaEnd 125->129 126->129 132 406fc6 128->132 133 406fa6-406fc4 __vbaHresultCheckObj 128->133 129->65 135 406fcd-407011 __vbaFreeStrList 132->135 133->135 136 407013-40702c __vbaNew2 135->136 137 40702e 135->137 139 407038-40706a 136->139 137->139 141 40708c 139->141 142 40706c-40708a __vbaHresultCheckObj 139->142 143 407093-4070c0 141->143 142->143 145 4070e2 143->145 146 4070c2-4070e0 __vbaHresultCheckObj 143->146 147 4070e9-407103 __vbaStrCat __vbaStrMove call 408550 145->147 146->147 149 407108-407129 __vbaFreeStrList __vbaFreeObj __vbaEnd 147->149 149->65
    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 00405FE9
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 0040602E
    • __vbaNew2.MSVBVM60(00403710,00409430,000000FF,?,?,?,?,00401766), ref: 0040604D
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 004060AF
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000068), ref: 00406108
    • __vbaFreeObj.MSVBVM60(00000000,?,00403720,00000068), ref: 0040612D
    • __vbaEnd.MSVBVM60(00000000,?,00403720,00000068), ref: 00406144
    • __vbaNew2.MSVBVM60(00403710,00409430), ref: 00406163
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 004061C5
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 0040621B
    • __vbaStrCat.MSVBVM60(\config.xml,?), ref: 00406237
    • __vbaStrMove.MSVBVM60(\config.xml,?), ref: 00406241
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033A8,000006F8), ref: 0040627E
    • __vbaFreeStrList.MSVBVM60(00000003,?,?,000000FF), ref: 004062A0
    • __vbaFreeObj.MSVBVM60(?,?,?,00401766), ref: 004062AB
    • __vbaVarDup.MSVBVM60 ref: 004062D4
    • #666.MSVBVM60(?,?), ref: 004062E1
    • __vbaVarCat.MSVBVM60(?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406320
    • __vbaVarCat.MSVBVM60(?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406334
    • __vbaStrVarVal.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040633E
    • __vbaFreeStr.MSVBVM60(00000000,?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?), ref: 00406353
    • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00000000,?,00000000,?,00000008,00000000,?,00000008,?), ref: 00406370
    • __vbaEnd.MSVBVM60(?,?,?,?,?,?,?,?,00401766), ref: 0040638C
    • __vbaVarDup.MSVBVM60 ref: 004063B5
    • #666.MSVBVM60(?,?), ref: 004063C2
    • __vbaVarCat.MSVBVM60(?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406401
    • __vbaVarCat.MSVBVM60(?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406415
    • __vbaStrVarMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040641B
    • __vbaStrMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406425
    • __vbaStrMove.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040643A
    • __vbaFreeStr.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406442
    • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000008,00000000,?,00000008,?), ref: 0040645F
    • __vbaVarDup.MSVBVM60 ref: 0040648B
    • #666.MSVBVM60(?,?), ref: 00406498
    • __vbaVarCat.MSVBVM60(?,00000008,?,?,?,?,?,?,?,?,?), ref: 004064D7
    • __vbaVarCat.MSVBVM60(?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 004064EB
    • __vbaStrVarMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 004064F1
    • __vbaStrMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 004064FB
      • Part of subcall function 004080C7: __vbaChkstk.MSVBVM60(?,00401766), ref: 004080E3
      • Part of subcall function 004080C7: __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00408113
      • Part of subcall function 004080C7: #648.MSVBVM60(0000000A), ref: 00408131
      • Part of subcall function 004080C7: __vbaFreeVar.MSVBVM60(0000000A), ref: 0040813F
      • Part of subcall function 004080C7: __vbaI2I4.MSVBVM60(?,0000000A), ref: 00408153
      • Part of subcall function 004080C7: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 00408160
      • Part of subcall function 004080C7: __vbaI2I4.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 0040816F
      • Part of subcall function 004080C7: #570.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408175
      • Part of subcall function 004080C7: __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408188
      • Part of subcall function 004080C7: #570.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040818E
      • Part of subcall function 004080C7: #526.MSVBVM60(0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408198
      • Part of subcall function 004080C7: __vbaStrVarMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081A1
      • Part of subcall function 004080C7: __vbaStrMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081AB
      • Part of subcall function 004080C7: __vbaFreeVar.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081B3
      • Part of subcall function 004080C7: __vbaI2I4.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081C2
      • Part of subcall function 004080C7: __vbaGet3.MSVBVM60(00000000,?,00000000,0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081CE
      • Part of subcall function 004080C7: __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081DD
      • Part of subcall function 004080C7: __vbaFileClose.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081E3
      • Part of subcall function 004080C7: __vbaStrCopy.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081F5
      • Part of subcall function 004080C7: __vbaFreeStr.MSVBVM60(00408225,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040821F
    • __vbaStrMove.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040650E
    • __vbaFreeStr.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406516
    • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000008,00000000,?,00000008,?), ref: 00406533
    • __vbaInStr.MSVBVM60(00000000,searchbin.org,00000001), ref: 00406551
    • __vbaInStr.MSVBVM60(00000000,searchbin.org,00000001,00000000,searchbin.org,00000001), ref: 00406574
    • __vbaInStr.MSVBVM60(00000000,consented_to_sync,?,00000001,00000000,searchbin.org,00000001,00000000,searchbin.org,00000001), ref: 00406587
    • __vbaFreeStr.MSVBVM60 ref: 004065AE
    • __vbaFreeStr.MSVBVM60 ref: 004065DF
    • __vbaEnd.MSVBVM60 ref: 004065EB
    • __vbaNew2.MSVBVM60(00403710,00409430,00000000,consented_to_sync,?,00000001,00000000,searchbin.org,00000001,00000000,searchbin.org,00000001), ref: 0040662B
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 0040668D
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 004066E3
    • __vbaStrCat.MSVBVM60(\config.xml,?), ref: 004066FF
    • #529.MSVBVM60(00000008,\config.xml,?), ref: 00406712
    • __vbaFreeStr.MSVBVM60(00000008,\config.xml,?), ref: 0040671A
    • __vbaFreeObj.MSVBVM60(00000008,\config.xml,?), ref: 00406722
    • __vbaFreeVar.MSVBVM60(00000008,\config.xml,?), ref: 0040672A
    • __vbaStrI4.MSVBVM60(?,<no>,00000008,\config.xml,?), ref: 00406741
    • __vbaStrMove.MSVBVM60(?,<no>,00000008,\config.xml,?), ref: 0040674B
    • __vbaStrCat.MSVBVM60(00000000,?,<no>,00000008,\config.xml,?), ref: 00406751
    • __vbaStrMove.MSVBVM60(00000000,?,<no>,00000008,\config.xml,?), ref: 0040675B
    • __vbaStrCat.MSVBVM60(<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406766
    • __vbaStrMove.MSVBVM60(<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406770
    • __vbaStrCat.MSVBVM60(<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 0040677B
    • __vbaStrMove.MSVBVM60(<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406785
    • __vbaStrI4.MSVBVM60(?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406791
    • __vbaStrMove.MSVBVM60(?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 0040679B
