Edit tour

Windows Analysis Report
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Overview

General Information

Sample name:	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Analysis ID:	1475671
MD5:	196c6cdd199d2148723a4a22fb9608fa
SHA1:	35defb7852ccec846956bd4f37231613925f5638
SHA256:	a06dfc86f1e4fbc5c469a961437692152eaeec13d6fa5fe87a3c29627ec6953f
Tags:	exe
Infos:

Detection

AgentTesla, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe (PID: 3864 cmdline: "C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe" MD5: 196C6CDD199D2148723A4A22FB9608FA)

InstallUtil.exe (PID: 7528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 7540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 7660 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2507506722.000000000306E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1792637573.0000000003F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0000000C.00000002.2507506722.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7528	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7660	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ec9670.2.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3f19690.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.5590000.4.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ec9670.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3f19690.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.5590000.4.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33d0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33d81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33e0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33e9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33f07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33f79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3400f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3409f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.InstallUtil.exe.430000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.InstallUtil.exe.430000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.InstallUtil.exe.430000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.InstallUtil.exe.430000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ea1650.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.230.212.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 7660, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49721

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Avira: detected

Found malware configuration

Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Multi AV Scanner detection for submitted file

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	ReversingLabs: Detection: 63%
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Virustotal: Detection: 48%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Joe Sandbox ML: detected

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.11:49721 -> 185.230.212.164:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: COMPUTERLINEComputerlineSchlierbachSwitzerlandCH COMPUTERLINEComputerlineSchlierbachSwitzerlandCH

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.11:49721 -> 185.230.212.164:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: smtp.zoho.eu

Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: InstallUtil.exe, 0000000C.00000002.2507506722.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: InstallUtil.exe, 0000000C.00000002.2507506722.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.zoho.eu
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.thawte.com0:
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, gmBpn1ecBmQ.cs

.Net Code: cTytqmH

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Code function: 0_2_0740C4D8 CreateProcessAsUserW,

0_2_0740C4D8

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_012848B0	0_2_012848B0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_01286D00	0_2_01286D00
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0128CFA8	0_2_0128CFA8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_01287318	0_2_01287318
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0128D870	0_2_0128D870
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_012848A0	0_2_012848A0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0128CAB1	0_2_0128CAB1
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0128CFA3	0_2_0128CFA3
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_02BF1168	0_2_02BF1168
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_02BF1FE8	0_2_02BF1FE8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_06034420	0_2_06034420
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_06034400	0_2_06034400
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0603E350	0_2_0603E350
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0740CA70	0_2_0740CA70
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07406EB0	0_2_07406EB0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07405510	0_2_07405510
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07406C78	0_2_07406C78
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07407810	0_2_07407810
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07407318	0_2_07407318
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07401338	0_2_07401338
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074057B0	0_2_074057B0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07405E40	0_2_07405E40
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0740AE08	0_2_0740AE08
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0740A6D8	0_2_0740A6D8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07406E9F	0_2_07406E9F
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074016A8	0_2_074016A8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074016B8	0_2_074016B8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07405500	0_2_07405500
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0740950B	0_2_0740950B
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07401D11	0_2_07401D11
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07409518	0_2_07409518
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07401D20	0_2_07401D20
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07400440	0_2_07400440
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07401048	0_2_07401048
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07400450	0_2_07400450
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07402868	0_2_07402868
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07406C68	0_2_07406C68
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07401038	0_2_07401038
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0740283E	0_2_0740283E
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074018E0	0_2_074018E0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074018F0	0_2_074018F0
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_074064A8	0_2_074064A8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07412E78	0_2_07412E78
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741F2C8	0_2_0741F2C8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741F9F2	0_2_0741F9F2
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741D40A	0_2_0741D40A
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_07412E45	0_2_07412E45
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741F211	0_2_0741F211
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741F236	0_2_0741F236
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741E688	0_2_0741E688
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0741F299	0_2_0741F299
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_08114418	0_2_08114418
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_08110040	0_2_08110040
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0811EE70	0_2_0811EE70
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0811EE62	0_2_0811EE62
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817F804	0_2_0817F804
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817E948	0_2_0817E948
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_081741D8	0_2_081741D8
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817F823	0_2_0817F823
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817F82F	0_2_0817F82F
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817E91F	0_2_0817E91F
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_081741BF	0_2_081741BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015C41F0	12_2_015C41F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015CA8D0	12_2_015CA8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015C4AC0	12_2_015C4AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015CAD17	12_2_015CAD17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015CDE90	12_2_015CDE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_015C3EA8	12_2_015C3EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_05A92438	12_2_05A92438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_05A9E048	12_2_05A9E048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D66C0	12_2_066D66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D5258	12_2_066D5258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066DC250	12_2_066DC250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066DB2F0	12_2_066DB2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D3120	12_2_066D3120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D7E50	12_2_066D7E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D7770	12_2_066D7770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066DE470	12_2_066DE470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D0040	12_2_066D0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D59AB	12_2_066D59AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D0038	12_2_066D0038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D0007	12_2_066D0007

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002F98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1780232302.000000000101E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000000.1255709990.0000000000A46000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamez56.exe@ vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1799131324.00000000077A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll, vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Binary or memory string: OriginalFilenamez56.exe@ vs Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, Lw3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/1@3/3

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	ReversingLabs: Detection: 63%
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Virustotal: Detection: 48%

Source: unknown	Process created: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe "C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe"
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ec9670.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3f19690.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.5590000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ec9670.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3f19690.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.5590000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3ea1650.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, To3i9W.cs

.Net Code: NewLateBinding.LateCall(objectValue, (Type)null, "Invoke", obj5, (string[])null, (Type[])null, obj6, true)

.NET source code contains potential unpacker

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, k5Q6Tj.cs

.Net Code: t8PSi1 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_08110C60 pushad ; retf	0_2_08110C61
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0811FA98 pushfd ; ret	0_2_0811FAA5
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Code function: 0_2_0817195A push 00000059h; ret	0_2_0817195E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D254B push 8B040750h; retf	12_2_066D2550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 12_2_066D2954 push 8B040750h; retf	12_2_066D2959

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Static PE information: section name: .text entropy: 7.191174421301109

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

File opened: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 8280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 9280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: 9450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: A450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: A7E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: B7E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Window / User API: threadDelayed 1572	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Window / User API: threadDelayed 7895	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1642	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8184	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe TID: 7364	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe TID: 7524	Thread sleep time: -66000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe TID: 2680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7904	Thread sleep count: 1642 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7904	Thread sleep count: 8184 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99304s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99195s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99558s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7900	Thread sleep time: -98359s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99304	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99195	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99558	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98359	Jump to behavior

Source: InstallUtil.exe, 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: InstallUtil.exe, 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1780232302.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllul]
Source: InstallUtil.exe, 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 12_2_015C70B0 CheckRemoteDebuggerPresent,

12_2_015C70B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 430000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 390000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 430000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 390000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 470000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 472000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 334008	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 390000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 392000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3D0000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3D2000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 5ED008	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C02008	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2507506722.000000000306E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507506722.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7660, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7660, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.InstallUtil.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.3fc3830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2507506722.000000000306E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507506722.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe PID: 3864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7660, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credentials in Registry	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	22 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	63%	ReversingLabs	Win32.Spyware.Negasteal
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	49%	Virustotal		Browse
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	100%	Avira	HEUR/AGEN.1311110
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
smtp.zoho.eu	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Avira URL Cloud	safe
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Avira URL Cloud	safe
http://status.thawte.com0:	0%	Avira URL Cloud	safe
http://smtp.zoho.eu	0%	Avira URL Cloud	safe
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Virustotal		Browse
http://smtp.zoho.eu	0%	Virustotal		Browse
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.zoho.eu	185.230.212.164	true	true	0%, Virustotal, Browse	unknown
www.google.com	172.217.18.100	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe, 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 0000000C.00000002.2507506722.0000000003011000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://status.thawte.com0:	InstallUtil.exe, 0000000C.00000002.2506277638.0000000001408000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2513246867.0000000006250000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.zoho.eu	InstallUtil.exe, 0000000C.00000002.2507506722.0000000003074000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.2507506722.0000000003115000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com	InstallUtil.exe, 0000000C.00000002.2507506722.0000000003011000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
185.230.212.164	smtp.zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	true
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1475671
Start date and time:	2024-07-18 08:06:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 194 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:07:41	API Interceptor	58x Sleep call for process: Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe modified
02:08:31	API Interceptor	66x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	172124118542a797d7ad180ab40c605d31d9af6871534140e8158050e1c4deb095c262bc08645.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	wdeigthseven.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Orden-de-compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Doc 0001_RFQ _MV_Vilnius provision.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Docs_BL INV PKL.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RS0987656789000JHGH.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SWIFT.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Docs Shipping PO#QSB-8927393_2324, QSB-8927394_23-24.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	z1Factura09876789.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Windows21.exe	Get hash	malicious	ZTrat	Browse	ip-api.com/xml/?fields=countryCode,query

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	172124118542a797d7ad180ab40c605d31d9af6871534140e8158050e1c4deb095c262bc08645.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	wdeigthseven.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden-de-compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc 0001_RFQ _MV_Vilnius provision.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Docs_BL INV PKL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RS0987656789000JHGH.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SWIFT.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Docs Shipping PO#QSB-8927393_2324, QSB-8927394_23-24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	z1Factura09876789.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Windows21.exe	Get hash	malicious	ZTrat	Browse	208.95.112.1
smtp.zoho.eu	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderlsTY.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderlsTYP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	okPY77wv6E.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse	185.230.214.164
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse	185.230.214.164
	RFQ_on_SAK-TC233L-32F200N_INFINEON_PN_PHARMA.pdf.exe	Get hash	malicious	AgentTesla	Browse	89.36.170.164

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	https://e-centralprojects.trainercentralsite.com	Get hash	malicious	Unknown	Browse	89.36.170.147
	https://e-centralprojects.trainercentralsite.com	Get hash	malicious	Tycoon2FA	Browse	89.36.170.147
	https://zohoinvoicepay.com/invoice/horizonhivesholdings/secure?CInvoiceID=2-5d1a6e6e7fc02c6aa9c16ba084eaf7b11969e250db6bf56b3ff921885bb1a02a1de112985005752c6b386aa74f5531aa4b7fa92bbb84e57e4955efe41be6b38898e1fb71080bbb7a%20	Get hash	malicious	Unknown	Browse	185.230.212.52
	https://hbagc.net	Get hash	malicious	Unknown	Browse	89.36.170.147
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderls.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	okPY77wv6E.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	https://bitbucket.oreaillyauto.com/	Get hash	malicious	Unknown	Browse	185.230.212.52
	https://show.zohopublic.com/publish/lbdok4d17ed2d1eb14856a7e4d9247a9cebd4	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	89.36.170.147
	c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe	Get hash	malicious	SystemBC	Browse	185.230.212.166
TUT-ASUS	172124118542a797d7ad180ab40c605d31d9af6871534140e8158050e1c4deb095c262bc08645.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	wdeigthseven.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden-de-compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Doc 0001_RFQ _MV_Vilnius provision.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Docs_BL INV PKL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RS0987656789000JHGH.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SWIFT.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Docs Shipping PO#QSB-8927393_2324, QSB-8927394_23-24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	z1Factura09876789.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Windows21.exe	Get hash	malicious	ZTrat	Browse	208.95.112.1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.log

Download File

Process:	C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzea
MD5:	7B709BC412BEC5C3CFD861C041DAD408
SHA1:	532EA6BB3018AE3B51E7A5788F614A6C49252BCF
SHA-256:	733765A1599E02C53826A4AE984426862AA714D8B67F889607153888D40BBD75
SHA-512:	B35CFE36A1A40123FDC8A5E7C804096FF33F070F40CBA5812B98F46857F30BA2CE6F86E1B5D20F9B6D00D6A8194B8FA36C27A0208C7886512877058872277963
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.1836252768431965
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
File size:	411'648 bytes
MD5:	196c6cdd199d2148723a4a22fb9608fa
SHA1:	35defb7852ccec846956bd4f37231613925f5638
SHA256:	a06dfc86f1e4fbc5c469a961437692152eaeec13d6fa5fe87a3c29627ec6953f
SHA512:	ebe6b74a34a61b8ea3a7d098478aa39e718706e4bfda925da7f6f26ec2bf1b433cff5ba041d02d8626e2596b1dc1812d49b1342a625550bc6c54d8ea62108c22
SSDEEP:	12288:nLLwulIXCJnxVhSJUnGH9M7AMlwBhKj6AW+YHxG:noydpAJSGHy7AMa4j6AWzR
TLSH:	8C94F10D13E8E505E6BE3BF86871A14043BAF0D62553E32F16C4A0F97B737A59D912A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......6.........."...P..2...........P... ...`....@.. ....................................`................................

File Icon


Icon Hash:	9b1a7a82aca38fc6

Static PE Info

General

Entrypoint:	0x46500e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x36BCF90E [Sun Feb 7 02:23:10 1999 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x64fb4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x11fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x63014	0x63200	e95b20fdc3e261deb6c7bc9d6a21f10f	False	0.7709819317465322	SysEx File -	7.191174421301109	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0x11fc	0x1200	8ceb5091861e31ce0db30ee617458d82	False	0.81640625	data	7.234907766431966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x68000	0xc	0x200	e540d8bce268e4b10c58febe9557ade4	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x660e8	0xd7f	PNG image data, 189 x 189, 8-bit/color RGBA, non-interlaced	0.9357452966714906
RT_GROUP_ICON	0x66e68	0x14	data	1.25
RT_VERSION	0x66e7c	0x380	data	0.4486607142857143

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2024 08:07:38.293613911 CEST	49708	80	192.168.2.11	172.217.18.100
Jul 18, 2024 08:07:38.298481941 CEST	80	49708	172.217.18.100	192.168.2.11
Jul 18, 2024 08:07:38.298618078 CEST	49708	80	192.168.2.11	172.217.18.100
Jul 18, 2024 08:07:38.298788071 CEST	49708	80	192.168.2.11	172.217.18.100
Jul 18, 2024 08:07:38.305404902 CEST	80	49708	172.217.18.100	192.168.2.11
Jul 18, 2024 08:07:38.305428982 CEST	80	49708	172.217.18.100	192.168.2.11
Jul 18, 2024 08:07:38.305497885 CEST	49708	80	192.168.2.11	172.217.18.100
Jul 18, 2024 08:08:30.846491098 CEST	49720	80	192.168.2.11	208.95.112.1
Jul 18, 2024 08:08:30.851730108 CEST	80	49720	208.95.112.1	192.168.2.11
Jul 18, 2024 08:08:30.851829052 CEST	49720	80	192.168.2.11	208.95.112.1
Jul 18, 2024 08:08:30.852839947 CEST	49720	80	192.168.2.11	208.95.112.1
Jul 18, 2024 08:08:30.870198011 CEST	80	49720	208.95.112.1	192.168.2.11
Jul 18, 2024 08:08:31.340411901 CEST	80	49720	208.95.112.1	192.168.2.11
Jul 18, 2024 08:08:31.395359039 CEST	49720	80	192.168.2.11	208.95.112.1
Jul 18, 2024 08:08:32.051111937 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:32.077877045 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:32.078479052 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:32.684546947 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:32.703526020 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:32.714226961 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.029174089 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.029371023 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.034255981 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.208009005 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.217192888 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.222232103 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.398071051 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.398087025 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.398102999 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.398155928 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.402034044 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.407660007 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.585927963 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.616827965 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.622323990 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.798582077 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.848319054 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.939152002 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:33.940232038 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:33.945267916 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.274324894 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.274617910 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:34.309957027 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.547049046 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.547329903 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:34.552242041 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.736284018 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.736531019 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:34.741501093 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.915445089 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:34.915713072 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:34.920581102 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:35.094333887 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:35.103811979 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:35.104320049 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:35.104362011 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:35.104383945 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:35.108755112 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:35.109282017 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:35.109292984 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:35.109302044 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.121263027 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.123450994 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.123601913 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.164760113 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.169621944 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.354891062 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.355354071 CEST	587	49721	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.355516911 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.358463049 CEST	49721	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.359349966 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.364347935 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.364478111 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.949939966 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:36.950103998 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:36.955364943 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.237421036 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.285824060 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.366127968 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.366373062 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.371476889 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.543229103 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.545217991 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.553447008 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.726175070 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.726979971 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.726993084 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.727154970 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.729240894 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:37.729399920 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.730892897 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:37.735599041 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.159085989 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.160375118 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.160764933 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.161184072 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.173930883 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.350789070 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.351577997 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.359359026 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.533104897 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.533489943 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.538626909 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.725162983 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.725450039 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.730321884 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.903162956 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:38.903414965 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:38.908509016 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.080323935 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.080538988 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.085614920 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.270478964 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.271928072 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272038937 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272038937 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272121906 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272121906 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272156954 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272192001 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272241116 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272241116 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.272317886 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:08:39.278235912 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.278263092 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.278278112 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.278455973 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.278692961 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.583303928 CEST	587	49723	185.230.212.164	192.168.2.11
Jul 18, 2024 08:08:39.630341053 CEST	49723	587	192.168.2.11	185.230.212.164
Jul 18, 2024 08:09:22.051713943 CEST	49720	80	192.168.2.11	208.95.112.1
Jul 18, 2024 08:09:22.057305098 CEST	80	49720	208.95.112.1	192.168.2.11
Jul 18, 2024 08:09:22.057792902 CEST	49720	80	192.168.2.11	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2024 08:07:38.283519983 CEST	49410	53	192.168.2.11	1.1.1.1
Jul 18, 2024 08:07:38.290390968 CEST	53	49410	1.1.1.1	192.168.2.11
Jul 18, 2024 08:08:30.832349062 CEST	58870	53	192.168.2.11	1.1.1.1
Jul 18, 2024 08:08:30.839515924 CEST	53	58870	1.1.1.1	192.168.2.11
Jul 18, 2024 08:08:32.042243958 CEST	59409	53	192.168.2.11	1.1.1.1
Jul 18, 2024 08:08:32.050302029 CEST	53	59409	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 18, 2024 08:07:38.283519983 CEST	192.168.2.11	1.1.1.1	0x520b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 08:08:30.832349062 CEST	192.168.2.11	1.1.1.1	0x2927	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 08:08:32.042243958 CEST	192.168.2.11	1.1.1.1	0x9341	Standard query (0)	smtp.zoho.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 18, 2024 08:07:38.290390968 CEST	1.1.1.1	192.168.2.11	0x520b	No error (0)	www.google.com	172.217.18.100	A (IP address)	IN (0x0001)	false
Jul 18, 2024 08:08:30.839515924 CEST	1.1.1.1	192.168.2.11	0x2927	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 18, 2024 08:08:32.050302029 CEST	1.1.1.1	192.168.2.11	0x9341	No error (0)	smtp.zoho.eu	185.230.212.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49720	208.95.112.1	80	7660	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jul 18, 2024 08:08:30.852839947 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 18, 2024 08:08:31.340411901 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 18 Jul 2024 06:08:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 18, 2024 08:08:32.684546947 CEST	587	49721	185.230.212.164	192.168.2.11	220 mx.zoho.eu SMTP Server ready July 18, 2024 8:08:32 AM CEST
Jul 18, 2024 08:08:32.703526020 CEST	49721	587	192.168.2.11	185.230.212.164	EHLO 414408
Jul 18, 2024 08:08:33.029174089 CEST	587	49721	185.230.212.164	192.168.2.11	250-mx.zoho.eu Hello 414408 (8.46.123.33 (8.46.123.33)) 250-STARTTLS 250 SIZE 53477376
Jul 18, 2024 08:08:33.029371023 CEST	49721	587	192.168.2.11	185.230.212.164	STARTTLS
Jul 18, 2024 08:08:33.208009005 CEST	587	49721	185.230.212.164	192.168.2.11	220 Ready to start TLS.
Jul 18, 2024 08:08:36.949939966 CEST	587	49723	185.230.212.164	192.168.2.11	220 mx.zoho.eu SMTP Server ready July 18, 2024 8:08:36 AM CEST
Jul 18, 2024 08:08:36.950103998 CEST	49723	587	192.168.2.11	185.230.212.164	EHLO 414408
Jul 18, 2024 08:08:37.237421036 CEST	587	49723	185.230.212.164	192.168.2.11	250-mx.zoho.eu Hello 414408 (8.46.123.33 (8.46.123.33)) 250-STARTTLS
Jul 18, 2024 08:08:37.366127968 CEST	587	49723	185.230.212.164	192.168.2.11	250 SIZE 53477376
Jul 18, 2024 08:08:37.366373062 CEST	49723	587	192.168.2.11	185.230.212.164	STARTTLS
Jul 18, 2024 08:08:37.543229103 CEST	587	49723	185.230.212.164	192.168.2.11	220 Ready to start TLS.

Target ID:	0
Start time:	02:07:37
Start date:	18/07/2024
Path:	C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe"
Imagebase:	0x9e0000
File size:	411'648 bytes
MD5 hash:	196C6CDD199D2148723A4A22FB9608FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.1792637573.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.1796909834.0000000005590000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1792637573.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1781352712.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1792637573.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:07:51
Start date:	18/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x60000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1426960071.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:07:54
Start date:	18/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x2c0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:07:56
Start date:	18/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xbf0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2507506722.000000000306E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2507506722.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2507506722.0000000003041000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.1%
Total number of Nodes:	126
Total number of Limit Nodes:	16

Executed Functions

Function 01287318 Relevance: 6.7, Strings: 5, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,cq, xrefs: 012875DA
(o_q, xrefs: 0128788D
(o_q, xrefs: 01287570
(o_q, xrefs: 01287562
,cq, xrefs: 012875E8

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (o_q$(o_q$(o_q$,cq$,cq
API String ID: 0-1313158517
Opcode ID: 7a49660769eb9ca4de331773766813f5ac8ece17bb8229cc6a7514211c5d745a
Instruction ID: c8ab0ebea7e3df96a4aae383c728d5f042864f17a2c23d615120dce693713715
Opcode Fuzzy Hash: 7a49660769eb9ca4de331773766813f5ac8ece17bb8229cc6a7514211c5d745a
Instruction Fuzzy Hash: 60028030A21109DFDB15EF69C884AADBBF6FF88304F248469E915AB2A1D774DD41CF50

Function 012848B0 Relevance: 6.5, Strings: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP_q, xrefs: 01284A4D
PH_q, xrefs: 01284C76
tP_q, xrefs: 01284AA7
tP_q, xrefs: 01284A91
PH_q, xrefs: 01284C65

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: PH_q$PH_q$tP_q$tP_q$tP_q
API String ID: 0-690212726
Opcode ID: db24901cb0bba51f4704d86436965b2e0fea4d316e910276fd91ca6e84045e3d
Instruction ID: 24ac3a58ecbedb1b6f5122050de3571047a6dc0d01ff6b2cc3178a36cc4b68aa
Opcode Fuzzy Hash: db24901cb0bba51f4704d86436965b2e0fea4d316e910276fd91ca6e84045e3d
Instruction Fuzzy Hash: 25C1E174E112598FEB24DFA9C954B9DBBF2BF88300F1085A9D509AB3A8DB305D85CF50

Function 081741BF Relevance: 5.6, Instructions: 5644
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f653583685f2934e0f57580c9cd6fd0cf2a81df2f1be986d0c097c8f70b3ede3
Instruction ID: 8bcc3fd3c066792d6828fbb9a5e393069e0b61e1b41632ece76da2a0f162e221
Opcode Fuzzy Hash: f653583685f2934e0f57580c9cd6fd0cf2a81df2f1be986d0c097c8f70b3ede3
Instruction Fuzzy Hash: 60C3EA70A122298FCB58EF38E99466CBBB2EF89300F5044EDD449A7354EB346E85CF55

Function 081741D8 Relevance: 5.6, Instructions: 5633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b557ffb758ad16976e5235063a9e3595cf2865f540084257ca00ca9eaf724e6d
Instruction ID: d866f2a8475ab811d5927749080c88c6184287bc28fe065b8a15613265437956
Opcode Fuzzy Hash: b557ffb758ad16976e5235063a9e3595cf2865f540084257ca00ca9eaf724e6d
Instruction Fuzzy Hash: 24C3EA70A122298FCB58EF38E99466CBBB2EF89300F5044EDD449A7354EB346E85CF55

Function 08114418 Relevance: 5.2, Instructions: 5170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1799597280.0000000008110000.00000040.00000800.00020000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970550ed2c69bf0e15f4484cd0ffb1edcf7cce54b74a4dca2b5b10e2dcec0f39
Instruction ID: 9ae5aea757f48f615c79267038ec790415895c9814ed10b1498c335a4a37675f
Opcode Fuzzy Hash: 970550ed2c69bf0e15f4484cd0ffb1edcf7cce54b74a4dca2b5b10e2dcec0f39
Instruction Fuzzy Hash: A4B3E870A112288BCB54EF38EA9966CBBF2FF88300F5485ADD489A3254EF345D85CF55

Function 0128D870 Relevance: 4.1, Strings: 3, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH_q, xrefs: 0128DD86
<dvq, xrefs: 0128DBB2
PH_q, xrefs: 0128DD75

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: <dvq$PH_q$PH_q
API String ID: 0-714248992
Opcode ID: b078a6ae14afc8ece6419712e1a29917423774d2665560d454a489ef9f7eae74
Instruction ID: e6621921439ce6745ff2b8cad86632941d1e41fae3c285607b7c499d2305a5c5
Opcode Fuzzy Hash: b078a6ae14afc8ece6419712e1a29917423774d2665560d454a489ef9f7eae74
Instruction Fuzzy Hash: 55E1E374E11218CFDB24DFA9C944B9DBBF2BF88300F2485A9E509AB295DB305D85CF50

Function 07405510 Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 07405599
Q!, xrefs: 0740575F
Q!, xrefs: 0740576D

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Q!$Q!$$_q
API String ID: 0-393975285
Opcode ID: 3a5a501e5d9576258579031c16e13ce8c1cd6cf248e2271cdd9a25e0b7b2275b
Instruction ID: c4d198d61ff9c3130980d2566a87ae2b376accbb4a69aa89c69d8caece2cb995
Opcode Fuzzy Hash: 3a5a501e5d9576258579031c16e13ce8c1cd6cf248e2271cdd9a25e0b7b2275b
Instruction Fuzzy Hash: 5271B4B4E00209DFDB04DFA5D9549AEBBB2FF88310F20852AE405A7795DB385945CF91

Function 01286D00 Relevance: 3.0, Strings: 2, Instructions: 508COMMON

Download Yara Rule

Strings

Hcq, xrefs: 012870F6
(o_q, xrefs: 0128722A

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (o_q$Hcq
API String ID: 0-689770731
Opcode ID: 90a6673631f63363f49014fe3af054d2a364a50390449f0738e1936e14d79305
Instruction ID: b09253173f714e24cd8be93a5c3af46e4e3225274e1b7100defcf3b0bae73c3e
Opcode Fuzzy Hash: 90a6673631f63363f49014fe3af054d2a364a50390449f0738e1936e14d79305
Instruction Fuzzy Hash: 8312A070A102199FDB14DF69C884BAEBBF6BF88300F248569E506DB395EB309D45CB90

Function 0741F236 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0741F49A
Te_q, xrefs: 0741F331

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q$Te_q
API String ID: 0-1615656442
Opcode ID: ee75c51b8fc34917f58944afd593ab31127ae1982b9ac55985037a1cb82a8995
Instruction ID: 8e0f60ab2050620bd5a966325d68d5e41aaa5a532d8af87cb5df210b53854a00
Opcode Fuzzy Hash: ee75c51b8fc34917f58944afd593ab31127ae1982b9ac55985037a1cb82a8995
Instruction Fuzzy Hash: 819145B4E052088FDB08DFA9D8446EEBBF2FF89310F24852AD415AB356D7356906CF51

Function 0741F211 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0741F49A
Te_q, xrefs: 0741F331

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q$Te_q
API String ID: 0-1615656442
Opcode ID: c85bd0a49f47d09a82126bcaa8a2a0e397296f374e53b9300aa7a8a30c5ce296
Instruction ID: 7cf95c0f8ffb5ed730e1162d580575afefac9bba491d2e1c8be0c387f7bd46bb
Opcode Fuzzy Hash: c85bd0a49f47d09a82126bcaa8a2a0e397296f374e53b9300aa7a8a30c5ce296
Instruction Fuzzy Hash: 058124B4E052088FDB08DFA9C8946EEBBF2FF89310F14852AD415AB365D7345906CF51

Function 0741F299 Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0741F49A
Te_q, xrefs: 0741F331

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q$Te_q
API String ID: 0-1615656442
Opcode ID: 86f780867f9f4911dde96dc30248466b6d343f66e15ab8cec3c41bca4efaab67
Instruction ID: 845921778f4050fd40f65c920f134c58ce7d36ac1cb0be6e1b641b6a64bd41d6
Opcode Fuzzy Hash: 86f780867f9f4911dde96dc30248466b6d343f66e15ab8cec3c41bca4efaab67
Instruction Fuzzy Hash: 948104B4E052088FDB08DFA9C8946EEBBF2FF89310F14856AD415AB355D7345906CF51

Function 0740CA70 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

Q+(i, xrefs: 0740CBBD
Q+(i, xrefs: 0740CBAF

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Q+(i$Q+(i
API String ID: 0-3998099878
Opcode ID: c0ce13ee17df857a36117260a7243d7f31116d4d62c3b6d94eab62402cc652e8
Instruction ID: 8748db26126df9a25b02c40d3a8c0fe30ccdcfb7d2ecb95656c5237dcb8d1fa3
Opcode Fuzzy Hash: c0ce13ee17df857a36117260a7243d7f31116d4d62c3b6d94eab62402cc652e8
Instruction Fuzzy Hash: 9C81F2B0D01219CFCB04CFA5D9846EEBBB2FF89300F24952AD416BB294D7345A46CFA4

Function 0741F2C8 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0741F49A
Te_q, xrefs: 0741F331

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q$Te_q
API String ID: 0-1615656442
Opcode ID: 01ff2deac785ef6d0ac6e446ae031ac6dab989ce07cdf3b6e8e59439312fbfe2
Instruction ID: fff9a56e186b64b11dae64f5db1d1b026d5d7a89467c10dbac58515119d474ba
Opcode Fuzzy Hash: 01ff2deac785ef6d0ac6e446ae031ac6dab989ce07cdf3b6e8e59439312fbfe2
Instruction Fuzzy Hash: 5971B3B4E012198FDB08DFA9C9946EEBBB2FF89300F10852AD515AB359D7745906CF50