    • __vbaStrCat.MSVBVM60(00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 004067A1
    • __vbaStrMove.MSVBVM60(00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 004067AB
    • __vbaStrCat.MSVBVM60(<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 004067B6
    • __vbaStrMove.MSVBVM60(<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 004067C0
    • __vbaStrCat.MSVBVM60(<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml), ref: 004067CB
    • __vbaStrMove.MSVBVM60(<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml), ref: 004067D5
    • __vbaStrI4.MSVBVM60(0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>), ref: 004067E1
    • __vbaStrMove.MSVBVM60(0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>), ref: 004067EB
    • __vbaStrCat.MSVBVM60(00000000,0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?), ref: 004067F1
    • __vbaStrMove.MSVBVM60(00000000,0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000,00000000,?), ref: 004067FB
    • __vbaStrCat.MSVBVM60(<\nos>,00000000,00000000,0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000), ref: 00406806
    • __vbaStrMove.MSVBVM60(<\nos>,00000000,00000000,0000000A,00000000,<nos>,00000000,<\noc>,00000000,00000000,?,00000000,<noc>,00000000,<\no>,00000000), ref: 00406810
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033A8,00000700), ref: 00406849
    • __vbaFreeStrList.MSVBVM60(0000000B,?,?,?,?,?,?,?,?,0000000A,?,?), ref: 0040688B
    • __vbaEnd.MSVBVM60(?,?,00000000,consented_to_sync,?,00000001,00000000,searchbin.org,00000001,00000000,searchbin.org,00000001), ref: 0040689A
    • __vbaVarDup.MSVBVM60 ref: 004068C8
    • #666.MSVBVM60(?,?), ref: 004068D5
    • __vbaVarCat.MSVBVM60(?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406914
    • __vbaVarCat.MSVBVM60(?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406928
    • __vbaStrVarMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040692E
    • __vbaStrMove.MSVBVM60(00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406938
    • __vbaStrMove.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 0040694D
    • __vbaFreeStr.MSVBVM60(?,00000000,?,00000008,00000000,?,00000008,?,?,?,?,?,?,?,?,?), ref: 00406955
    • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000008,00000000,?,00000008,?), ref: 00406972
    • __vbaInStr.MSVBVM60(00000000,searchbin.org,00000001,?,?,00000000,searchbin.org,00000001), ref: 00406990
    • __vbaFreeStr.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 004069C9
    • __vbaEnd.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 004069D5
    • __vbaNew2.MSVBVM60(00403710,00409430,00000000,searchbin.org,00000001,?,?,00000000,searchbin.org,00000001), ref: 00406A10
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 00406A72
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 00406AC8
    • __vbaStrCat.MSVBVM60(\config.xml,?), ref: 00406AE4
    • #529.MSVBVM60(00000008,\config.xml,?), ref: 00406AF7
    • __vbaFreeStr.MSVBVM60(00000008,\config.xml,?), ref: 00406AFF
    • __vbaFreeObj.MSVBVM60(00000008,\config.xml,?), ref: 00406B07
    • __vbaFreeVar.MSVBVM60(00000008,\config.xml,?), ref: 00406B0F
    • __vbaStrI4.MSVBVM60(?,<no>,00000008,\config.xml,?), ref: 00406B26
    • __vbaStrMove.MSVBVM60(?,<no>,00000008,\config.xml,?), ref: 00406B30
    • __vbaStrCat.MSVBVM60(00000000,?,<no>,00000008,\config.xml,?), ref: 00406B36
    • __vbaStrMove.MSVBVM60(00000000,?,<no>,00000008,\config.xml,?), ref: 00406B40
    • __vbaStrCat.MSVBVM60(<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B4B
    • __vbaStrMove.MSVBVM60(<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B55
    • __vbaStrCat.MSVBVM60(<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B60
    • __vbaStrMove.MSVBVM60(<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B6A
    • __vbaStrI4.MSVBVM60(00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B76
    • __vbaStrMove.MSVBVM60(00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B80
    • __vbaStrCat.MSVBVM60(00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B86
    • __vbaStrMove.MSVBVM60(00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B90
    • __vbaStrCat.MSVBVM60(<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406B9B
    • __vbaStrMove.MSVBVM60(<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml,?), ref: 00406BA5
    • __vbaStrCat.MSVBVM60(<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml), ref: 00406BB0
    • __vbaStrMove.MSVBVM60(<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>,00000008,\config.xml), ref: 00406BBA
    • __vbaStrI4.MSVBVM60(?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>), ref: 00406BC6
    • __vbaStrMove.MSVBVM60(?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?,<no>), ref: 00406BD0
    • __vbaStrCat.MSVBVM60(00000000,?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?), ref: 00406BD6
    • __vbaStrMove.MSVBVM60(00000000,?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000,00000000,?), ref: 00406BE0
    • __vbaStrCat.MSVBVM60(<\nos>,00000000,00000000,?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000), ref: 00406BEB
    • __vbaStrMove.MSVBVM60(<\nos>,00000000,00000000,?,00000000,<nos>,00000000,<\noc>,00000000,00000000,00000004,00000000,<noc>,00000000,<\no>,00000000), ref: 00406BF5
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033A8,00000700), ref: 00406C2E
    • __vbaFreeStrList.MSVBVM60(0000000B,?,?,?,?,?,?,00000004,?,?,?,?), ref: 00406C70
    • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,searchbin.org,00000001,?,?,00000000,searchbin.org), ref: 00406CB3
    • __vbaEnd.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,searchbin.org,00000001,?,?,00000000,searchbin.org), ref: 00406CBF
    • __vbaStrCopy.MSVBVM60(00000000,searchbin.org,00000001,?,?,00000000,searchbin.org,00000001), ref: 00406CD8
    • __vbaFreeStr.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 00406D07
    • __vbaEnd.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 00406D1E
    • __vbaFreeStr.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 00406D54
    • __vbaEnd.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 00406D60
    • __vbaNew2.MSVBVM60(00403710,00409430,?,?,00000000,searchbin.org,00000001), ref: 00406D9B
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 00406DFD
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 00406E53
    • __vbaStrCat.MSVBVM60(\config.xml,?), ref: 00406E6F
    • #529.MSVBVM60(00000008,\config.xml,?), ref: 00406E82
    • __vbaFreeStr.MSVBVM60(00000008,\config.xml,?), ref: 00406E8A
    • __vbaFreeObj.MSVBVM60(00000008,\config.xml,?), ref: 00406E92
    • __vbaFreeVar.MSVBVM60(00000008,\config.xml,?), ref: 00406E9A
    • __vbaStrI4.MSVBVM60(00000002,<no>,00000008,\config.xml,?), ref: 00406EB1
    • __vbaStrMove.MSVBVM60(00000002,<no>,00000008,\config.xml,?), ref: 00406EBB
    • __vbaStrCat.MSVBVM60(00000000,00000002,<no>,00000008,\config.xml,?), ref: 00406EC1
    • __vbaStrMove.MSVBVM60(00000000,00000002,<no>,00000008,\config.xml,?), ref: 00406ECB
    • __vbaStrCat.MSVBVM60(<\no>,00000000,00000000,00000002,<no>,00000008,\config.xml,?), ref: 00406ED6
    • __vbaFreeStr.MSVBVM60(004071A5), ref: 0040719F
    • __vbaErrorOverflow.MSVBVM60(?,?,00000000,searchbin.org,00000001), ref: 004071C4
    • __vbaInStr.MSVBVM60(00000000,?,?,?), ref: 0040721C
    • __vbaLenBstr.MSVBVM60(?,00000000,?,?,?), ref: 00407229
    • __vbaInStr.MSVBVM60(00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407242
    • #631.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407262
    • __vbaStrMove.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 0040726C