Function 07405500 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

$_q, xrefs: 07405599
Q!, xrefs: 0740576D

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Q!$$_q
API String ID: 0-4001421713
Opcode ID: 46413a919294346b085f1cacc2163b5c9d5fea574a4fb7afdf4b85db5b6a04fd
Instruction ID: e10db5f0f0676da1ab3395370d092a4365b0cb5f472b93782eea91b6c195bf00
Opcode Fuzzy Hash: 46413a919294346b085f1cacc2163b5c9d5fea574a4fb7afdf4b85db5b6a04fd
Instruction Fuzzy Hash: F371D5B4E00209DFDB04CFA5D9559AEBBB2FF88310F20852AE405A7765DB385945CF91

Function 012848A0 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

PH_q, xrefs: 01284C76
PH_q, xrefs: 01284C65

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: bbbfee6a6d2bbc5ddddc9572f0a2582be3efb909f37606dec47a8affd976b768
Instruction ID: 5de06177e39aac7adf31c124f0edcf8f45f8b58a38ce883bd29361ea4eb71710
Opcode Fuzzy Hash: bbbfee6a6d2bbc5ddddc9572f0a2582be3efb909f37606dec47a8affd976b768
Instruction Fuzzy Hash: 9561F174E112598FEB18EFAAC954B9DFBF2BF88300F248169D508AB359DB315945CF10

Function 0740C4D8 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 0740C643

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 78179bd5c9dc27d15ffea1b7ecb26bd0ef5ec154a4c8d9c616e083b39e3231dd
Instruction ID: 27efb8fd3abb3e1a87cf6e4b05cb16ba04a31ff7956a62bf6a6817dac53ddbc2
Opcode Fuzzy Hash: 78179bd5c9dc27d15ffea1b7ecb26bd0ef5ec154a4c8d9c616e083b39e3231dd
Instruction Fuzzy Hash: 05513DB1D0022ADFCB20CF99C840BDDBBB5BF48314F0085AAE519B7250DB719A85CFA0

Function 0128CFA3 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0128D1CF

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q
API String ID: 0-823545363
Opcode ID: c0719fdbe8e7d47915ee92b8c1a200e6602d837793b0989e8d1aa8bccc53d669
Instruction ID: 5db3a20a0376a25f7fb149c40a09f99be1ce67451a1b3001c2df646295658ea5
Opcode Fuzzy Hash: c0719fdbe8e7d47915ee92b8c1a200e6602d837793b0989e8d1aa8bccc53d669
Instruction Fuzzy Hash: 62B1E274A01319CFDB28DFB5C494A9EBBB2FF89305F209469D406AB3A4CB759946CF10

Function 0128CFA8 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

Te_q, xrefs: 0128D1CF

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Te_q
API String ID: 0-823545363
Opcode ID: d32c23d5474ad5c0dbcb3a0a1b3ec008e142a5098ccca6295ec759306268bccb
Instruction ID: bb9cdea7cbdf92cb3bee8469da9f94fdc648c19d4661c115f1e7b93d0f91a00e
Opcode Fuzzy Hash: d32c23d5474ad5c0dbcb3a0a1b3ec008e142a5098ccca6295ec759306268bccb
Instruction Fuzzy Hash: 5DB1E274A01219CFDB28DFB5C494A9EBBB2FF89305F209469D406AB3A4CB759946CF10

Function 0741D40A Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

<, xrefs: 0741D53D

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 79f294db1dbfaf6b1b6496a28c5119c45811800f5c43ff815c425a0f013cb9d9
Instruction ID: 7c55c5544c263c3047cd7f5bf730061e8b5a21fbba3cf73c10271da4a252bb0b
Opcode Fuzzy Hash: 79f294db1dbfaf6b1b6496a28c5119c45811800f5c43ff815c425a0f013cb9d9
Instruction Fuzzy Hash: C26177B5E01658CFDB58CFAAC9446DDBBF2AF89301F14C1AAD408AB325DB345A85CF50

Function 07412E78 Relevance: 1.1, Instructions: 1088COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f3c6ef6d74794ed88acd355e4bbc26cfcc723c76d4bf2782b783a76d32b6da
Instruction ID: fbd414e3ecad5d18b87923f57735485e447541bf3b362e9f0a72a3698089b6f2
Opcode Fuzzy Hash: 97f3c6ef6d74794ed88acd355e4bbc26cfcc723c76d4bf2782b783a76d32b6da
Instruction Fuzzy Hash: 6472DE71A142158FC709FFB8D89856DBFF2BF89204F51896AD089D7351EF38980ACB52

Function 06034420 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798231181.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6030000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c11b50180b4d2abf5bf1a8e8e89d16ba8de7d7cb11496bb33214f09922ecf2
Instruction ID: daa481da3d40ae2ed100c571e738e59e322e578783dc23c75800fd76fd9eb571
Opcode Fuzzy Hash: a8c11b50180b4d2abf5bf1a8e8e89d16ba8de7d7cb11496bb33214f09922ecf2
Instruction Fuzzy Hash: 54526B34A002568FCB14DF28C944B99B7F2FF89314F2182A9D4586F3A5DB71AD86CF81

Function 06034400 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798231181.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6030000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5880d697bf976e8cd8ee6b9ec08e5feca5555b9d08964a7516ceb943d419812
Instruction ID: fa066f2c1b4b5e2bbf17ae379af5db963f61f5f4787f4fb4c0e7d75d19c81cea
Opcode Fuzzy Hash: a5880d697bf976e8cd8ee6b9ec08e5feca5555b9d08964a7516ceb943d419812
Instruction Fuzzy Hash: EF525A34A003568FCB14DF28C944B99B7F2FF89314F2582A9D4586F3A5DB71AD86CB81

Function 0817F804 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c79d0edf7e3be7f49530f65e75dff42071343c194db35db19ee78ae89bfe74
Instruction ID: 4b793ce46058cce9728a01ad25dd3acdd0f793c1064b1d2e387ad87f85bfe5b9
Opcode Fuzzy Hash: 06c79d0edf7e3be7f49530f65e75dff42071343c194db35db19ee78ae89bfe74
Instruction Fuzzy Hash: 94D18D74E0520ADFCB08CFA9C4908AFFBB2FF89311B15C559D415AB215D735AA86CF90

Function 07407810 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e387f0beeb131db6de5d3552cdc16e3de174ae7e8cdd56259ac77c7908b43b5a
Instruction ID: 630299f17a399b728540181c1202085b5bbd8b001d9d8b85492b4db4517d778d
Opcode Fuzzy Hash: e387f0beeb131db6de5d3552cdc16e3de174ae7e8cdd56259ac77c7908b43b5a
Instruction Fuzzy Hash: A6D126B0A102698FDB65CF65C9447DDFBB2FF89300F10C9EAD40AA7255D774AA868F40

Function 0817F82F Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb095deacb46662e1b429dcda52588ada2f6a61ddf1f0966c5b7643ae708966
Instruction ID: f90d4a81fb8e3fb0603305c5256d65fb561f5c18c1f60e56bcf12333cea2cd31
Opcode Fuzzy Hash: 7eb095deacb46662e1b429dcda52588ada2f6a61ddf1f0966c5b7643ae708966
Instruction Fuzzy Hash: 78C15C70E0520ADFDB08CFA9C4908AFFBB2FF89311B15C559D415AB255D734AA46CF90

Function 0817F823 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15907d68ecf9259b4d712a9685167ed8ac5d200c69e7d78f1908340cb9d07cb
Instruction ID: f1192ef90c957e0945752baa61aa1533bd23bd9efe17315ed3b22a0576997bf7
Opcode Fuzzy Hash: c15907d68ecf9259b4d712a9685167ed8ac5d200c69e7d78f1908340cb9d07cb
Instruction Fuzzy Hash: 78C15A70E0020ADFDB08CFA9C5908AFFBB2FF88311B15C559D415AB255DB35AA86CF90

Function 07406EB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af385edb8e42f1ddb3ac797a80df53e8a0bdd929231c90ca7e1a002419f279c
Instruction ID: 90200f608c6dba686d9f84fddd74c65d46abb54132637a6862dd04679ab9b407
Opcode Fuzzy Hash: 5af385edb8e42f1ddb3ac797a80df53e8a0bdd929231c90ca7e1a002419f279c
Instruction Fuzzy Hash: 746118B0E0031ADFDB04DFA5D9946EEBBB1FB89310F10882AD416A7381D7785906CF91

Function 0741F9F2 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc6636ff75f08851c8f7317c6127bfa7161a5ce727d967c18c45a83c525e44f
Instruction ID: d6c031512fa8f6b833e8d26f4c5259fc6b22a9483273070ee217efb47871ddf6
Opcode Fuzzy Hash: 0fc6636ff75f08851c8f7317c6127bfa7161a5ce727d967c18c45a83c525e44f
Instruction Fuzzy Hash: F8516BB0E152098FCB08CFAAC5505EEFBF2EF89350F24D46AD419A7255D7384A06CF64

Function 07406E9F Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0095401b0f1211e2a37285c7bbe4d1451c19b9e04a9cc74ba4908285ebe865
Instruction ID: 552f425dcffd51d464325d2878d853cdc9ef30a5aee3b2f06efe468410811690
Opcode Fuzzy Hash: aa0095401b0f1211e2a37285c7bbe4d1451c19b9e04a9cc74ba4908285ebe865
Instruction Fuzzy Hash: 14512BB0E1031ADFDB04CFA5C9586EEBBB1FF89310F10892AD416A7285D7785906CF91

Function 07406C68 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56329d667feb6f8596c7395aed2f855a68dee04ddb0a26d3f8b25edc4af811f4
Instruction ID: be0aa0899a551075dbe9a7d99e74db1da0beb26a77aad2d6751de2ef9a4befee
Opcode Fuzzy Hash: 56329d667feb6f8596c7395aed2f855a68dee04ddb0a26d3f8b25edc4af811f4
Instruction Fuzzy Hash: ED414CB4D1920A9FCB04CFA6D8415EEBBB1FF8A310F10D82AD412A7390D7784656CF91

Function 07406C78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a55fd8f0194f6040c5c7dfeb489607326d96e287db8eb274b2c0319aff6f84
Instruction ID: 1be4a0558fedf0739a36d8ed2f69b8b18e61a74d22f9ae94195dbbac44c0b7ab
Opcode Fuzzy Hash: a5a55fd8f0194f6040c5c7dfeb489607326d96e287db8eb274b2c0319aff6f84
Instruction Fuzzy Hash: C6415AB0D2520A9BCB04CFA6C9405EEFBB5FF89310F11982AD412B7394D7384666CFA5

Function 0817E91F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16cf3a6f66f9a9b20d284e81b84e815966f385d95e3f5387983666b5d79af47
Instruction ID: 42ee45ba5a13283796cadbb25896a8c308cbccb355ccfc1bc0e189f60ad000f7
Opcode Fuzzy Hash: e16cf3a6f66f9a9b20d284e81b84e815966f385d95e3f5387983666b5d79af47
Instruction Fuzzy Hash: C43129B0E056588FDB19CFAAC8543CEBFF2AFC9310F18C1AAD414AA265DB740945CF50

Function 0817E948 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a4eb111a6e13682d8558464a4f57ac6e7718b7c6e9b3bf585a1217143ef773
Instruction ID: 7eca3986f0e3233fee877217d32ea972c3165c6b230e3d01736407dbf5a8cbb6
Opcode Fuzzy Hash: 13a4eb111a6e13682d8558464a4f57ac6e7718b7c6e9b3bf585a1217143ef773
Instruction Fuzzy Hash: A421E4B1E006188BEB18CFABD9443DEFBF2AFC8311F14C16AD409A6254DB751A46CF90

Function 01287A41 Relevance: 11.8, Strings: 9, Instructions: 519COMMON

Download Yara Rule

Strings

(o_q, xrefs: 01287B65
(o_q, xrefs: 01287B39
(o_q, xrefs: 01288011
,cq, xrefs: 01287EF0
(o_q, xrefs: 01287F5F
(o_q, xrefs: 01287C02
(o_q, xrefs: 01287F4F
,cq, xrefs: 01287EE0
(o_q, xrefs: 01287A7E

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (o_q$(o_q$(o_q$(o_q$(o_q$(o_q$(o_q$,cq$,cq
API String ID: 0-2006360050
Opcode ID: 6a935fda115e87e69bbebb121d73520197a19fd865c210b9350d533ff1f1c719
Instruction ID: 65cd5f556c520d6ee681e36b4892f14b1f4df1c1daac633e749ec85dada0a40e
Opcode Fuzzy Hash: 6a935fda115e87e69bbebb121d73520197a19fd865c210b9350d533ff1f1c719
Instruction Fuzzy Hash: C9227E30A1120A9FCB15EF69C984AAEBBF2FF88314F248569E515DB3A5D730ED41CB50

Function 01288B18 Relevance: 4.6, Strings: 3, Instructions: 815
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o_q, xrefs: 01289819
$_q, xrefs: 0128963C
$_q, xrefs: 0128965F

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (o_q$$_q$$_q
API String ID: 0-2711016522
Opcode ID: cad2190022eae7184e5aa3638a8b388b2213f15703aed1d07c04eab554b46a86
Instruction ID: d9b5cf5b6a5e29172cbef4c9dc47041e47d5df3486011f2f9a649e8f344746e5
Opcode Fuzzy Hash: cad2190022eae7184e5aa3638a8b388b2213f15703aed1d07c04eab554b46a86
Instruction Fuzzy Hash: DB725474A10219CFDB15EBA5C864BAEBBB3FF94300F1081A9D10AAB399CE359D45CF51

Function 01289D20 Relevance: 3.9, Strings: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 01289ECC
$_q, xrefs: 01289E20
$_q, xrefs: 01289E2C

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq$$_q$$_q
API String ID: 0-3221398524
Opcode ID: 099b0a207f1b32ec782695be4ac22936e744871ebd79346728071712e9bf66fd
Instruction ID: 40ce595ea9f4fd8fee6bd2ddca1113e06f881c4f87a6961d9a9a8cd073dd6e97
Opcode Fuzzy Hash: 099b0a207f1b32ec782695be4ac22936e744871ebd79346728071712e9bf66fd
Instruction Fuzzy Hash: C351A031B651128FDF197B3A886C63E3FE6AFC5645318486AE607CB3D5DE24CC428791

Function 0817FE20 Relevance: 3.8, Strings: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{ :, xrefs: 0817FEEE
tu}s, xrefs: 0817FE6A
tu}s, xrefs: 0817FEA0

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: tu}s$tu}s${ :
API String ID: 0-3169588376
Opcode ID: c3e9883f3af13e9443bd6ec5b8fe37ae167baee2d3fb331136a1c310234661f8
Instruction ID: d405a1f6525ea5f084af28d26df5a938975dee29945066cac9403afe0fd4a5b2
Opcode Fuzzy Hash: c3e9883f3af13e9443bd6ec5b8fe37ae167baee2d3fb331136a1c310234661f8
Instruction Fuzzy Hash: 46211970E052499FDB08CFA9C940AAFBFF1FF89300F15C5AAD405A7266DB309A42DB51

Function 0817FE30 Relevance: 3.8, Strings: 3, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{ :, xrefs: 0817FEEE
tu}s, xrefs: 0817FE6A
tu}s, xrefs: 0817FEA0

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: tu}s$tu}s${ :
API String ID: 0-3169588376
Opcode ID: ea6ed7fba7cb0f7b838c48ff08389d6b50465588132f4be4a4c747db2d266436
Instruction ID: 5bc2e616ac7b6a1ff0ab7b5f6cfdc7319a6c5225181edeee3aed0f50810daca1
Opcode Fuzzy Hash: ea6ed7fba7cb0f7b838c48ff08389d6b50465588132f4be4a4c747db2d266436
Instruction Fuzzy Hash: 0221F4B0E01609DFDB08DFA9C940AAEFBF2BF89301F11C5AAD414A7215DB309A42CB51

Function 012861E0 Relevance: 2.9, Strings: 2, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 012863B1
Hcq, xrefs: 012863E4

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq$Hcq
API String ID: 0-4088181183
Opcode ID: e2701e4083703b06d2e7456a0510d4fba494e5e972057cedfed31d58568a5de4
Instruction ID: 974ac2717a4c76eb27a7c331b932e2c3b54688ee8829bd61a47956b186196fe6
Opcode Fuzzy Hash: e2701e4083703b06d2e7456a0510d4fba494e5e972057cedfed31d58568a5de4
Instruction Fuzzy Hash: 63E1E030B202169FDB15AF68C858B7E7BA3AB88710F148929E606CB3D5DF74DC45CB91

Function 08171D28 Relevance: 2.9, Strings: 2, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 08171E69
Hcq, xrefs: 08171DE0

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq$Hcq
API String ID: 0-4088181183
Opcode ID: ad523cd90dc96b9b74e9a2b917000d1ee5f5d56c373d03c87a89c5f0c40919b5
Instruction ID: 6f2c3ee07ebaf73ebec5f66dd1bff878869075aa1dcc6f70694795310be61f59
Opcode Fuzzy Hash: ad523cd90dc96b9b74e9a2b917000d1ee5f5d56c373d03c87a89c5f0c40919b5
Instruction Fuzzy Hash: 5BD1B231B142158BDB04BBB8D85416EBBB6EFC9300F40896DD48AE7395DF389C4AC766

Function 012868D0 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

,cq, xrefs: 012869B0
,cq, xrefs: 012869A6

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: ,cq$,cq
API String ID: 0-2927840315
Opcode ID: 4ebf03631b0afffb2b4c5b49a34ddb6fe1d5752c966665532ae366133b7ca4d7
Instruction ID: 7e10e0844dd2bcf9848ddc15fa2e5203671d82db9287ce4f47319878d6e6cd92
Opcode Fuzzy Hash: 4ebf03631b0afffb2b4c5b49a34ddb6fe1d5752c966665532ae366133b7ca4d7
Instruction Fuzzy Hash: 7F819E30A21106CFCB14EF6DC884AAABBB2BF88314F158169D605AB3E5D731E841CB91

Function 0128F2A8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

Xcq, xrefs: 0128F35F
4'_q, xrefs: 0128F30A

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 4'_q$Xcq
API String ID: 0-55182120
Opcode ID: e48551055b09b750651f1e5aa8b6783d636969ab4a6c34b47f289c9abcdc66f0
Instruction ID: 5f4ae942941e5d0bd115dff230554ffdb22c41651ece7cb55437f2bce765ffb8
Opcode Fuzzy Hash: e48551055b09b750651f1e5aa8b6783d636969ab4a6c34b47f289c9abcdc66f0
Instruction Fuzzy Hash: 8F8137316122469FCB06EF7DD9186AE7FF2EF85310F1440AAE905CB2A6DB309D15CB90

Function 0128FA58 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

Hcq, xrefs: 0128FB3F
Hcq, xrefs: 0128FB72

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq$Hcq
API String ID: 0-4088181183
Opcode ID: 0949927658215f1531e7678c19ae728f7be1a94acda52f37ac2e0ed341c1b0b0
Instruction ID: bcece39926e6d6000a78d0ef0e7a61f54052811423bc2a64854634c417666c03
Opcode Fuzzy Hash: 0949927658215f1531e7678c19ae728f7be1a94acda52f37ac2e0ed341c1b0b0
Instruction Fuzzy Hash: 8141FF712252568FDB01EF28C944ABEBBE2FF88314F198859E9059B3D1DB34CC11CBA0

Function 08173E6B Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

@D6, xrefs: 08173F3D
D, xrefs: 08173EC2

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: D$@D6
API String ID: 0-1118780540
Opcode ID: 09afcd931d386fd8b60a5553a9df38cf0d9814322e1111e31ee6d93cc623dfb5
Instruction ID: d425a022c7393fe2fd4fac9c2e8dab293dff025a44eb2ca35d4a82c2b72bb28f
Opcode Fuzzy Hash: 09afcd931d386fd8b60a5553a9df38cf0d9814322e1111e31ee6d93cc623dfb5
Instruction Fuzzy Hash: F631645280E3C25FC70387B88C656957FB0AE43120B1A06EBC0D1CF6E3EA19090AC763

Function 08172F6F Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJdq, xrefs: 08173046
Te_q, xrefs: 08173031

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: TJdq$Te_q
API String ID: 0-3934155944
Opcode ID: 6d5c197fa01362857cd2665d417fc7e6f623f23e392c88e88d8d37067731561d
Instruction ID: 4b9873a14487a5a18ccb062ab1b1b56674c27eb7dfafe2f129a77a9c1117a555
Opcode Fuzzy Hash: 6d5c197fa01362857cd2665d417fc7e6f623f23e392c88e88d8d37067731561d
Instruction Fuzzy Hash: 3431E7717142118FC709BBB8E85852E7BF6FF89614B41489DE449DB352DE349C0AC366

Function 08172F88 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

TJdq, xrefs: 08173046
Te_q, xrefs: 08173031

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: TJdq$Te_q
API String ID: 0-3934155944
Opcode ID: af1f97b357503429182f68310349046ed747ce5b80037de40eeaee73200b0d66
Instruction ID: c2c24d72d727dc88f4ae3fb801d57fa7c60e89430250bc919e24ba04dbdb1d40
Opcode Fuzzy Hash: af1f97b357503429182f68310349046ed747ce5b80037de40eeaee73200b0d66
Instruction Fuzzy Hash: 392191317101158FC708BBB9E85892EBBF6FF89614B41486DE449D7351DE349C0A83A6

Function 0817C6C8 Relevance: 2.1, Strings: 1, Instructions: 884COMMON

Download Yara Rule

Strings

@, xrefs: 0817CB7C

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: bca1c2b0097f92a2e24bbd099cfa12badea13b0a73d17c75e27ed113c31fe312
Instruction ID: 0b3a00734bfe52a86f679d47f7e7fee60a2929e6324b9d3ba483c070742f4295
Opcode Fuzzy Hash: bca1c2b0097f92a2e24bbd099cfa12badea13b0a73d17c75e27ed113c31fe312
Instruction Fuzzy Hash: 87629C70A152188FCB18BFB8E59966CBBF1EF88304F4144ADE44AE7355DF385849CB62

Function 0817CBC5 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

@, xrefs: 0817CB7C

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 521b607fdec56b68c27712ed57cb7e648ab321fbb10a7964a6767e86bc3dbcd2
Instruction ID: 4b93357948b039b82b4337c93cf7470906d4cf015054acc8cb0e3e4ff1f129a2
Opcode Fuzzy Hash: 521b607fdec56b68c27712ed57cb7e648ab321fbb10a7964a6767e86bc3dbcd2
Instruction Fuzzy Hash: 6812DE70A1A2188FCB19AF74E95929C7FF1EF89300F0144ADE44AE7355EB385C49CB62

Function 01287FD8 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

(o_q, xrefs: 01288011

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (o_q
API String ID: 0-493409505
Opcode ID: 2cd222258f5e249765ffdf77621f92bee04e2fe4ba1a80f8e8f73f9da88e3750
Instruction ID: 993758bb83a15ca3df63d46c45c35a25e0865fa406a982465d65698ed04d0bd1
Opcode Fuzzy Hash: 2cd222258f5e249765ffdf77621f92bee04e2fe4ba1a80f8e8f73f9da88e3750
Instruction Fuzzy Hash: 66128E31A11106CFCB25EF68D584AAEBBF2FF48300F5A8554E506DB2A6D734ED41CB61

Function 07404FFB Relevance: 1.6, APIs: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 07405073

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1f053a2adbefa6689c62dcacaae277fe4478ae084e308c81f26efdc6a56dd198
Instruction ID: 5fa7b65796079d34586de03ebbae7a23c11162fc1883040c9570f78260d17c4d
Opcode Fuzzy Hash: 1f053a2adbefa6689c62dcacaae277fe4478ae084e308c81f26efdc6a56dd198
Instruction Fuzzy Hash: 382128B5900249DFCB10DF9AD444AEEFBF4FB48310F10846AE858A3250D3759954CFA1

Function 0740E9F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0740EA80

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 461bf2926589424725a0f27671fab8340e2df1a932df15a7398b9c6afc40abc7
Instruction ID: d91c3588b6834d4001227cabfb3a9c5537229d71f60734122f3e2eefcc91d922
Opcode Fuzzy Hash: 461bf2926589424725a0f27671fab8340e2df1a932df15a7398b9c6afc40abc7
Instruction Fuzzy Hash: BC2127B19003199FCB10DFA9C985BEEBBF5FF48314F10882AE919A7240D7789955CFA0

Function 0740DFA8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0740E026

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 74e91fb32ba9ec7d9dfb91932cb057350f817c1880bccd8e05d7dac121a3c13a
Instruction ID: 50783ed1b7cd869a4ff3e1353c2955da03eacaca47d6392f3d4d20e2f8f12ba0
Opcode Fuzzy Hash: 74e91fb32ba9ec7d9dfb91932cb057350f817c1880bccd8e05d7dac121a3c13a
Instruction Fuzzy Hash: E52135B1D002198FDB14DFAAC4857EEBBF4BF48324F10842AD419A7241C778A945CFA1

Function 0740FAB8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0740FB36

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0dcff3ee54db220d61d49d81d5c2b89c50129d65380ff180e67a7c796db8c003
Instruction ID: 40274aac7d16f0e81cebd3398592e95987c5a86ba161ed70f4ed0ee41ee1cd2a
Opcode Fuzzy Hash: 0dcff3ee54db220d61d49d81d5c2b89c50129d65380ff180e67a7c796db8c003
Instruction Fuzzy Hash: CC2138B1D002098FDB20DFAAC5857EEBBF4AF48314F54842AD519A7240D778A945CFA1

Function 0740EEE8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 0740EF5F

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe43abc56b022c10308a040edc4199028783f839ca2086e52d56bc2672b0d089
Instruction ID: 6a3e62c616645334dec52059bb39e35a4b23e0664e6bada39fee8046cb38538a
Opcode Fuzzy Hash: fe43abc56b022c10308a040edc4199028783f839ca2086e52d56bc2672b0d089
Instruction Fuzzy Hash: D62138B1C002099FCB10DFAAC444AEEBBF4EF48320F10842AD519A7240C7799945CFA1

Function 0741E5D0 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0741E64B

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce8f02cbf4d05976c01446ce31ce69e3ea1fc2b42234fbf4fca05128b7d64338
Instruction ID: 3e5459489749c57033f1b2e3e4345ce0d67180f36f30c8caafdf1f1304432289
Opcode Fuzzy Hash: ce8f02cbf4d05976c01446ce31ce69e3ea1fc2b42234fbf4fca05128b7d64338
Instruction Fuzzy Hash: 192138B5D00249DFCB10DF9AC484BDEBBF4BB48320F14842AE858A3250D374A944CFA1

Function 0811BD20 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 0811BD90

Memory Dump Source

Source File: 00000000.00000002.1799597280.0000000008110000.00000040.00000800.00020000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b46b8ba48b8e6541dce74192ef7d437380bf9c483f32351bf6dd9dc3c416ec59
Instruction ID: 3447854d3b504b4ce84f42068b6a7b39a9f54e230a92c84f7e40867aaec27f12
Opcode Fuzzy Hash: b46b8ba48b8e6541dce74192ef7d437380bf9c483f32351bf6dd9dc3c416ec59
Instruction Fuzzy Hash: 6D1133B1C0465A9BCB14CFAAC544BEEFBF4BF48324F11812AD818B7240D338A944CFA5

Function 0741E5D8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0741E64B

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c9f371a4c0a0a0ac113488cdbe62ea92cc86daa26c8a191cd0ece99e004b1dd6
Instruction ID: af6f1cbb3dc951b02f52cf70c5aabc8dd0c056e718cd8ec41f47bfadc1667de8
Opcode Fuzzy Hash: c9f371a4c0a0a0ac113488cdbe62ea92cc86daa26c8a191cd0ece99e004b1dd6
Instruction Fuzzy Hash: DF21E4B5900259DFCB10DF9AC584BDEFBF4FB48320F50842AE958A7250D379A944CFA5

Function 07405000 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 07405073

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 235bb9806170e3a7929cab9f1e50fe53d68bcc14cc556a03d9c8442df08ef7cf
Instruction ID: 93049134cc676a9b81c3fefbcb7b5d26bdb65c09afbb72eb96c5630f1050e1ea
Opcode Fuzzy Hash: 235bb9806170e3a7929cab9f1e50fe53d68bcc14cc556a03d9c8442df08ef7cf
Instruction Fuzzy Hash: 2921E4B59002499FCB10DF9AC984BDEFBF4FB48320F10842AE958A7250D379A944CFA5

Function 0740E678 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0740E6E6

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c5067b0a6b13b7237cebf8cbf5e6313b91a72fdb13612b24e821ac43a70b91bb
Instruction ID: 95812c020bcb68bc8a14364ec4543f3eca3c92ad7fff5c461a8cc6d070f84b20
Opcode Fuzzy Hash: c5067b0a6b13b7237cebf8cbf5e6313b91a72fdb13612b24e821ac43a70b91bb
Instruction Fuzzy Hash: 3F1167B58002599FCB10DFAAC844ADFFFF5EF48320F10881AE519A7250C775A944CFA0

Function 0740FD40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0740FDA2

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f5b8f9f43ae5c5bde887125651d66d93ae80ab64b19f50d5f4cabaef40ab33e6
Instruction ID: 355b01da00ee098e988ab2336cf91def4b2aff2db05e372e8536016dc5e031f3
Opcode Fuzzy Hash: f5b8f9f43ae5c5bde887125651d66d93ae80ab64b19f50d5f4cabaef40ab33e6
Instruction Fuzzy Hash: 81113AB1D002498FCB20DFAAC5457DEFBF4AF88324F20842AD51AA7240C775A945CFA5