    • __vbaFreeVar.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407274
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Move$Free$CheckHresult$List$New2$#666$#529Error$#570ChkstkCopyFile$#526#631#648BstrCloseGet3OpenOverflow
    • String ID: --new-window about:blank$3$<\no>$<\noc>$<\nos>$<no>$<noc>$<nos>$C:\Program Files\Google\Chrome\Application\chrome.exe$USERPROFILE$\AppData$\Local\Google\Chrome\User Data\Default\Preferences$\Local\Google\Chrome\User Data\Default\Secure Preferences$\Local\Google\Chrome\User Data\Default\Web Data$\config.xml$\scsearch.cmd$chrome.exe$consented_to_sync$open$searchbin.org
    • API String ID: 4186687548-712572182
    • Opcode ID: e2d87f5d9b60a91e3779c17048a7abad53b6fd50ecc9942f32ac93be17457ec6
    • Instruction ID: 81ec297902dc8c15080008829ccf919422ac6a2b520c5a52d3fdb0b4ea67f9e8
    • Opcode Fuzzy Hash: e2d87f5d9b60a91e3779c17048a7abad53b6fd50ecc9942f32ac93be17457ec6
    • Instruction Fuzzy Hash: CBC2D972D00218AFDB11EFA5C945BDEBBB8AF04308F1081BAE505B71A1DB789B45DF64
    Function 00407B08 Relevance: 140.4, APIs: 74, Strings: 6, Instructions: 423COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 152 407b08-407b68 __vbaChkstk __vbaOnError 153 4080c2 __vbaErrorOverflow 152->153 154 407b6e-4080b2 __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403e44 __vbaSetSystemError call 403d20 __vbaSetSystemError call 40785b call 403d20 __vbaSetSystemError __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 40785b __vbaI4Str call 403e44 __vbaSetSystemError __vbaI4Str call 403d54 __vbaSetSystemError __vbaVarDup call 408239 __vbaFreeVar call 403d20 __vbaSetSystemError 152->154 156 4080c7-40817c __vbaChkstk __vbaOnError #648 __vbaFreeVar __vbaI2I4 __vbaFileOpen __vbaI2I4 #570 153->156 158 4081d3-408224 __vbaI2I4 __vbaFileClose __vbaStrCopy __vbaFreeStr 156->158 159 40817e-4081ce __vbaI2I4 #570 #526 __vbaStrVarMove __vbaStrMove __vbaFreeVar __vbaI2I4 __vbaGet3 156->159 159->158
    APIs
    • __vbaChkstk.MSVBVM60(00000000,00401766,?,?,?,?,004073BF,000000FF,00000000,00000000,00000001,?,?,?), ref: 00407B24
    • __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,00401766), ref: 00407B54
    • __vbaI4Str.MSVBVM60(000000FF,?,00000000,?,00000000,00401766), ref: 00407B80
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,?,00000000,?,00000000,00401766), ref: 00407B8B
    • __vbaVarDup.MSVBVM60 ref: 00407BB0
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60(000000FF,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00408255
      • Part of subcall function 00408239: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 00408285
      • Part of subcall function 00408239: #716.MSVBVM60(00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 0040829C
      • Part of subcall function 00408239: __vbaObjVar.MSVBVM60(00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082A5
      • Part of subcall function 00408239: __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082AF
      • Part of subcall function 00408239: __vbaFreeVar.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082B7
      • Part of subcall function 00408239: __vbaVarVargNofree.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082C9
      • Part of subcall function 00408239: __vbaStrErrVarCopy.MSVBVM60(00000000,?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082CF
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60 ref: 004082EE
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60 ref: 004082FF
      • Part of subcall function 00408239: __vbaLateMemCall.MSVBVM60(?,Sendkeys,00000002), ref: 00408317
      • Part of subcall function 00408239: __vbaFreeVar.MSVBVM60(00000000,00000000,00000000,wscript.shell), ref: 00408322
      • Part of subcall function 00408239: __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,00000000,wscript.shell), ref: 00408334
      • Part of subcall function 00408239: __vbaFreeObj.MSVBVM60(00408352,?,00000000,00000000,00000000,00000000,wscript.shell), ref: 0040834C
    • __vbaFreeVar.MSVBVM60(000000FF,00000000), ref: 00407BC5
      • Part of subcall function 0040785B: __vbaChkstk.MSVBVM60(?,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00407877
      • Part of subcall function 0040785B: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078A7
      • Part of subcall function 0040785B: __vbaOnError.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078B5
      • Part of subcall function 0040785B: #535.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078C1
      • Part of subcall function 0040785B: __vbaSetSystemError.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040790A
      • Part of subcall function 0040785B: #598.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040791C
      • Part of subcall function 0040785B: #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407928
      • Part of subcall function 0040785B: __vbaFpR4.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040792D
      • Part of subcall function 0040785B: #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040795E
      • Part of subcall function 0040785B: __vbaExitProc.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407AD3
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000), ref: 00407BF0
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000), ref: 00407BFB
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000), ref: 00407C20
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407C35
    • __vbaI4Str.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407C47
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407C52
    • __vbaVarDup.MSVBVM60(00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407C77
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407C8C
    • __vbaI4Str.MSVBVM60(00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407CB9
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407CC4
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407CD7
    • __vbaSetSystemError.MSVBVM60(000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407D03
    • __vbaI4Str.MSVBVM60(000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407D15
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407D20
    • __vbaVarDup.MSVBVM60(00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407D45
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000,?), ref: 00407D5A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000,00000000), ref: 00407D85
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000), ref: 00407D90
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,000000FF,00000000), ref: 00407DB5
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407DCA
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000), ref: 00407DF5
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF), ref: 00407E00
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,000000FF), ref: 00407E25
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000,00000000), ref: 00407E3A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000), ref: 00407E65
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000), ref: 00407E70
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000), ref: 00407E95
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF), ref: 00407EAA
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407ED5
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407EE0
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F05
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407F1A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407F45
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F50
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F75
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407F8A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407FB5
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407FC0
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407FE5
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407FFA
    • __vbaI4Str.MSVBVM60(0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00408027
    • __vbaSetSystemError.MSVBVM60(00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 00408032
    • __vbaI4Str.MSVBVM60(00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 00408044
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 0040804F
    • __vbaVarDup.MSVBVM60(00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00408074
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00408089
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,00000000,00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 0040809C
    • __vbaErrorOverflow.MSVBVM60(000000FF,?,00000000,?,00000000,00401766), ref: 004080C2
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 004080E3
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00408113
    • #648.MSVBVM60(0000000A), ref: 00408131
    • __vbaFreeVar.MSVBVM60(0000000A), ref: 0040813F
    • __vbaI2I4.MSVBVM60(?,0000000A), ref: 00408153
    • __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 00408160
    • __vbaI2I4.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 0040816F
    • #570.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408175
    • __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408188
    • #570.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040818E
    • #526.MSVBVM60(0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408198
    • __vbaStrVarMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081A1
    • __vbaStrMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081AB
    • __vbaFreeVar.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081B3
    • __vbaI2I4.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081C2
    • __vbaGet3.MSVBVM60(00000000,?,00000000,0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081CE
    • __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081DD
    • __vbaFileClose.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081E3
    • __vbaStrCopy.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081F5
    • __vbaFreeStr.MSVBVM60(00408225,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040821F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Error$FreeSystem$Chkstk$#535$#570AddrefCopyFileMove$#526#598#648#716CallCloseExitGet3LateNofreeOpenOverflowProcVarg
    • String ID: %{F4}$($chrome://settings/searchEngines$searchbin${ENTER}${TAB}
    • API String ID: 1876089844-1676975298
    • Opcode ID: ca479e800ff32aa33247eb6b9ecce17d2b7615a5abb97a07e07b44ac415a5772
    • Instruction ID: a0ccc39395e5f37a6b666f65872c3af7b1124e290a2e432bcd6dd6ea00620131
    • Opcode Fuzzy Hash: ca479e800ff32aa33247eb6b9ecce17d2b7615a5abb97a07e07b44ac415a5772
    • Instruction Fuzzy Hash: 310294B2C11209EADB00FFA1D959BDDBBB8BF00348F10856EF101771E2DB785A499B59
    Function 00405A87 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 116COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 00405AA5
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00405AD5
    • __vbaStrCat.MSVBVM60(00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405AEB
    • __vbaStrMove.MSVBVM60(00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405AF5
    • __vbaStrCat.MSVBVM60(00403AA0,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405B00
    • __vbaVarDup.MSVBVM60 ref: 00405B3A
    • #626.MSVBVM60(?,00000000,0000000A), ref: 00405B4B
    • __vbaChkstk.MSVBVM60(?,00000000,0000000A), ref: 00405B53
    • __vbaVarLateMemCallLd.MSVBVM60(?,?,ExecQuery,00000001,?,00000000,0000000A), ref: 00405B73
    • __vbaObjVar.MSVBVM60(00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405B7C
    • __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405B89
    • __vbaForEachCollAd.MSVBVM60(?,?,00000000,?,00000000,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405B9A
    • __vbaFreeStr.MSVBVM60(?,?,00000000,?,00000000,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF,?,?,?,?,00401766), ref: 00405BA8
    • __vbaFreeVarList.MSVBVM60(00000005,00000000,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF), ref: 00405BC6
    • __vbaNextEachCollAd.MSVBVM60(?,?), ref: 00405BEE
    • __vbaFreeObjList.MSVBVM60(00000002,?,?,00405C58,?,?), ref: 00405C47
    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,00000000,?,00000000,00000000,00000000,Select Name from Win32_Process Where Name = ',000000FF), ref: 00405C52
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Free$ChkstkCollEachList$#626AddrefCallErrorLateMoveNext
    • String ID: ExecQuery$Select Name from Win32_Process Where Name = '$winmgmts:
    • API String ID: 2087024845-1728417821
    • Opcode ID: ae1e5c6a4a02adbd2971238eeceb8222ed51d1a0215ffb9028c7c069e8e6d5b0
    • Instruction ID: 446a3894490e32008951607a9032805612bafcaf9972e9decba46b2d6c5585e7
    • Opcode Fuzzy Hash: ae1e5c6a4a02adbd2971238eeceb8222ed51d1a0215ffb9028c7c069e8e6d5b0
    • Instruction Fuzzy Hash: 7241C8B2D0020CAAEB11EFD5C845FDEB7BCAB04304F5081AAF115BB191DB785B498FA5
    Function 00407411 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 124fileCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 0040742D
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00407468
    • #648.MSVBVM60(0000000A), ref: 00407486
    • __vbaFreeVar.MSVBVM60(0000000A), ref: 00407494
    • __vbaNew2.MSVBVM60(00403710,00409430,0000000A), ref: 004074B3
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 004074F7
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 00407532
    • __vbaStrCat.MSVBVM60(\config.xml,?), ref: 00407548
    • __vbaStrMove.MSVBVM60(\config.xml,?), ref: 00407552
    • __vbaI2I4.MSVBVM60(00000000,\config.xml,?), ref: 0040755B
    • __vbaFileOpen.MSVBVM60(00000008,000000FF,00000000,00000000,\config.xml,?), ref: 00407565
    • __vbaFreeStrList.MSVBVM60(00000002,?,?,00000008,000000FF,00000000,00000000,\config.xml,?), ref: 00407574
    • __vbaFreeObj.MSVBVM60(?,?,00401766), ref: 0040757F
    • __vbaI2I4.MSVBVM60(00000000,?,?,00401766), ref: 00407593
    • __vbaPrintFile.MSVBVM60(0040415C,00000000,00000000,?,?,00401766), ref: 0040759E
    • __vbaI2I4.MSVBVM60(?,?,?,?,?,00401766), ref: 004075B0
    • __vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,00401766), ref: 004075B6
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$FileFree$CheckHresult$#648ChkstkCloseErrorListMoveNew2OpenPrint
    • String ID: \config.xml
    • API String ID: 4233488025-127920364
    • Opcode ID: f33ccce571e312d2545654ed63b3f19d8f42c1bd8f7d85301cc1819d469ec3df
    • Instruction ID: 726068ea63843b647cc15b5922ec19383417bb8284cb42c9973c29f63a5e4022
    • Opcode Fuzzy Hash: f33ccce571e312d2545654ed63b3f19d8f42c1bd8f7d85301cc1819d469ec3df
    • Instruction Fuzzy Hash: 1051E7B1D04208AFDB00EFE5C945BDDBBB4BB04318F20816AF101BB2E1D7795A04DB59
    Function 004080C7 Relevance: 30.1, APIs: 20, Instructions: 86COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 004080E3
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00408113
    • #648.MSVBVM60(0000000A), ref: 00408131
    • __vbaFreeVar.MSVBVM60(0000000A), ref: 0040813F
    • __vbaI2I4.MSVBVM60(?,0000000A), ref: 00408153
    • __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 00408160
    • __vbaI2I4.MSVBVM60(00000120,000000FF,00000000,?,0000000A), ref: 0040816F