Function 02BF2650 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 02BF26A8

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 13ce9477728a916262f3ada517068d2b4b8a8b334fdace020967225ea2af3dba
Instruction ID: 0e09863aa0c6398e8c2e270e4ab804ce0ed60c2b86084c72b96f0e5f56596b12
Opcode Fuzzy Hash: 13ce9477728a916262f3ada517068d2b4b8a8b334fdace020967225ea2af3dba
Instruction Fuzzy Hash: 1C1145B58003499FCB10DF9AC545BDEFBF4EB48320F20845AD919A7340D338A944CFA5

Function 02BF264E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 02BF26A8

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 35c204186199253a99af72ea5c03bd92f815bd651a136daf1ad623d9a68669fc
Instruction ID: 11b8ad80b73dd1c64c5c96311c872d619b2e4735e0c8a64dd7ccd98149321e69
Opcode Fuzzy Hash: 35c204186199253a99af72ea5c03bd92f815bd651a136daf1ad623d9a68669fc
Instruction Fuzzy Hash: 021145B6800249CFCB10DF99C645BDEBBF0EB48320F25845AD919B7340D338A948CFA5

Function 02BF03F0 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02BF0455

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4b3f953ff4c9b0b78679887faf898796bae74c7f71e7e287e3d8ddab761fd535
Instruction ID: 92327a299e7011fbeafaf8dc3fee50678e07b16829a068003595ab5dbbfbd0d0
Opcode Fuzzy Hash: 4b3f953ff4c9b0b78679887faf898796bae74c7f71e7e287e3d8ddab761fd535
Instruction Fuzzy Hash: AA1103B5800248DFCB50DF9AD584BDEBBF4EB48314F24845AE519B7610C374A984CFA5

Function 02BF03F8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02BF0455

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3dadaa2f1d0e331208b423fc8d7d2d5833f4cd85eda46bd09791065db9709d10
Instruction ID: 5191f68ee2255e6ed1759f3a12fbb2e0f6c894db0abab46cff170e51e0406636
Opcode Fuzzy Hash: 3dadaa2f1d0e331208b423fc8d7d2d5833f4cd85eda46bd09791065db9709d10
Instruction Fuzzy Hash: 241103B5800348DFCB10DF9AD584BDEFBF8EB48314F108459D518A3210C375A584CFA5

Function 0817E528 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

4'_q, xrefs: 0817E683

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: f49fc527731b62eef98aec3e1646b2af2d7db3c94530817602cc4a2a9a7a2740
Instruction ID: 5d52fa936b5a6ee6bdbad586a511de4301e3a3c9e7d0374ec2a0d6ef9dbdb4fa
Opcode Fuzzy Hash: f49fc527731b62eef98aec3e1646b2af2d7db3c94530817602cc4a2a9a7a2740
Instruction Fuzzy Hash: 1A91A071A111158BD704FBB8E58866DB7F2FF88704F9188ADD449E7344DB38AC45C7A2

Function 012887D8 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

4'_q, xrefs: 0128898A

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 72176e8a0c4a4fcc2fa31561d8263e36736f1fd15964def3fb911ff944e9903c
Instruction ID: eb68c4ac529b0a5b918a184b5be5a647ee1105ad118005bd0e0d07ab4b470c00
Opcode Fuzzy Hash: 72176e8a0c4a4fcc2fa31561d8263e36736f1fd15964def3fb911ff944e9903c
Instruction Fuzzy Hash: 2D6191317351068FD714EF3DD884A6A7BE9BF4820074544AAEA46CB3A1DB70EC00C761

Function 0128ED58 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

Hcq, xrefs: 0128EE40

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq
API String ID: 0-419967981
Opcode ID: 7ad8921efb6fc746e9fb8ed8bd8ce7322a62c9d62727fb8c5862a87c77ae6168
Instruction ID: fddece046f80c8feb209f815fe85b096f47931cd094e33331337589d03fe7252
Opcode Fuzzy Hash: 7ad8921efb6fc746e9fb8ed8bd8ce7322a62c9d62727fb8c5862a87c77ae6168
Instruction Fuzzy Hash: FE41D2313152469FC716AF2DD8586AA3FE2AF8A321F0584A9E945CB3D2CB34DC15CB61

Function 01285138 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

8cq, xrefs: 01285249

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: 0a3c81c7a7e51d8231fc836d6b5603d32eeef22006c2b3fd26a5a87dcdbd6f56
Instruction ID: 0b1cafd321f835a1570eb117244d18f74f4d07e4f2fd3ed63ee0d9bc4d5232c2
Opcode Fuzzy Hash: 0a3c81c7a7e51d8231fc836d6b5603d32eeef22006c2b3fd26a5a87dcdbd6f56
Instruction Fuzzy Hash: B9410074E16209DFDB04DFAAC4846EEBBF6BF89300F149069E419B72A4DB345A46CF50

Function 012885C8 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

4'_q, xrefs: 01288653

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: cd3db435c9b49b0ce19dba65d9e801c4c212651b28342b664b043a0ca35561f0
Instruction ID: 6beba937982fdceae310ee2280083889fa042a6d7d665a195690047c7f8c41f2
Opcode Fuzzy Hash: cd3db435c9b49b0ce19dba65d9e801c4c212651b28342b664b043a0ca35561f0
Instruction Fuzzy Hash: 5D418C75661216CFCB05EF29C948A6A7BB2FF88314F100469EA06CB3B1C731DC51CBA0

Function 01285128 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

8cq, xrefs: 01285249

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: c998abd3cebeb53e38bf2eea28adb5d31e6a8f7edd642b182d181df5245baf7a
Instruction ID: bd4e754e9db8803de427ca7abdcba6acb6d19d7974ad9aa9d5266432e1fb2100
Opcode Fuzzy Hash: c998abd3cebeb53e38bf2eea28adb5d31e6a8f7edd642b182d181df5245baf7a
Instruction Fuzzy Hash: 08410FB4E16209DFDB04DFAAC5846EDBBF2BF89300F14806AD415A73A0DB345946CF50

Function 08171020 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

(cq, xrefs: 08171048

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (cq
API String ID: 0-301743287
Opcode ID: 18ed772df984d2f5b0a2512a192a4003d896e2702ebd8ae892c2138075472d06
Instruction ID: d8a83c65b54f19292d371d62939d4bb50d31581305977ff585484da6c8137bce
Opcode Fuzzy Hash: 18ed772df984d2f5b0a2512a192a4003d896e2702ebd8ae892c2138075472d06
Instruction Fuzzy Hash: C2317C31E042498FCB11DFBDD8509EEBBB4EF89320B1482AED549E7251EB309945CBA5

Function 0817195F Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

(cq, xrefs: 0817195F

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (cq
API String ID: 0-301743287
Opcode ID: 022835cc2ba959df2091060078ce164fcb0f5916a03dbe8eb206f92632560075
Instruction ID: 08dbf4b1a6963cbe2e2d10ef9ffb72fe6f5f6a46aa8391e446663dcf1ffd749f
Opcode Fuzzy Hash: 022835cc2ba959df2091060078ce164fcb0f5916a03dbe8eb206f92632560075
Instruction Fuzzy Hash: 4F3123B4D04258EFDB24DFA9C598B9EBFF5EF48310F24846EE405AB250C7745845CB61

Function 081718DB Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

(cq, xrefs: 081718ED

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: (cq
API String ID: 0-301743287
Opcode ID: 88cb12e9fb0f08f71b9fbd6cd17c045a60bd93dfed6ff3974cccefa0c7878140
Instruction ID: dcac08743b951d5ddf54e6153a93510f053c4c89c021dec731f9fa98ebf2ee2b
Opcode Fuzzy Hash: 88cb12e9fb0f08f71b9fbd6cd17c045a60bd93dfed6ff3974cccefa0c7878140
Instruction Fuzzy Hash: EB110820A1C3D55FE7069B7888246BE3FB29FD6310F6808DFC4419B2D2DB250D45C762

Function 08173F16 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

@D6, xrefs: 08173F3D

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: @D6
API String ID: 0-6984494
Opcode ID: de769bf41f963091baf5c0faf6ac7014ea5ac8155588b1afaca2c219d443e6fb
Instruction ID: f399507b5816d8385ff25b1b663511a11859f2c69f452488b8b4f2fa1c18f601
Opcode Fuzzy Hash: de769bf41f963091baf5c0faf6ac7014ea5ac8155588b1afaca2c219d443e6fb
Instruction Fuzzy Hash: F501DF6190E3CA4FC303E7B4D9212987FB0AF57200B1905DBC089CF1A7EA250E09CB52

Function 08173F89 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

43`q, xrefs: 08173FB3

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: 43`q
API String ID: 0-987742510
Opcode ID: 364f59ab1e1480b4786de8dc4ecd872a73f5a8025d0b45471b29831195c14e4b
Instruction ID: 42375db1403b42297c61acf241333ce862463a80a0cb1cae82f48f682c5fcf8d
Opcode Fuzzy Hash: 364f59ab1e1480b4786de8dc4ecd872a73f5a8025d0b45471b29831195c14e4b
Instruction Fuzzy Hash: DBE0ED293192941FC31A57766C2057B3FABABCA220B0884AAF8818B295CC704C068390

Function 0817BF76 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f27491810729a9508722e81af9b3be1aa1e9dae5f5a9b4b671fbc80571a96b1
Instruction ID: 5f2c6a723a2d38df7ad61069fa6e494a143fbe6344a9a6650d4838a6cf7c919d
Opcode Fuzzy Hash: 5f27491810729a9508722e81af9b3be1aa1e9dae5f5a9b4b671fbc80571a96b1
Instruction Fuzzy Hash: 2FE1F331B152608FC705BBB8D85826D7BB1FF89204F5545ADD08AE7392DB389C46C7A2

Function 0817B360 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce7f4e4280e15b3833a21201e5c6540a1e16d6a7efc017a385326af2719002a
Instruction ID: 7af5cd8319150353a456f579b0fc5c3531c4d7988a763a57435d67dcbba78547
Opcode Fuzzy Hash: 0ce7f4e4280e15b3833a21201e5c6540a1e16d6a7efc017a385326af2719002a
Instruction Fuzzy Hash: 6BC1AF31A14625CBD704BBB8E48912DBBF1EF88714F45496DE889E7344DF38A84AC792

Function 0817C6B7 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee9c1e54ff59bdc6100bd059c26231cca81dd6c1a72bf0cd201cc2bbd250e5a
Instruction ID: f8eec58d73d0dc28c4dedb2f825576578d68cbcd9b448cd5705c207443497e0f
Opcode Fuzzy Hash: cee9c1e54ff59bdc6100bd059c26231cca81dd6c1a72bf0cd201cc2bbd250e5a
Instruction Fuzzy Hash: BBC17E71A11215CFC708BBB8E49856DBBF1EF88304F51886DE445E7361DE38A84ACB92

Function 0817BFE4 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463b3610bd6f82abf9b1eba7d34663455635804a5b59c33413b65d8030291070
Instruction ID: 190674f87202d4611003912e0398e6591fab552809a0a51922dabfe604c5703a
Opcode Fuzzy Hash: 463b3610bd6f82abf9b1eba7d34663455635804a5b59c33413b65d8030291070
Instruction Fuzzy Hash: 88B1D171B15224CFC704BBB8E84826D7BB1FF99304F5145ADD08AE7391DB389846C7A6

Function 01289968 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6a3abeb22be64209548ca212cf658fecb07b20695cdb79dbd147529ca2efaf
Instruction ID: c08f6a958c3f20c082f9154042bb7f895ca5e572458fb04da095496b63fc6961
Opcode Fuzzy Hash: aa6a3abeb22be64209548ca212cf658fecb07b20695cdb79dbd147529ca2efaf
Instruction Fuzzy Hash: DDD12935A11215CFCB05DF6DC488AADBBF6AF88314F1A8469E505AB3A1C732EC81CB50

Function 0817C027 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e891ab5dd38ab9ec53c95b7bee778f31b934ccf0b4bb56256e38d6a9536e24c
Instruction ID: 2a65d906056cca773207f03b6e7f0cb10618a9851cf5879a90f772b01f729785
Opcode Fuzzy Hash: 5e891ab5dd38ab9ec53c95b7bee778f31b934ccf0b4bb56256e38d6a9536e24c
Instruction Fuzzy Hash: 97B1B031B112248FC705BBB8E89816D7BB1FF99304F51496DD08AE7351DF38A846C7A6

Function 01289847 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3482011a6315766b6ae60e370b531cd8bc608ce7b9330cf10e833e4e0369262d
Instruction ID: b127e7ac4ced277f59d127c0c0d142487e4565bf3fae3378bf5b6322d913a883
Opcode Fuzzy Hash: 3482011a6315766b6ae60e370b531cd8bc608ce7b9330cf10e833e4e0369262d
Instruction Fuzzy Hash: 3BD12871A11219CFCB05DFA9C8889ADBBF6BF88314F1A8459E515AB3A1C731EC81CB54

Function 0817B350 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e9efb014be2936a65c3ed693673680d12c470eb69c89bb15dab0af27843dd8
Instruction ID: bfe2a283c25a5514bad8df1d49604a25b166e2cd266f328adf45b75b997d78a7
Opcode Fuzzy Hash: 54e9efb014be2936a65c3ed693673680d12c470eb69c89bb15dab0af27843dd8
Instruction Fuzzy Hash: 8F91B031A15625CBC705BBB8E49912DBBF1FF88711F44486DE885E7344DF38A84AC792

Function 0817E1EC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbf6b0072e877fd50620e965678ba8c39df94fcf06679322ec6f0dbb0b4b236
Instruction ID: 7b13566c799ccaf025226ec78bd48fc3315f22e92f7dc3fd16b3f64a046ddc00
Opcode Fuzzy Hash: 9fbf6b0072e877fd50620e965678ba8c39df94fcf06679322ec6f0dbb0b4b236
Instruction Fuzzy Hash: 2C711571A142158FC704FBB8E88966EBFF1EF48604F4549ADD489E7391DE389C49C3A2

Function 0817B146 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ed2c57ddd48af03e63f0a85e3fb232dee590b78c08100dd332bc9fde8da914
Instruction ID: df3f2c88be9bc7dc67f91f2b62cd628ce487e0b6f943f1fc8045d52d67323fba
Opcode Fuzzy Hash: 71ed2c57ddd48af03e63f0a85e3fb232dee590b78c08100dd332bc9fde8da914
Instruction Fuzzy Hash: FF519F7150E3D19FC3036BB498686693FB4AF47214F4945DFE4C4CB2A3DA28984AC726

Function 0128A1A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffdd821307b95079523a6468d77bc0d3cbb1d3e97c5167f526e7abaf4c940fe
Instruction ID: fbe1d4c332e069d4e698525f1f288fd2ac53f46478346cbfd2c59459a7afb17c
Opcode Fuzzy Hash: dffdd821307b95079523a6468d77bc0d3cbb1d3e97c5167f526e7abaf4c940fe
Instruction Fuzzy Hash: D1512170E112099FDB18DFAAD844AEEBBF2BF88310F14802AE415BB398DB305945CF50

Function 0128F7BD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b986a11c9b844da1c737790aa3d338e199d9b8230134350c2fc38594633cb08e
Instruction ID: ba6f473baf3286d833c9c0d78bbd5098422bab86b2d4efb876586182aa5e2b16
Opcode Fuzzy Hash: b986a11c9b844da1c737790aa3d338e199d9b8230134350c2fc38594633cb08e
Instruction Fuzzy Hash: 8041377261A3859FC707AF3995182693FB5EF8B324F1800EBE945CB2A3D7358915C790