    • #570.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408175
    • __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408188
    • #570.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040818E
    • #526.MSVBVM60(0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 00408198
    • __vbaStrVarMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081A1
    • __vbaStrMove.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081AB
    • __vbaFreeVar.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081B3
    • __vbaI2I4.MSVBVM60(0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081C2
    • __vbaGet3.MSVBVM60(00000000,?,00000000,0000000A,0000000A,00000000,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081CE
    • __vbaI2I4.MSVBVM60(00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081DD
    • __vbaFileClose.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081E3
    • __vbaStrCopy.MSVBVM60(00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 004081F5
    • __vbaFreeStr.MSVBVM60(00408225,00000000,00000000,00000120,000000FF,00000000,?,0000000A), ref: 0040821F
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Free$#570FileMove$#526#648ChkstkCloseCopyErrorGet3Open
    • String ID:
    • API String ID: 848986026-0
    • Opcode ID: b9c988f50762e1f42bd4044532c7f8afc5e7c4b4bbcaf4a72e43ba7aca64bb3a
    • Instruction ID: 192901e60949e60abddf98d9c747286e910dc2d9051fb4a473a1e2700c44341c
    • Opcode Fuzzy Hash: b9c988f50762e1f42bd4044532c7f8afc5e7c4b4bbcaf4a72e43ba7aca64bb3a
    • Instruction Fuzzy Hash: F731DDB5D00208AADB05FFA6D955BDEBB78AF04308F10856EF111771E2DB785A08DB54
    Function 00408550 Relevance: 16.6, APIs: 11, Instructions: 65COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(00000000,00401766), ref: 0040856C
    • __vbaStrCopy.MSVBVM60(?,?,?,00000000,00401766), ref: 00408599
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,00401766), ref: 004085A7
    • #600.MSVBVM60(00004008,00000000), ref: 004085C7
    • __vbaFpI4.MSVBVM60(00004008,00000000), ref: 004085CC
    • __vbaOnError.MSVBVM60(00000000,00004008,00000000), ref: 004085DD
    • #598.MSVBVM60(00000000,00004008,00000000), ref: 004085E9
    • __vbaSetSystemError.MSVBVM60(00100000,00000000,?,00000000,00004008,00000000), ref: 00408607
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,00100000,00000000,?,00000000,00004008,00000000), ref: 00408630
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,000000FF,00100000,00000000,?,00000000,00004008,00000000), ref: 00408644
    • __vbaFreeStr.MSVBVM60(00408658,00100000,00000000,?,00000000,00004008,00000000), ref: 00408652
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Error$System$#598#600ChkstkCopyFree
    • String ID:
    • API String ID: 2004912071-0
    • Opcode ID: d437f5286443e835dc7f1c724543d2cae34ff7b020b60e29c469e74aacbc4dfa
    • Instruction ID: 7517123636db62f08c5f402fb29260e4f6c50c2b97ea237a8552e783dbfe27c2
    • Opcode Fuzzy Hash: d437f5286443e835dc7f1c724543d2cae34ff7b020b60e29c469e74aacbc4dfa
    • Instruction Fuzzy Hash: E421C7B1C41208EADB11FFA6C906BCDBBB4EF05719F10816AE114772E1C7B91B449B69
    Function 00408669 Relevance: 9.0, APIs: 6, Instructions: 33COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00000000,00401766), ref: 004086A3
    • __vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,00000000,00401766), ref: 004086AA
    • #579.MSVBVM60(?,00000001,?,?,?,?,?,?,?,?,00000000,00401766), ref: 004086B2
    • __vbaI2I4.MSVBVM60(?,00000001,?,?,?,?,?,?,?,?,00000000,00401766), ref: 004086B9
    • __vbaExitProc.MSVBVM60(?,00000001), ref: 004086C8
    • __vbaFreeStr.MSVBVM60(004086DB,?,00000001), ref: 004086D5
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$#579CopyErrorExitFreeProc
    • String ID:
    • API String ID: 2402984289-0
    • Opcode ID: de301805d5208372b78eb789df5a5a1bd4ec956f38e7ed7d508780ae18c52df3
    • Instruction ID: c7ca3cd3966a5db7d8c15ebcda69731f7905b10847d8bd9a0d84444d5b2987cc
    • Opcode Fuzzy Hash: de301805d5208372b78eb789df5a5a1bd4ec956f38e7ed7d508780ae18c52df3
    • Instruction Fuzzy Hash: D9F03171900208AACB00FBA9CA52A9EBBB4AB14704F50417EE055B31E2D7790A008BA5
    Function 00403C34 Relevance: .0, Instructions: 8COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 284 403c34-403c3b 285 403c3d 284->285 286 403c3f-403c44 284->286 285->286 287 403c4b 286->287 287->287
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 6975ce1ccd12cf26a00fd2c63556b782eabfc4bccc9ba50c2d49a07b6cc1b730
    • Instruction ID: ef15f6299607b504d3799c77c8c1f0724ce1870abe4c03c10b3f0798aeb0ce53
    • Opcode Fuzzy Hash: 6975ce1ccd12cf26a00fd2c63556b782eabfc4bccc9ba50c2d49a07b6cc1b730
    • Instruction Fuzzy Hash: 2EB012213CC0419AF3204B544D01432358492443813244C3BF510F73E2CB38CE40953D

    Non-executed Functions

    Function 00405C75 Relevance: 61.5, APIs: 29, Strings: 6, Instructions: 222COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 00405C91
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00405CD2
    • #648.MSVBVM60(0000000A), ref: 00405CF0
    • __vbaFreeVar.MSVBVM60(0000000A), ref: 00405CFC
    • __vbaFileOpen.MSVBVM60(00000001,000000FF,?,00000000,0000000A), ref: 00405D14
    • #570.MSVBVM60(?,00000001,000000FF,?,00000000,0000000A), ref: 00405D23
    • #621.MSVBVM60(0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D35
    • __vbaStrVarMove.MSVBVM60(0000000A,0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D3E
    • __vbaStrMove.MSVBVM60(0000000A,0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D48
    • __vbaFreeVar.MSVBVM60(0000000A,0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D50
    • __vbaStrCopy.MSVBVM60(0000000A,0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D6B
    • __vbaStrCopy.MSVBVM60(0000000A,0000000A,?,?,?,00000001,000000FF,?,00000000,0000000A), ref: 00405D78
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033A8,000006FC), ref: 00405DB8
    • __vbaStrCopy.MSVBVM60(00000000,?,004033A8,000006FC), ref: 00405DCF
    • __vbaFreeStrList.MSVBVM60(00000003,?,000000FF,?), ref: 00405DE2
    • __vbaI4Str.MSVBVM60(?,?,?,?,00401766), ref: 00405DF7
    • __vbaStrCopy.MSVBVM60 ref: 00405E18
    • __vbaStrCopy.MSVBVM60 ref: 00405E25
    • __vbaHresultCheckObj.MSVBVM60(?,?,004033A8,000006FC), ref: 00405E65
    • __vbaStrCopy.MSVBVM60(?,?,004033A8,000006FC), ref: 00405E7C
    • __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00405E8F
    • __vbaI4Str.MSVBVM60(?,?,?,?,?,?,?,?,00401766), ref: 00405EA4
    • __vbaStrCopy.MSVBVM60 ref: 00405EC5
    • __vbaStrCopy.MSVBVM60 ref: 00405ED2
    • __vbaHresultCheckObj.MSVBVM60(?,?,004033A8,000006FC), ref: 00405F12
    • __vbaStrCopy.MSVBVM60(?,?,004033A8,000006FC), ref: 00405F29
    • __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00405F3C
    • __vbaI4Str.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401766), ref: 00405F51
    • __vbaFileClose.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401766), ref: 00405F66
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Copy$Free$CheckHresultList$FileMove$#570#621#648ChkstkCloseErrorOpen
    • String ID: <\no>$<\noc>$<\nos>$<no>$<noc>$<nos>
    • API String ID: 3544903097-2179780191
    • Opcode ID: 811644d99b0ba18e03d117fa7b8f6acbda8abc20d120ba09e6e3689cc8bdc5f7
    • Instruction ID: 5b4deb8dc5d1d309a5a618e7ecdb3caa85dc1cb6a2c4e72963564ea347902074
    • Opcode Fuzzy Hash: 811644d99b0ba18e03d117fa7b8f6acbda8abc20d120ba09e6e3689cc8bdc5f7
    • Instruction Fuzzy Hash: D2A1D672900208AFDB01EFD5C945BDEBBB9EF08314F20806AF515BB2A1D7799A45CF94
    Function 00407E3C Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 147COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
      • Part of subcall function 0040785B: __vbaChkstk.MSVBVM60(?,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00407877
      • Part of subcall function 0040785B: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078A7
      • Part of subcall function 0040785B: __vbaOnError.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078B5
      • Part of subcall function 0040785B: #535.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078C1
      • Part of subcall function 0040785B: __vbaSetSystemError.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040790A
      • Part of subcall function 0040785B: #598.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040791C
      • Part of subcall function 0040785B: #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407928
      • Part of subcall function 0040785B: __vbaFpR4.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040792D
      • Part of subcall function 0040785B: #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040795E
      • Part of subcall function 0040785B: __vbaExitProc.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407AD3
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000,00000000), ref: 00407E65
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000), ref: 00407E70
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF,?,00000000), ref: 00407E95
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60(000000FF,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00408255
      • Part of subcall function 00408239: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 00408285
      • Part of subcall function 00408239: #716.MSVBVM60(00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 0040829C
      • Part of subcall function 00408239: __vbaObjVar.MSVBVM60(00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082A5
      • Part of subcall function 00408239: __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082AF
      • Part of subcall function 00408239: __vbaFreeVar.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082B7
      • Part of subcall function 00408239: __vbaVarVargNofree.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082C9
      • Part of subcall function 00408239: __vbaStrErrVarCopy.MSVBVM60(00000000,?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082CF
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60 ref: 004082EE
      • Part of subcall function 00408239: __vbaChkstk.MSVBVM60 ref: 004082FF
      • Part of subcall function 00408239: __vbaLateMemCall.MSVBVM60(?,Sendkeys,00000002), ref: 00408317
      • Part of subcall function 00408239: __vbaFreeVar.MSVBVM60(00000000,00000000,00000000,wscript.shell), ref: 00408322
      • Part of subcall function 00408239: __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,00000000,wscript.shell), ref: 00408334
      • Part of subcall function 00408239: __vbaFreeObj.MSVBVM60(00408352,?,00000000,00000000,00000000,00000000,wscript.shell), ref: 0040834C
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,000000FF), ref: 00407EAA
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407ED5
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407EE0
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F05
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407F1A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407F45
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F50
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407F75
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407F8A
    • __vbaI4Str.MSVBVM60(?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000), ref: 00407FB5
    • __vbaSetSystemError.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407FC0
    • __vbaVarDup.MSVBVM60(00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00407FE5
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00407FFA
    • __vbaI4Str.MSVBVM60(0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00408027
    • __vbaSetSystemError.MSVBVM60(00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 00408032
    • __vbaI4Str.MSVBVM60(00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 00408044
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 0040804F
    • __vbaVarDup.MSVBVM60(00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?), ref: 00408074
    • __vbaFreeVar.MSVBVM60(000000FF,00000000,00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF,00000000), ref: 00408089
    • __vbaSetSystemError.MSVBVM60(00000000,000000FF,00000000,00000000,00000000,0000000B,?,000000FF,00000000,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 0040809C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Error$FreeSystem$Chkstk$#535$Addref$#598#716CallCopyExitLateNofreeProcVarg
    • String ID: %{F4}$(${ENTER}${TAB}
    • API String ID: 1263919342-741405084
    • Opcode ID: cccab48f81030bcd87ef75a4f10a4cfd7d8a5784bb419b0e92c5cc4b2e7ed0f0
    • Instruction ID: a86730d22c78510cd4e09e753203e64df0386319e86a2427419bac41b7672f92
    • Opcode Fuzzy Hash: cccab48f81030bcd87ef75a4f10a4cfd7d8a5784bb419b0e92c5cc4b2e7ed0f0
    • Instruction Fuzzy Hash: 8551A6B2C11109EADF00FFE1D999ACDBBB8BF00349F10846EF101760E2DB785A499B59
    Function 004057BF Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 201COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 004057DB
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00405811
    • __vbaNew.MSVBVM60(00403620,000000FF,?,?,?,?,00401766), ref: 00405822
    • __vbaObjSet.MSVBVM60(00403620,00000000,00403620,000000FF,?,?,?,?,00401766), ref: 0040582C
    • __vbaObjSetAddref.MSVBVM60(?,00403620,00403620,00000000,00403620,000000FF,?,?,?,?,00401766), ref: 0040583F
    • __vbaChkstk.MSVBVM60 ref: 00405859
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000024), ref: 00405894
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000028), ref: 004058D6
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000028), ref: 00405918
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000028), ref: 0040595A
    • __vbaChkstk.MSVBVM60(00000000,?,00403610,00000028), ref: 00405980
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000034), ref: 004059B1
    • __vbaChkstk.MSVBVM60(?), ref: 004059DB
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403610,00000054), ref: 00405A0C
    • __vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00405A27
    • __vbaCastObj.MSVBVM60(00000000,00403610,?,00000000), ref: 00405A3A
    • __vbaObjSet.MSVBVM60(00403620,00000000,00000000,00403610,?,00000000), ref: 00405A44
    • __vbaFreeObj.MSVBVM60(00405A6A,00403620,00000000,00000000,00403610,?,00000000), ref: 00405A5C
    • __vbaFreeObj.MSVBVM60(00405A6A,00403620,00000000,00000000,00403610,?,00000000), ref: 00405A64
    Strings
    • application/x-www-form-urlencoded, xrefs: 0040592D
    • GET, xrefs: 0040586C
    • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36 Edg/84.0.522.5, xrefs: 004058A9
    • text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8, xrefs: 004058EB
    • Content-Type, xrefs: 00405932
    • Accept, xrefs: 004058F0
    • User-Agent, xrefs: 004058AE
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$CheckHresult$Chkstk$AddrefFree$CastError
    • String ID: Accept$Content-Type$GET$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36 Edg/84.0.522.5$User-Agent$application/x-www-form-urlencoded$text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    • API String ID: 1842893189-504762343
    • Opcode ID: 674279092d2e5bd32679f66718147f7b5bffc0dede9d8c9807e405f675cca271
    • Instruction ID: 4626b93129a506694ace89990d13f655c080643502275c86c9a171b5ca8b4981