Function 08171128 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb983d129c945e3fcba8e7f618306fb2690f8b6fde9a50e7f1d3f9bcd4294a6c
Instruction ID: e3b6647f97472b7c135239d512296789f86aa7e56fc4df0a2fed27bcca86a953
Opcode Fuzzy Hash: eb983d129c945e3fcba8e7f618306fb2690f8b6fde9a50e7f1d3f9bcd4294a6c
Instruction Fuzzy Hash: 0D4165B0D042499FCB00DFA9D854AEEBBF1AF89310F20886ED846BB351DB745905CB61

Function 0128A4C0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc4c81dd6e79eec1ae47b292047b081d36f066cabf4513beae961347bbe50c1
Instruction ID: 0735f17a973c97b204bee90cdd3517a002d95767ccb93eb76c2d82b729d56d6b
Opcode Fuzzy Hash: efc4c81dd6e79eec1ae47b292047b081d36f066cabf4513beae961347bbe50c1
Instruction Fuzzy Hash: 724120B5D15209DFDB04EFAAE9483EDBFF0AF88315F10856AD011A3290DB780A84CF60

Function 012852A8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29df67c3cfeabdef67e367f5378a457783471a4f4056991ab099bbf8967a651b
Instruction ID: e796b89662dcc5675c0876412088d6a6c30012f317a017c32708f9af3be0dc9d
Opcode Fuzzy Hash: 29df67c3cfeabdef67e367f5378a457783471a4f4056991ab099bbf8967a651b
Instruction Fuzzy Hash: 40316F7171120A9BCB06EF68D458AAF7BA6FF88324F008428FA0587395CB75DC65CB90

Function 012889F8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc22cdb6ced9fd88d37d2bb0ed15daeebda439b3236dd9c037e27d7756d5561
Instruction ID: 6f0038f5ebe6de53e41eb6a9bc05d7f6524b458a6eb6a09ed539c26b5bff4933
Opcode Fuzzy Hash: fcc22cdb6ced9fd88d37d2bb0ed15daeebda439b3236dd9c037e27d7756d5561
Instruction Fuzzy Hash: 3621F4313652024BEB163A2DC89837EB69BAFC4604F584439D606CB3D6EF69CC42D391

Function 0817176F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a0b166c1ca7c856a9589031733694e4e92661bff95dfb0440b4e3769f0b07c
Instruction ID: 3e08ceb6e9ca2c327a5b31c95af7bbc6f913b2c53af256a5d09c8a0edf4890f5
Opcode Fuzzy Hash: 29a0b166c1ca7c856a9589031733694e4e92661bff95dfb0440b4e3769f0b07c
Instruction Fuzzy Hash: B2414C30D007099FDB15DFA9C89469DBBF1FF89310F14C66DD849AB261EB70A985CB90

Function 0817E0F0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a019401ac251b9c41d8b7359a8f5311b755a3c354c5c900d7403fed479b20ffe
Instruction ID: acbb75f08d613642cd4ed9c470bf81542a9daa94c4a04544acde8b2679953df3
Opcode Fuzzy Hash: a019401ac251b9c41d8b7359a8f5311b755a3c354c5c900d7403fed479b20ffe
Instruction Fuzzy Hash: 4B210731B142214BD304BBF8E89566E7BF5EF88214F4488ADD48CE3341DE38AC06C3A2

Function 01286728 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602c79f607df396f3d125336059dff5a1b570b56c3f21fef3fd7a0ef210959f8
Instruction ID: 8112342db11434f6cc95511f96cc836712340152017ff12de3e98c80a489896f
Opcode Fuzzy Hash: 602c79f607df396f3d125336059dff5a1b570b56c3f21fef3fd7a0ef210959f8
Instruction Fuzzy Hash: 1421C235721A128BC729BB2DD498B2AB7A2FF89661B044568D606CB394DF30DC02CBD0

Function 0121D5B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780616237.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856754271eee72594ce6b656c21f9abf547d64db05ba308630323a26be41bc52
Instruction ID: 72ba04e3c2e8085eacc580a492438641c964ec603305765d5b5b49f52a82fb5c
Opcode Fuzzy Hash: 856754271eee72594ce6b656c21f9abf547d64db05ba308630323a26be41bc52
Instruction Fuzzy Hash: CF214871114248DFCB05DF58E9C8B16BFA5FBA4314F208969E9090B25EC336D416C6A1

Function 0817E100 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62a07ab1845995a2d8306f71da125c51f0b80dcb6741fca40e8563b82399d06
Instruction ID: f0cee03d41115d3ae65b1ff91941ad828e2e6de056ac50aaa46d0aa63e4a875c
Opcode Fuzzy Hash: f62a07ab1845995a2d8306f71da125c51f0b80dcb6741fca40e8563b82399d06
Instruction Fuzzy Hash: D6118771B141359BD704BBB8E88562E77F9EF98618F80896DD44DE3340DE78AC06C3A6

Function 01284657 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf00f33437769bc4a03f8710353a6138f2ab66e273f50e6575a3789634f5169b
Instruction ID: b6f32c4f623feafc52ce4117724503e2b7c9404468a94d3c2e1d4b4f9c02bd16
Opcode Fuzzy Hash: cf00f33437769bc4a03f8710353a6138f2ab66e273f50e6575a3789634f5169b
Instruction Fuzzy Hash: EF31E074E0121A9FCB08DFAAD854AEEBBF2BF89300F10856AD815A7354EB305A45CF51

Function 0122D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780662840.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_122d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d868e7e70412e4c879fb5e13883912adf1d364deb49972a7c66e933b3b7cae
Instruction ID: 107c760df276c8e66ee0109b1194362ef6c006a1672554ae148fef93b4e40719
Opcode Fuzzy Hash: 34d868e7e70412e4c879fb5e13883912adf1d364deb49972a7c66e933b3b7cae
Instruction Fuzzy Hash: AD214971514208FFDB05DF98C5C0B2ABB65FB85324F20C66DE9094B257C37AD406CA61

Function 0122D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780662840.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_122d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53b71f965aaa5e066feda9c9a642f85044b2d2245f6a54a12e09ddb9e68140a
Instruction ID: ba661761fceebe75479490563620e4c0489ea612f00613e0711546d2e9309f1f
Opcode Fuzzy Hash: b53b71f965aaa5e066feda9c9a642f85044b2d2245f6a54a12e09ddb9e68140a
Instruction Fuzzy Hash: C7212575514248EFCB15DF58D580B1ABF65EB84314F20C56DE9090B266C37AD507CA61

Function 01285299 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2e29d41773d15798bc7e396a3329ff32baa2feaf54c1c5d16b2df920007800
Instruction ID: c7ae4631a4cb22991d3c28f2094764ba3e8495330fe0f22dc73d1d80e6292e09
Opcode Fuzzy Hash: 5e2e29d41773d15798bc7e396a3329ff32baa2feaf54c1c5d16b2df920007800
Instruction Fuzzy Hash: BB21FF3161520A9FCB02EF6CD45876B7BA2EF88324F004068EA058B396CB74DC55CB90

Function 081719A8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195bd226d895d845931886a82a020907e7c2ea0b16d8958857649690d9073803
Instruction ID: 5d371bc447675108007b6650310ffe85dc323017bbb47278ad1f56e713663df0
Opcode Fuzzy Hash: 195bd226d895d845931886a82a020907e7c2ea0b16d8958857649690d9073803
Instruction Fuzzy Hash: 2931D4B4C11258EFDB20DF99C984B9EBBF5AF48714F24801EE405B7250C7B55845CFA5

Function 0122D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780662840.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_122d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db921168ae8f6958322ca5b693c1fa53e7c557345390644738d5f69d9841d4c1
Instruction ID: ed0162af65b324fada0046037189d74a11631404740f14af9889f32f75da245f
Opcode Fuzzy Hash: db921168ae8f6958322ca5b693c1fa53e7c557345390644738d5f69d9841d4c1
Instruction Fuzzy Hash: B921B0714083849FCB03CF24D994715BF71EB46314F28C5DAD9498F2A7C33A980ACB62

Function 012861D1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96a4189fa89f9958f379fdf83a5090492913b4cadc864f377858faff02e83f0
Instruction ID: 2d4472a20b950785a44d9e5460e228f583ab2497645c5ae90562db9227bfbeef
Opcode Fuzzy Hash: b96a4189fa89f9958f379fdf83a5090492913b4cadc864f377858faff02e83f0
Instruction Fuzzy Hash: 60110330B15612DFCB11EF28C448B69BBB2FF85312F0485A9DA06CB295DB70DC55C791

Function 0128B571 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995416ca7d78c69e29c2c0c2a9f90c17c56adf61b737252ffe96c9f5b2c8b05c
Instruction ID: 3913b9a097645b8b50850b3cff792a9510ef86a81739e1fa92e62cd80e9b9e73
Opcode Fuzzy Hash: 995416ca7d78c69e29c2c0c2a9f90c17c56adf61b737252ffe96c9f5b2c8b05c
Instruction Fuzzy Hash: 9A110C317056945FC706567E585C66BBFEBAFCA311F04487AE006C72D6CD398C058371

Function 0817E0AF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76807a1078c0e6629c23803bfb1769b6160554f01ec57d38ee24f56a55d57fd5
Instruction ID: 1616678550ba459e78f34a765bbe0f538d3f828e532f93fab774f018e6335aa4
Opcode Fuzzy Hash: 76807a1078c0e6629c23803bfb1769b6160554f01ec57d38ee24f56a55d57fd5
Instruction Fuzzy Hash: D211CA72B141218BD744BBBCE88626DB7F5FF94654F80496DD449E7340DF38A8068792

Function 01286818 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f1f740cc752fd38a944ce01314c2a070300f27153e440b88090820327fb2df
Instruction ID: 9b1f681f258b116697709960bdc8251cff1a0c53b1be534f799ee9d89c3e1f05
Opcode Fuzzy Hash: d6f1f740cc752fd38a944ce01314c2a070300f27153e440b88090820327fb2df
Instruction Fuzzy Hash: FB11C2703202068FE740EE6AD084A2A7BD6BF99660B5040BDD20ACB3A1DE61DC098791

Function 012864D8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798e8dcd4ca44605634f1931dcea1c7c8b32ae3e4a5780c5aed1e06f4e410f3b
Instruction ID: 6c38133d83e04ed03dbddf555cf7daab4d9926fbb796fa36d458af3e73a94672
Opcode Fuzzy Hash: 798e8dcd4ca44605634f1931dcea1c7c8b32ae3e4a5780c5aed1e06f4e410f3b
Instruction Fuzzy Hash: D811E071715202DFEB25AF69E498F2ABBE6AB84310F044929E6018B388DF74D841C7A0

Function 012896A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d32844c130ac4211c4bce1f070f0260682bce9d5e7bf1d5f7fd01a88901117
Instruction ID: efb1f0fbefd98a850885c05c6929b0c3a7ac504637aee164913aa29750ccd88b
Opcode Fuzzy Hash: 83d32844c130ac4211c4bce1f070f0260682bce9d5e7bf1d5f7fd01a88901117
Instruction Fuzzy Hash: 94115E35B101049FDB049E69D848BADBBB6BB8C610F148529EA16A7390DA71AC10CB90

Function 0121D5B3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780616237.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: 6a4d284c76927a4b93fe68948ebf06f33dc72d8dea468452f4adea1512374347
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: 0111AF76504284CFDB16CF54D9C8B16BFA1FB94314F24C6A9D9090B25AC336D45ACBA1

Function 08171D19 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5f1550192b97e6d2e47abb30eb5a934908ffc5233d060f11acefdf3aad1b2a
Instruction ID: 447d7f141d34bd9c72283803aa24f601e5d0c604735e7a3e9f0646d612e5420a
Opcode Fuzzy Hash: cf5f1550192b97e6d2e47abb30eb5a934908ffc5233d060f11acefdf3aad1b2a
Instruction Fuzzy Hash: 8001F236B082621B9B16D6BA5C508BFBBFBEFC6121309857ED848DB341DF308C0243A4

Function 0122D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780662840.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_122d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: c5aff798ac2773e4a0d87be10f1bc7b417ab4b2fb963dc3e31934d519a787f6a
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 1911BB75504284EFDB02CF54C5C4B19BBA1FB85224F24C6A9D9494B297C33AD40ACB61

Function 0128F8C0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5dc67d0f3a223c45d14b2e55a0634fae16ccc253c733c03c16937d8a724c74b
Instruction ID: 592f5661500575274b5568121a378633e56517a3bc878a47566f9c506539c95b
Opcode Fuzzy Hash: c5dc67d0f3a223c45d14b2e55a0634fae16ccc253c733c03c16937d8a724c74b
Instruction Fuzzy Hash: 1111823262121AEFCB01FF1DD548A6A7BA5FF48324F004025FA058B391C770D960CB90

Function 0128451A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3ec528b73b09a07c6cc40d3be91216134bd99cf7af3c7ced89a01304b2a30b
Instruction ID: d289fce5b2553c355d5134278f8ec75213e2df225d7b85c9ef570056f6757261
Opcode Fuzzy Hash: af3ec528b73b09a07c6cc40d3be91216134bd99cf7af3c7ced89a01304b2a30b
Instruction Fuzzy Hash: 38111270D112199BDB04DFAAE8486EDFBB6EF8A300F209569E915B7250DB344946CF60

Function 0128F9BA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34ae2bb2fa1df5db643ff9567a3734196798adfa37ad431fbd33d004869e465
Instruction ID: 35b894542765aa0351329484e168291b9db72085517dc5bde30391f66b9e7b94
Opcode Fuzzy Hash: a34ae2bb2fa1df5db643ff9567a3734196798adfa37ad431fbd33d004869e465
Instruction Fuzzy Hash: 1201F572A142456FCB02DF5998146AF3FE7EBCA261F09446AF604D7280CA718D118B91

Function 08171088 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ec0f02aa41a8cc1e6eb29fcbc575c3b193ddedb50ccc191c83519a51add921
Instruction ID: 8adb1b4652c3c787000045f873c2689a9cdc3839d26d4e9d12ec3cf2ba2d1d03
Opcode Fuzzy Hash: 08ec0f02aa41a8cc1e6eb29fcbc575c3b193ddedb50ccc191c83519a51add921
Instruction Fuzzy Hash: D111C571D0070A8ECB10EFA9C9409EEFBF4EF48310B11966AD558B7211E730EA91CB90

Function 0128A190 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5aef6eb95063eb5de2c18a000d486321bad8d63a31c1d99e2c6afec197ba93
Instruction ID: 841c74982d46e9d10590755bfd4c4fd4c0ec15571459cb806b271afd26d067d6
Opcode Fuzzy Hash: 3f5aef6eb95063eb5de2c18a000d486321bad8d63a31c1d99e2c6afec197ba93
Instruction Fuzzy Hash: 3A116971D146598BEB09DFAAD8083EEBFB6AF8A301F04C56AC524A7294DB740145CFA0