    • Opcode Fuzzy Hash: 674279092d2e5bd32679f66718147f7b5bffc0dede9d8c9807e405f675cca271
    • Instruction Fuzzy Hash: E781C1B1D00618EFDF11EFE1C945B9EBBB5AF04715F20842AE110BB2E1C7B95A159F48
    Function 00407970 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 115COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • #685.MSVBVM60 ref: 00407977
    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00407981
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004043E4,00000024), ref: 004079B0
    • __vbaInStr.MSVBVM60(00000000, of ,?,00000001), ref: 004079CA
    • __vbaFreeStr.MSVBVM60(00000000, of ,?,00000001), ref: 004079DD
    • __vbaFreeObj.MSVBVM60(00000000, of ,?,00000001), ref: 004079E5
    • #685.MSVBVM60(00000000, of ,?,00000001), ref: 004079F9
    • __vbaObjSet.MSVBVM60(?,00000000,00000000, of ,?,00000001), ref: 00407A03
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004043E4,00000028), ref: 00407A33
    • __vbaFreeObj.MSVBVM60 ref: 00407A44
    • #685.MSVBVM60(00000000, of ,?,00000001), ref: 00407A50
    • __vbaObjSet.MSVBVM60(?,00000000,00000000, of ,?,00000001), ref: 00407A5A
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004043E4,0000002C), ref: 00407A89
    • __vbaFreeStr.MSVBVM60 ref: 00407A9A
    • __vbaFreeObj.MSVBVM60 ref: 00407AA2
    • #685.MSVBVM60 ref: 00407AAE
    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00407AB8
    • __vbaFreeObj.MSVBVM60 ref: 00407ACE
    • __vbaExitProc.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407AD3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Free$#685$CheckHresult$ExitProc
    • String ID: of $Pause of Module Module1
    • API String ID: 702240550-2600979415
    • Opcode ID: a65c55e1711da7352c3465e6af9c4d71b5eab40d7921c77667ba85d396a7a17e
    • Instruction ID: bcc9841c5ef64846aa14b3bb82d8dde63ed29e7ae1935dadc93b54cb3f05fd1d
    • Opcode Fuzzy Hash: a65c55e1711da7352c3465e6af9c4d71b5eab40d7921c77667ba85d396a7a17e
    • Instruction Fuzzy Hash: DA41B0B1E11218EFDF04EBE2D945ADDBBB5BF08309F10412AF101B71A1DB785A05DB19
    Function 00407605 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 124fileCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 00407621
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 0040765C
    • #648.MSVBVM60(0000000A), ref: 0040767A
    • __vbaFreeVar.MSVBVM60(0000000A), ref: 00407688
    • __vbaNew2.MSVBVM60(00403710,00409430,0000000A), ref: 004076A7
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403700,00000014), ref: 004076EB
    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403720,00000050), ref: 00407726
    • __vbaStrCat.MSVBVM60(\endz.bat,?), ref: 0040773C
    • __vbaStrMove.MSVBVM60(\endz.bat,?), ref: 00407746
    • __vbaI2I4.MSVBVM60(00000000,\endz.bat,?), ref: 0040774F
    • __vbaFileOpen.MSVBVM60(00000008,000000FF,00000000,00000000,\endz.bat,?), ref: 00407759
    • __vbaFreeStrList.MSVBVM60(00000002,?,?,00000008,000000FF,00000000,00000000,\endz.bat,?), ref: 00407768
    • __vbaFreeObj.MSVBVM60(?,?,00401766), ref: 00407773
    • __vbaI2I4.MSVBVM60(00000000,?,?,00401766), ref: 00407787
    • __vbaPrintFile.MSVBVM60(0040415C,00000000,00000000,?,?,00401766), ref: 00407792
    • __vbaI2I4.MSVBVM60(?,?,?,?,?,00401766), ref: 004077A4
    • __vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,00401766), ref: 004077AA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$FileFree$CheckHresult$#648ChkstkCloseErrorListMoveNew2OpenPrint
    • String ID: \endz.bat
    • API String ID: 4233488025-836411913
    • Opcode ID: a5cf55fc2c6a7299c5100dee2d74f6d936dc8adb580c39f17066be930d0f1b1c
    • Instruction ID: eb3d0e3b09e24125154fe4d43b1921289b3d4521f638bcb25b0956297f06d492
    • Opcode Fuzzy Hash: a5cf55fc2c6a7299c5100dee2d74f6d936dc8adb580c39f17066be930d0f1b1c
    • Instruction Fuzzy Hash: 7851E6B1D04208EFDB00EFE5C945BDDBBB4BB08318F20812AE101BB2E1D7796A45DB59
    Function 00403218 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 85COMMON
    Download Yara Rule
    APIs
    • __vbaStrI2.MSVBVM60(00000000,00000001,?,?,?), ref: 0040730A
    • __vbaStrMove.MSVBVM60(00000000,00000001,?,?,?), ref: 00407314
    • __vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000001,?,?,?), ref: 0040731E
    • __vbaStrToAnsi.MSVBVM60(?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040732D
    • __vbaStrToAnsi.MSVBVM60(?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040733C
    • __vbaStrToAnsi.MSVBVM60(?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040734B
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?), ref: 00407357
    • __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,00000000,00000000,?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank), ref: 00407372
    • __vbaSetSystemError.MSVBVM60(000000FF,00000000,00000000,00000001,?,?,?), ref: 00407381
    • __vbaLenBstr.MSVBVM60(000000FF,00000000,00000000,00000001,?,?,?), ref: 0040738C
      • Part of subcall function 00408363: __vbaChkstk.MSVBVM60(?,00401766,?,?,?,004073A1,?,000000FF,00000000,00000000,00000001,?,?,?), ref: 0040837F
      • Part of subcall function 00408363: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,?,00401766), ref: 004083AF
      • Part of subcall function 00408363: __vbaSetSystemError.MSVBVM60(?,004083F6,00000000,000000FF,?,00000000,?,?,00401766), ref: 004083CC
    • __vbaStrMove.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073A6
    • __vbaFreeStr.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073AE
    • #598.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073B3
    Strings
    • --new-window about:blank, xrefs: 00407327
    • C:\Program Files\Google\Chrome\Application\chrome.exe, xrefs: 00407336
    • open, xrefs: 00407345
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$AnsiError$System$FreeMove$#598BstrChkstkList
    • String ID: --new-window about:blank$C:\Program Files\Google\Chrome\Application\chrome.exe$open
    • API String ID: 1113896204-3556789961
    • Opcode ID: 0930aed2b5ee13716c77e17afc936e3a1f5a6044ac9741c058973f1387b3f26c
    • Instruction ID: 4f5327f00a6b78534dd0944f096b154270bd006c7e664a11aa52557e301cce0e
    • Opcode Fuzzy Hash: 0930aed2b5ee13716c77e17afc936e3a1f5a6044ac9741c058973f1387b3f26c
    • Instruction Fuzzy Hash: 0931DFB2D10218BADB01FBA5D942DDEBBBCAF08B14F10813BF511B2191DB7856448BA9
    Function 00408239 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 82COMMON
    Download Yara Rule
    APIs
    • __vbaChkstk.MSVBVM60(000000FF,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00408255
    • __vbaOnError.MSVBVM60(000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 00408285
    • #716.MSVBVM60(00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 0040829C
    • __vbaObjVar.MSVBVM60(00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082A5
    • __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082AF
    • __vbaFreeVar.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082B7
    • __vbaVarVargNofree.MSVBVM60(?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082C9
    • __vbaStrErrVarCopy.MSVBVM60(00000000,?,00000000,00000000,00000000,wscript.shell,00000000,000000FF,?,00000000,?,000000FF,00401766,000000FF), ref: 004082CF
    • __vbaChkstk.MSVBVM60 ref: 004082EE
    • __vbaChkstk.MSVBVM60 ref: 004082FF
    • __vbaLateMemCall.MSVBVM60(?,Sendkeys,00000002), ref: 00408317
    • __vbaFreeVar.MSVBVM60(00000000,00000000,00000000,wscript.shell), ref: 00408322
    • __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,00000000,wscript.shell), ref: 00408334
    • __vbaFreeObj.MSVBVM60(00408352,?,00000000,00000000,00000000,00000000,wscript.shell), ref: 0040834C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$ChkstkFree$Addref$#716CallCopyErrorLateNofreeVarg
    • String ID: Sendkeys$wscript.shell
    • API String ID: 2317557238-2703340374
    • Opcode ID: 3aa126790aa8d38722bb6b45166ceae3e63db01d09bf6553b643586cc3300b2d
    • Instruction ID: 845078678ea0ac4086a93db7b85c2988f8ef500e18684ac0f9fcb2d015b9514e
    • Opcode Fuzzy Hash: 3aa126790aa8d38722bb6b45166ceae3e63db01d09bf6553b643586cc3300b2d
    • Instruction Fuzzy Hash: 172121B1D41708AADB00FFA5CA56BCEB7B9AF05704F60442AF5007B1D1DBBD6B088B58
    Function 004083F6 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 80COMMON
    Download Yara Rule
    APIs
    • __vbaChkstk.MSVBVM60(?,00401766), ref: 00408412
    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401766), ref: 00408442
    • __vbaSetSystemError.MSVBVM60(?,000000FF), ref: 00408467
    • #526.MSVBVM60(?,00000064,?,000000FF), ref: 0040847F
    • __vbaStrVarMove.MSVBVM60(?,?,00000064,?,000000FF), ref: 00408488
    • __vbaStrMove.MSVBVM60(?,?,00000064,?,000000FF), ref: 00408492
    • __vbaFreeVar.MSVBVM60(?,?,00000064,?,000000FF), ref: 0040849A
    • __vbaStrToAnsi.MSVBVM60(?,000000FF,00000064,?,?,00000064,?,000000FF), ref: 004084AF
    • __vbaSetSystemError.MSVBVM60(?,00000000,?,000000FF,00000064,?,?,00000064,?,000000FF), ref: 004084BD
    • __vbaStrToUnicode.MSVBVM60(000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?,000000FF), ref: 004084C9
    • __vbaFreeStr.MSVBVM60(000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?,000000FF), ref: 004084D1
    • __vbaInStr.MSVBVM60(00000000,about:blank,000000FF,00000001,000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?,000000FF), ref: 004084E9
    • __vbaStrI4.MSVBVM60(?,00000000,about:blank,000000FF,00000001,000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?), ref: 004084FC
    • __vbaStrMove.MSVBVM60(?,00000000,about:blank,000000FF,00000001,000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?), ref: 00408508
    • __vbaFreeStr.MSVBVM60(0040853C,00000000,about:blank,000000FF,00000001,000000FF,?,?,00000000,?,000000FF,00000064,?,?,00000064,?), ref: 00408536
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$ErrorFreeMove$System$#526AnsiChkstkUnicode
    • String ID: about:blank
    • API String ID: 2857376212-258612819
    • Opcode ID: 46f3602e102f7a177016b591e0776dde0a2f017daa9f9147f1ad92c12a4e0a36
    • Instruction ID: 2c4478ae3b07d4a0d7458d627b53724bea7dbceea4ed27ae98bc5d4c37e4c452
    • Opcode Fuzzy Hash: 46f3602e102f7a177016b591e0776dde0a2f017daa9f9147f1ad92c12a4e0a36
    • Instruction Fuzzy Hash: 9A31FAB1D01208AADF01FFA5C946BDDBBB9AF00748F50802EF100771E1DB795B499B58
    Function 0040785B Relevance: 15.1, APIs: 10, Instructions: 76COMMON
    Download Yara Rule
    APIs
    • __vbaChkstk.MSVBVM60(?,00401766,000000FF,?,00000000,?,00000000,00401766), ref: 00407877
    • __vbaOnError.MSVBVM60(000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078A7
    • __vbaOnError.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078B5
    • #535.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 004078C1
    • __vbaSetSystemError.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040790A
    • #598.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040791C
    • #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407928
    • __vbaFpR4.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040792D
    • #535.MSVBVM60(00000004,00000000,00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 0040795E
    • __vbaExitProc.MSVBVM60(00000001,000000FF,?,00000000,?,?,00401766,000000FF), ref: 00407AD3
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$#535Error$#598ChkstkExitProcSystem
    • String ID:
    • API String ID: 506643573-0
    • Opcode ID: 5ebbeb17cda9f78a7bbf8916f25d9070e84be1f42e78c29077435f54df786519
    • Instruction ID: 479ac2cb31638a750bf151d5241b814f415ab7b63777ba7dff70bd1e2671deb8
    • Opcode Fuzzy Hash: 5ebbeb17cda9f78a7bbf8916f25d9070e84be1f42e78c29077435f54df786519
    • Instruction Fuzzy Hash: E42117B0D05208EFDB00EFA5C65A79DBFB4BF05718F2081AAE054772D1C7BC1A549B6A
    Function 0040320B Relevance: 9.1, APIs: 6, Instructions: 67COMMON
    Download Yara Rule
    APIs
    • __vbaInStr.MSVBVM60(00000000,?,?,?), ref: 0040721C
    • __vbaLenBstr.MSVBVM60(?,00000000,?,?,?), ref: 00407229
    • __vbaInStr.MSVBVM60(00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407242
    • #631.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407262
    • __vbaStrMove.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 0040726C
    • __vbaFreeVar.MSVBVM60(?,?,00000003,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00407274
    • __vbaErrorOverflow.MSVBVM60(?,00000000,?,?,?), ref: 004072BD
    • __vbaStrI2.MSVBVM60(00000000,00000001,?,?,?), ref: 0040730A
    • __vbaStrMove.MSVBVM60(00000000,00000001,?,?,?), ref: 00407314
    • __vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000001,?,?,?), ref: 0040731E
    • __vbaStrToAnsi.MSVBVM60(?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040732D
    • __vbaStrToAnsi.MSVBVM60(?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040733C
    • __vbaStrToAnsi.MSVBVM60(?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?,?,?), ref: 0040734B
    • __vbaSetSystemError.MSVBVM60(00000000,00000000,?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank,00000000,?,00000000,00000000,00000001,?), ref: 00407357
    • __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,00000000,00000000,?,open,00000000,?,C:\Program Files\Google\Chrome\Application\chrome.exe,00000000,?,--new-window about:blank), ref: 00407372
    • __vbaSetSystemError.MSVBVM60(000000FF,00000000,00000000,00000001,?,?,?), ref: 00407381
    • __vbaLenBstr.MSVBVM60(000000FF,00000000,00000000,00000001,?,?,?), ref: 0040738C
    • __vbaStrMove.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073A6
    • __vbaFreeStr.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073AE
    • #598.MSVBVM60(?,000000FF,00000000,00000000,00000001,?,?,?), ref: 004073B3
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: __vba$Ansi$ErrorFreeMove$BstrSystem$#598#631ListOverflow
    • String ID:
    • API String ID: 25209670-0
    • Opcode ID: f1576177c5cf6f2f8a106e67769da4f81eb68ee8f9e6c286109fe786c2a5e57c
    • Instruction ID: f96491c2094b865e394dae8e7540f5c1eb0b3e4328e5741e5ae8b3ab1924fbce
    • Opcode Fuzzy Hash: f1576177c5cf6f2f8a106e67769da4f81eb68ee8f9e6c286109fe786c2a5e57c
    • Instruction Fuzzy Hash: B4214F75D00215AFCB11EFA9C941A9EBBF8FF08700F10806AF850B72A1D778A954CF96
    Function 00405746 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
    Download Yara Rule
    APIs
    • __vbaFreeStr.MSVBVM60 ref: 00405753
    • __vbaFreeStr.MSVBVM60 ref: 0040575B
    • __vbaFreeObj.MSVBVM60 ref: 00405763
    • __vbaFreeVarList.MSVBVM60(00000009,?,?,?,?,?,?,?,?,?), ref: 0040579A
    Memory Dump Source
    • Source File: 00000000.00000002.1718465381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1718450407.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718480760.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1718496532.000000000040A000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_09j4wHYrHs.jbxd
    Similarity
    • API ID: Free__vba$List
    • String ID:
    • API String ID: 2192533141-0
    • Opcode ID: 4e0077a37a6905dba1e0a1b34ecd22d00910cc9cf8537f22a841ca2826c48a7e
    • Instruction ID: b13d634f3d5cfcc0d15fd9e3d8b4a1e450bef5a8e729e7efd378391748652767
    • Opcode Fuzzy Hash: 4e0077a37a6905dba1e0a1b34ecd22d00910cc9cf8537f22a841ca2826c48a7e
    • Instruction Fuzzy Hash: C5F05973D1051CAAEB15EAD1CC81EDFB3BCAB08304F448567B116F2051EA34AB498B65