Function 0121D7ED Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780616237.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a3f42a10c2ff39b8754fda50c5073a72a0b2d9924f74bbea84923ece589171
Instruction ID: 47df772f8eb429dddc9c5b2546fd12ae7b07d3f6a4677cddc8f94dc42711fa48
Opcode Fuzzy Hash: c7a3f42a10c2ff39b8754fda50c5073a72a0b2d9924f74bbea84923ece589171
Instruction Fuzzy Hash: 7501FC71014308DAE710CB99C988B67BFD8EF61324F15C429EE0D1A18AC3749441C671

Function 0128A638 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211146439e3b3f91e940fecaf32bb58a43b897c6b8d7142572c82a1a6cb83e29
Instruction ID: 63fe69c857452ec0ec9916cb57938b9447611db8d4d0d73017d8479cc8010ed4
Opcode Fuzzy Hash: 211146439e3b3f91e940fecaf32bb58a43b897c6b8d7142572c82a1a6cb83e29
Instruction Fuzzy Hash: 9E014870D11209DFEF14EFAAC9087EEBAB1BB89314F049529D110B3294DF780840CF64

Function 0128A637 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b63b448bc1c55b93841f4336461da1d8992626ab8d650cf4e2db0964a1328c
Instruction ID: 1f981f61fea3f88d485e95deb5943f038522af593442b0a776781158aaf573d3
Opcode Fuzzy Hash: d4b63b448bc1c55b93841f4336461da1d8992626ab8d650cf4e2db0964a1328c
Instruction Fuzzy Hash: CE012570D112099FEF14DFAAD9197EEBBB1BB89314F149529D111B3294DB780841CF64

Function 01284528 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c29d77d6a23cb4fa9f1851538bc8f332a7209a2c88fbf1992864fee70d71455
Instruction ID: dd3b60f9b67ff5148c02ce3197aed0d7ac12ddba1412a8fc1704faca83ab0225
Opcode Fuzzy Hash: 9c29d77d6a23cb4fa9f1851538bc8f332a7209a2c88fbf1992864fee70d71455
Instruction Fuzzy Hash: A601D074E112099BCB14DFAAE8086EDBBF6AB8D301F10D52AD919B3254DB355902CF64

Function 08170FE0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d2a8121d9ce27462e58cbd51eb1df87f90efd832be1fa5bd70dbc0cf594b68
Instruction ID: 9842b41e0cc0f5ed35f6c1b5aa43708a514aa25afc4d854d3702c324e4ad8330
Opcode Fuzzy Hash: 57d2a8121d9ce27462e58cbd51eb1df87f90efd832be1fa5bd70dbc0cf594b68
Instruction Fuzzy Hash: 800186756092846FC702CF68E4509EA7FE4EF8B221B1880AFE848CB652C672C812D791

Function 012850B8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7182165735a47aa252f2147f8040b997927b4c5d301d77f7d2493795931f898c
Instruction ID: 00eab208556c90e2e970d0257d9987c4bd2a2c1cdd174b4773a12df1d7a71ae3
Opcode Fuzzy Hash: 7182165735a47aa252f2147f8040b997927b4c5d301d77f7d2493795931f898c
Instruction Fuzzy Hash: 3001AD359592E49FDB01EF7D94A82DCBFF0DF06314F1846EAC88097112E6700A4ACB40

Function 0121D7EC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780616237.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746309d047d60bc4c1a8429a7fb71bff80c8cc6d06bdfc28a0dd59e4f8fa7937
Instruction ID: 7c0c9f9e6c93466236f3b31b291289c0fa0a05d0ce988cd2e562e99a463d3afc
Opcode Fuzzy Hash: 746309d047d60bc4c1a8429a7fb71bff80c8cc6d06bdfc28a0dd59e4f8fa7937
Instruction Fuzzy Hash: 5DF0C871404344DAE7108B0AC8C8B62FFD8EF51624F18C45AEE0C1B286C3789845CA70

Function 01284738 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c27a2d55d5447f2a8f3bba4f094a7ae5b66ff882e16eb15c4728ff5851d7fbf
Instruction ID: 3bc918f6d95f0596ff4d56e056f131afb0c44a6031c4ac1b5149e0cae9cb31e1
Opcode Fuzzy Hash: 6c27a2d55d5447f2a8f3bba4f094a7ae5b66ff882e16eb15c4728ff5851d7fbf
Instruction Fuzzy Hash: DEF06275D0525ADFCB04EFA8D4915EDBFB0FF56304B1040AAD855E7394D3349606CB41

Function 0128A628 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dfd570ae1274a0e8c85518b9e7a3479cc4c6246272da9bca5527016187ba410
Instruction ID: 983c387c35b179efe3f757a76c7977bc747d352728acb9212b285c8cc63582eb
Opcode Fuzzy Hash: 4dfd570ae1274a0e8c85518b9e7a3479cc4c6246272da9bca5527016187ba410
Instruction Fuzzy Hash: 37F017729652199FEF10DF98C819BEEBBB0FB98318F102929D011B7394CB7909419F64

Function 0128A344 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585ee7bed33ac4a5d7132da2ed34469b8c86f18407335343459f0dd6a957a337
Instruction ID: abba52e35cbcb9b3fc92d567a6bd42fbe8da3fef2a9403ad265e13e9a8111ee4
Opcode Fuzzy Hash: 585ee7bed33ac4a5d7132da2ed34469b8c86f18407335343459f0dd6a957a337
Instruction Fuzzy Hash: 68F064B2D19268CFCF01DBE8D8921ECBFB0EB5A211F4040AAD405AB295D6799542CB10

Function 0817E0B3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532ef6c1469fa69671477221ff8c22afa2f505d547eedcb36f306018a9528dd2
Instruction ID: 77767abff908cc75c7b10038516cb78e88fd289f4bd3a3bff9820e5b7e513cbd
Opcode Fuzzy Hash: 532ef6c1469fa69671477221ff8c22afa2f505d547eedcb36f306018a9528dd2
Instruction Fuzzy Hash: DEF0482104F3E18FDB135BB49865191BFB09E0722039E04C7D8D1CE0A7C668286EDB22

Function 08171010 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5c7c518b0f9cdee90f3f52de0acafc3b107cbd19edee6cd92d6b6546733715
Instruction ID: d983227f46a0914badfc3bfd33731f24cee06c7ee61279ce9e0caab22bd5ed7a
Opcode Fuzzy Hash: ce5c7c518b0f9cdee90f3f52de0acafc3b107cbd19edee6cd92d6b6546733715
Instruction Fuzzy Hash: 19E0DF2631D2D02FC70746A8A4A4A7A3F298FC7212B0D40FFE589CB192C5904804C363

Function 01284C8C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f986968f170f3340ae911b518c3e1d07166a1bf6aadd964daef390377f545ae0
Instruction ID: 425108b32eaa51f10505d24e968c1ef004b34ca3e4c4ea35849934b317b8c567
Opcode Fuzzy Hash: f986968f170f3340ae911b518c3e1d07166a1bf6aadd964daef390377f545ae0
Instruction Fuzzy Hash: 03E01234E00259CFCB18EF95E8807DCBBB4AB84210F1084AAD01EA7214DA302A96CFA0

Function 08173F50 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8911674fb26f24fa95471feeb211976e4623af3888ce701626ffb93456d76431
Instruction ID: 571ed39eb78c72e9babc777a0e9d4e20f99c671ce81c2e6cecf784745ed973a1
Opcode Fuzzy Hash: 8911674fb26f24fa95471feeb211976e4623af3888ce701626ffb93456d76431
Instruction Fuzzy Hash: CFD0127091520DEFCB00EFB4E94155DBBF9EB45310B5045A9E419D7314DB316F049B51

Function 0128974D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a608d63dbde613d227d9e40074ef1f4dc3dd2230faaa83969a6939f2eab96083
Instruction ID: 5bd450af87fdf90dc966ae0340e5f4a7a546983d43c94ff3d49ecb41c1d89cb2
Opcode Fuzzy Hash: a608d63dbde613d227d9e40074ef1f4dc3dd2230faaa83969a6939f2eab96083
Instruction Fuzzy Hash: 1AD0673BB400189FCB049F9DE884DDDF776FB98221B048516E915E3261D632A921DB90

Function 01286B6F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda39bb2e4d11fa99c5bf1e2b49a23b1cf8b1b2f0ebebf78eda16d57f9b84333
Instruction ID: 45396241ec61d6c12dc96523b5f37f4a3da9f2b021bef2e886e2072b0554227b
Opcode Fuzzy Hash: dda39bb2e4d11fa99c5bf1e2b49a23b1cf8b1b2f0ebebf78eda16d57f9b84333
Instruction Fuzzy Hash: C7E0C2310186868EC703EB38EC14B993BB2BF52305F0445B1E1080A2AECB7458488B51

Function 0817ED91 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799746272.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8170000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb1688999f34aae223199b12456b5145f4d26d2a844b8cfc2d95e5892751e54
Instruction ID: 0fa4cb3934356724f1cc521146a7928f438447bb0df0a57b5e98c54f6f66ffb0
Opcode Fuzzy Hash: 2cb1688999f34aae223199b12456b5145f4d26d2a844b8cfc2d95e5892751e54
Instruction Fuzzy Hash: 0DE0B630601254CFD758DBA0DA85858BBB2FF49305B519498E0069B766C735D981CE01

Function 01286B80 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bc8cedc65249cedff692fa37ebb7f0799aefd021132754583fec3382c6addf
Instruction ID: 4e21efb5c57963cf81eeb888f03fcd6db9c03c2ba5c8252511d5010ad75df71a
Opcode Fuzzy Hash: e5bc8cedc65249cedff692fa37ebb7f0799aefd021132754583fec3382c6addf
Instruction Fuzzy Hash: 9EC0123145420B8AC602F77DF845F5D377BFA80314B508630A2050A23DDF74B8894690

Non-executed Functions

Function 08110040 Relevance: 6.8, Strings: 5, Instructions: 529COMMON

Download Yara Rule

Strings

Hcq, xrefs: 08110171
Hcq, xrefs: 08110593
Hcq, xrefs: 08110330
Hcq, xrefs: 08110534
Hcq, xrefs: 08110112

Memory Dump Source

Source File: 00000000.00000002.1799597280.0000000008110000.00000040.00000800.00020000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Hcq$Hcq$Hcq$Hcq$Hcq
API String ID: 0-1692708840
Opcode ID: a4bd8636747bf8638dbf289a0b3f41ec126496b6cfffeee1c47d49461119f349
Instruction ID: 6da9c8d09ec07c2d9e55ee41c9529076ce2ad501b09b196a30e181eca6ed9030
Opcode Fuzzy Hash: a4bd8636747bf8638dbf289a0b3f41ec126496b6cfffeee1c47d49461119f349
Instruction Fuzzy Hash: 97F1B031B101149FCB48EB7DC89467E7BA7BFD8360B248569E50ADB398CE34DD0687A1

Function 02BF1FE8 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH_q, xrefs: 02BF22AB
PH_q, xrefs: 02BF21D3

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 5ce836f0a539ee9c893f5950c25ea9f4309010a7085710bb4d444f697a3d7b88
Instruction ID: bff0ffe514cf4efe2912dc78823a08c95bb9348a03cc47ec4bef0c6944706083
Opcode Fuzzy Hash: 5ce836f0a539ee9c893f5950c25ea9f4309010a7085710bb4d444f697a3d7b88
Instruction Fuzzy Hash: DBD1C174A006048FDB58DF69C598AA9B7F1FF4C714F2580E8EA06AB365DB31AD44CF60

Function 0128CAB1 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

Xcq, xrefs: 0128CAD7

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Xcq
API String ID: 0-450769270
Opcode ID: b39d4e675da6323812f11debf4908f5a3e6dec25f24b34106aff678cb5203a84
Instruction ID: b09bce4a83fa0908e65eeef817db5c5d3f5b2bb6dbb574de481e98256eb0a8f3
Opcode Fuzzy Hash: b39d4e675da6323812f11debf4908f5a3e6dec25f24b34106aff678cb5203a84
Instruction Fuzzy Hash: FDB1BA31732106CBEB387E7DD4452BA7AE6AFC4B01F284C19D982966C8DB31C9618775

Function 07400440 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

L~, xrefs: 0740053E

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: L~
API String ID: 0-3876828424
Opcode ID: b298b687a49c6f0d9ce75512724938f224b657cea8bbab63f07fb2ffcaa5c06f
Instruction ID: 9aea7bac74eb6c747ce6a00e413215790331308e2e905fe9dad3a44e32ec696c
Opcode Fuzzy Hash: b298b687a49c6f0d9ce75512724938f224b657cea8bbab63f07fb2ffcaa5c06f
Instruction Fuzzy Hash: 95911574E15219CFCB04CFA9C5809AEFBF2FF89210F14996AD405EB264D334AA42CF95

Function 07400450 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

L~, xrefs: 0740053E

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: L~
API String ID: 0-3876828424
Opcode ID: 28dc281623cbd13e1a6e564e4ebe1efaee3af8cccc55bfc1bbb65da1db9b62e1
Instruction ID: c4bdef333062febd3f68fb8a44459596dc128690b6aff301e31a624bb96b4b33
Opcode Fuzzy Hash: 28dc281623cbd13e1a6e564e4ebe1efaee3af8cccc55bfc1bbb65da1db9b62e1
Instruction Fuzzy Hash: 2B91F5B4A15219CFCB04CF99C58499EFBF2FF89210F14996AD015AB264D334AA42CF95

Function 07412E45 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a293ac0a2b6719026aa1ad556abd7ad2f3d0fba2d73c2106ccf855447339bf3
Instruction ID: 543ad5dd2db317dcbc1443331e63c312408eec604618327241b71797b1d62092
Opcode Fuzzy Hash: 1a293ac0a2b6719026aa1ad556abd7ad2f3d0fba2d73c2106ccf855447339bf3
Instruction Fuzzy Hash: CA228E71E102159FCB08FFB9D9845AEBBF2FF98304B518969D049A7354EF38A806CB51

Function 02BF1168 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1781128557.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6799e17b910c667ed30154ae78c72468dde8cd1ae3c7f7e714d1c40f51615c8d
Instruction ID: 2bf424bd44657e364d5f46cd52dcbcc38f3e9ed5a42c1b49b90967a01865042c
Opcode Fuzzy Hash: 6799e17b910c667ed30154ae78c72468dde8cd1ae3c7f7e714d1c40f51615c8d
Instruction Fuzzy Hash: 75E1BD707106018BDB69EB79C4507AEB7F6AF89304F1488ADD25ACB7A5CF35E809CB50

Function 0603E350 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798231181.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6030000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7559500211e582706e78cab2ceee221b3a377d49ed2d0f82638dcfdcf02fa469
Instruction ID: 6442e2d81ae1f2629f842faa4b2c67875235d453a3e542e9611ae663d546556a
Opcode Fuzzy Hash: 7559500211e582706e78cab2ceee221b3a377d49ed2d0f82638dcfdcf02fa469
Instruction Fuzzy Hash: 3BA18130B502556FDB98EB79881477F6AEBAFC8350F24856D900ADB398CE349D07C791

Function 0811EE62 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799597280.0000000008110000.00000040.00000800.00020000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a58649809ca17787cb68741949b409254707cd9eb53ba1a1cdc0acbbfe8bb2
Instruction ID: 9223b728619d00097ef280c3d4e7c9c20a8c76575b7fd4d42c0f9b777f83272a
Opcode Fuzzy Hash: d6a58649809ca17787cb68741949b409254707cd9eb53ba1a1cdc0acbbfe8bb2
Instruction Fuzzy Hash: E3D1193192075ACACB01EF64D9506EDB7B1FF95300F10C7AAD11937269EB70AAC8CB91

Function 0811EE70 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799597280.0000000008110000.00000040.00000800.00020000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4989b05abe2d6af43757f2bb8b7fb108336006dd976315c812670e1561b4d2
Instruction ID: ad90ddffe00f324d662252f4380e1e202f7864a654528322d71d050415615bb2
Opcode Fuzzy Hash: 4a4989b05abe2d6af43757f2bb8b7fb108336006dd976315c812670e1561b4d2
Instruction Fuzzy Hash: E7D1193192075ACACB01EF64D9506EDB7B1FF95300F10C7AAD11937629EB70AAC8CB91

Function 0740A6D8 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf661ac9170e8f1da039fe91b33187dd2e4b4a5421daa745212381d4b41b835
Instruction ID: 528b863d9c3c468954bbfcb64095122881772ad7a017dd9dab207066a83a5186
Opcode Fuzzy Hash: cdf661ac9170e8f1da039fe91b33187dd2e4b4a5421daa745212381d4b41b835
Instruction Fuzzy Hash: 79A104B0E15318CFDB04CFA5DA84ADDBBB2FB8A350F14D92AD40AA7295D7349902CF54

Function 07407318 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c6fd4926fad3f4c0c60e3663c38828cb2c6899cab3a7ccbff87ac93c6b5d9b
Instruction ID: 3ea8a12f7646fd2952a806014cb644f3b02106a8926e38dc9a3f973089ad22d3
Opcode Fuzzy Hash: 74c6fd4926fad3f4c0c60e3663c38828cb2c6899cab3a7ccbff87ac93c6b5d9b
Instruction Fuzzy Hash: DFA14E70E1020A9FCB05DFA9D580A9EBFF2FF89310F20C969D414AB359D735AA098F50

Function 074018E0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b8ef8c8a9d57954e04500152a8f3e46cf5811df6ed97190c14e6beb77b2213
Instruction ID: f88c92b9c8c2599c453a1730aaa43307b066df9fdf6654f92004c9f246f28c2b
Opcode Fuzzy Hash: 61b8ef8c8a9d57954e04500152a8f3e46cf5811df6ed97190c14e6beb77b2213
Instruction Fuzzy Hash: 5E71F6B4E1520E8FCB04CFA9C5809DEFBF2BF8A310F24946AD415B7254D3749A42CBA5

Function 074018F0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8cc2b58910b9db194d2ac1c5a3b8af53e8090cc5561e91139425a7b7476443
Instruction ID: 5477d6cf8ff6abf59ae52edfce021bc47af93e96cb6031100b936c5f79533b64
Opcode Fuzzy Hash: 7a8cc2b58910b9db194d2ac1c5a3b8af53e8090cc5561e91139425a7b7476443
Instruction Fuzzy Hash: 1471D3B4E1520A9FCB04CFA9D5809DEFBF2FF8A310F24942AD415B7254D3749A42CBA4

Function 07401338 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c37dced7f5f9f45e12d9bb3bb8b2c796255e69f76b3c6acbeaa3cf6a838fd82
Instruction ID: 454ee467850b1c03534b8877ec66523dc268bfb22396d872a6d268a01dfd4ac1
Opcode Fuzzy Hash: 7c37dced7f5f9f45e12d9bb3bb8b2c796255e69f76b3c6acbeaa3cf6a838fd82
Instruction Fuzzy Hash: A76128B0D15219DFDB04CFA9C5819EEFBF1AF8A300F14C56AD455AB294D3349A42CF90

Function 07401048 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3de6d4fed5bc58be448f9a53006f7b9bc2f314156ca60e2b0f4adfaf43e14c7
Instruction ID: a7cb8f6e7ce26f4217fd3cd904de643d040b096381d7f017265595d0bd678bc0
Opcode Fuzzy Hash: f3de6d4fed5bc58be448f9a53006f7b9bc2f314156ca60e2b0f4adfaf43e14c7
Instruction Fuzzy Hash: 8C71D1B4E1524ADFCB04CFA9D5808EEFBB1BF89310F24856AD515AB354C334A982CF95

Function 07401038 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bf56174c3bc658fc16825241a3ee87a2bb1ebfba14dab7ebd8668f76be73fe
Instruction ID: 5221e815591be302b988d249cb778af1b8bba9f2f60ec6b7c983e1cee81702cd
Opcode Fuzzy Hash: e1bf56174c3bc658fc16825241a3ee87a2bb1ebfba14dab7ebd8668f76be73fe
Instruction Fuzzy Hash: C56105B4D1424ACFCB04CFA9C5809EEFFB1BF8A310F14856AD555AB654C334A982CF91

Function 074016A8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad7a52b94500324ac85e32bfa5d60b90a322f926274d37687f81931cffe9d49
Instruction ID: 1bc42ba709692bf52b9a8b2d11cd323deff4b0de01f9f7df7aa62ca17d50dc34
Opcode Fuzzy Hash: 3ad7a52b94500324ac85e32bfa5d60b90a322f926274d37687f81931cffe9d49
Instruction Fuzzy Hash: A341EAB5D1460A8FCB48CFAAC5855EEFBF2BF89300F14D46AC415A7255D3349A42CF94

Function 0740283E Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9e8a546c8562e63e3b2bdf51435bf3a3cbdc21216404fdf93f2618f33ad9bd
Instruction ID: eb9cea81f6b40ca8f90ea273561798647f9e6012cbba8d2928c6ac3c5386a66b
Opcode Fuzzy Hash: 2a9e8a546c8562e63e3b2bdf51435bf3a3cbdc21216404fdf93f2618f33ad9bd
Instruction Fuzzy Hash: 8F416FB1E056588FDB18CF6B8D4469AFBF3AFC9300F14C1BAC54DAA265DB3409468F51

Function 074016B8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7208ed39863b37af71a6e0f886ea0c37767bb44674ac385164b793407f27d9a4
Instruction ID: 10b407029d534344cfb214b0367f1bffd013088ad972552662ab6ef7d66cb837
Opcode Fuzzy Hash: 7208ed39863b37af71a6e0f886ea0c37767bb44674ac385164b793407f27d9a4
Instruction Fuzzy Hash: CA41D7B4E1420EDBCB48CFAAC9855EEFBF2BB89300F14D46AC415A7254D3349A42CF94

Function 07401D20 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af57a8a50962123e1ee923cd1044c807b12493f94714a2538730b71a3daf8178
Instruction ID: f204c8decfc28bf40fb9cfab76f867afa27bc643493ee9ac4ecda73db38a3010
Opcode Fuzzy Hash: af57a8a50962123e1ee923cd1044c807b12493f94714a2538730b71a3daf8178
Instruction Fuzzy Hash: 7941D6B0E112198FDB58CFABC94469EFBF3BF88300F14C0AAD518AB254D7345A468F91

Function 07402868 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c992105a4e4e1d4120545a65135189ecdee025d7cc9783e4e9c6f0a22b78aa4
Instruction ID: b6e1ddd95193b9a4141ab1d140755d249296aad4925972aa71df33a64410ea3f
Opcode Fuzzy Hash: 8c992105a4e4e1d4120545a65135189ecdee025d7cc9783e4e9c6f0a22b78aa4
Instruction Fuzzy Hash: D5414CB1E116188BDB58CF6B8D4479EFAF3BFC9300F14C1BA850CA6255EB3409858E51

Function 07401D11 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f2f2bc1a36e5dd50f9baa2491800a53b20599698cd983159c783ca7affb75f
Instruction ID: 498fe48c1f179cc32acaddd119fa139fb3f96ae0008581db7d44cb2e20302c36
Opcode Fuzzy Hash: 49f2f2bc1a36e5dd50f9baa2491800a53b20599698cd983159c783ca7affb75f
Instruction Fuzzy Hash: 7241C9B0E112198FDB58CF6BC94469EFBF3BF89300F14C0AAD519AB254D7345A468F91

Function 0741E688 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798977469.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27394b11ef932b287b7e202a4e5e6b6c63037a5c5c7b5788dce0fcea15993ef
Instruction ID: c2a1b2e77ae807e30d8a0b47febc8704dc0f232d1900331cfa647ef84697cd98
Opcode Fuzzy Hash: c27394b11ef932b287b7e202a4e5e6b6c63037a5c5c7b5788dce0fcea15993ef
Instruction Fuzzy Hash: 3D31DC71E056189FEB18DFABD85069EFBF3AFC9300F14C0AAD518A6265DB340A468F51

Function 07405E40 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2e06dbae701b1d98b1af3a83a03afd1ab6e19e4b48be2a0e02c20c31680324
Instruction ID: 5a2f3a3088fe859b1fbfe0abb93a38a945c4d25e4b19ccfcaaa5e328ed63eb16
Opcode Fuzzy Hash: 6e2e06dbae701b1d98b1af3a83a03afd1ab6e19e4b48be2a0e02c20c31680324
Instruction Fuzzy Hash: 432127B1E116198BDB08CFAAD9405DEFBF7EFC9210F14C13AD418A7254DB345A518F91

Function 074057B0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0d77bfc409fbd9682953f83973eacdd2051d23fcfb18de05668d8ef2e51f0f
Instruction ID: 269a079e19b1519732d6d95e7275898bd852a32124ade8be85b2eb44d6544417
Opcode Fuzzy Hash: fb0d77bfc409fbd9682953f83973eacdd2051d23fcfb18de05668d8ef2e51f0f
Instruction Fuzzy Hash: F9114AB1E112199BDB08CFABE9406DEFBF7EFC8210F14C03AD418A7214DA344A118F90

Function 0740AE08 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c400acf19931b290f1b51fbdf4ac8dbfceeba08d92fa9ea648ee8e5cd5c71420
Instruction ID: 40aa728c75c3c9b416a0048f55b3ed3b929f66dc252532877f857fc69ff5d350
Opcode Fuzzy Hash: c400acf19931b290f1b51fbdf4ac8dbfceeba08d92fa9ea648ee8e5cd5c71420
Instruction Fuzzy Hash: F71103B1E116199BDB08CFABD9406EEFBF7EBC8210F14C03AD518A7254DB345A028B91

Function 07409518 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d4cb35806267011457a720e1ffe9b4298d4af4ac68f8888f634d8b579f511a
Instruction ID: 9d7d71bae59a93ccdf5b01b68d62c01ffce95bc7275a643348b7690e4d5dc5ab
Opcode Fuzzy Hash: 31d4cb35806267011457a720e1ffe9b4298d4af4ac68f8888f634d8b579f511a
Instruction Fuzzy Hash: A91106B1E116199BDB48CFABD9406EEFBF7AFC8210F14C03AD408A6255DB745A428F91

Function 074064A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fc8403df2e85a9eabcb4f106d678ca77ad543c847cf386f5c7eb61ff342844
Instruction ID: 4f1c43fde2258f840eb4dd7881eb695c1e5f472d7b00661540866fcc52691d58
Opcode Fuzzy Hash: b7fc8403df2e85a9eabcb4f106d678ca77ad543c847cf386f5c7eb61ff342844
Instruction Fuzzy Hash: 481117B1E116199BDB08CFAAD9406DEFBF7EFC9310F14C07AD418A7254DA345A128F91

Function 0740950B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798926482.0000000007400000.00000040.00000800.00020000.00000000.sdmp, Offset: 07400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7400000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83187f4a05d36a755828fef73245bfa08e718124b8b117d010b9925d804fc94d
Instruction ID: e1fd70bc47ee3f3632f691887c2ddb267a314dae8c4f4b51b18a96bb3070f44c
Opcode Fuzzy Hash: 83187f4a05d36a755828fef73245bfa08e718124b8b117d010b9925d804fc94d
Instruction Fuzzy Hash: E41137B0E116189FDB48CFABC9406AEFAF7AFC9300F14C07AD408A6255DB745A428F91

Function 0128B638 Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

Xcq, xrefs: 0128B76B
Xcq, xrefs: 0128B669
Xcq, xrefs: 0128B69D
Xcq, xrefs: 0128B723

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Xcq$Xcq$Xcq$Xcq
API String ID: 0-2577476577
Opcode ID: c256d8392ddb62015f7b77a3d7ecaef3f56b63ec895ffb3d8fd34d4bc70aff91
Instruction ID: d3fd7610dc0f5861cc267d05f49841bc9d3091e4917665deabb7d5165d513aae
Opcode Fuzzy Hash: c256d8392ddb62015f7b77a3d7ecaef3f56b63ec895ffb3d8fd34d4bc70aff91
Instruction Fuzzy Hash: 1781D27291335A8FDB66BF3984843AE77A0EF45310F1941BBC1019B6A1EB718C5ADB90

Function 0128B628 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xcq, xrefs: 0128B76B
Xcq, xrefs: 0128B669
Xcq, xrefs: 0128B69D
Xcq, xrefs: 0128B723

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: Xcq$Xcq$Xcq$Xcq
API String ID: 0-2577476577
Opcode ID: 67c14bf9b08ee54a40700105ed21f74f420fc7c04575b162434948ec69dcefc0
Instruction ID: 57f4bef01a3c72192294c8ed06e61a09f8c5cf9412b9412fa137cf02d9093f0d
Opcode Fuzzy Hash: 67c14bf9b08ee54a40700105ed21f74f420fc7c04575b162434948ec69dcefc0
Instruction Fuzzy Hash: 0931EA35E5226B4BDF3DAA6CC9503BF7AA1BF84300F5900B9C616977C5EB3089419FA1

Function 0128F1C8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;_q, xrefs: 0128F1D4
\;_q, xrefs: 0128F206
\;_q, xrefs: 0128F1FA
\;_q, xrefs: 0128F1DE

Memory Dump Source

Source File: 00000000.00000002.1780919549.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.jbxd

Similarity

API ID:
String ID: \;_q$\;_q$\;_q$\;_q
API String ID: 0-294077808
Opcode ID: 9873eec421c4190b0b894f51b7516c81171916b07ad821f37b9a42cbf01a1498
Instruction ID: 071f4cdae700d18359a9323e263830de435d0ff8334bbc156a26c021f4b501c5
Opcode Fuzzy Hash: 9873eec421c4190b0b894f51b7516c81171916b07ad821f37b9a42cbf01a1498
Instruction Fuzzy Hash: C801F73677100A8FCB64AE2CC65492577EAAFC9760315406AE601CB3FDDE70DC42C750

Analysis Process: InstallUtil.exePID: 7660, Parent PID: 3864COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.8%
Total number of Nodes:	109
Total number of Limit Nodes:	14

Executed Functions

Function 066D3120 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066D3848
$_q, xrefs: 066D3854
$_q, xrefs: 066D3878
$_q, xrefs: 066D382B
$_q, xrefs: 066D381F
$_q, xrefs: 066D386C

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: 5cb73b63a6b9b43d40c64f1875526122371b06c7695ae71c1cfbefeb96172109
Instruction ID: 08ab40784270abfc82fcd8dbe4eb2f466e6a77dbe606412897809e8c225382cf
Opcode Fuzzy Hash: 5cb73b63a6b9b43d40c64f1875526122371b06c7695ae71c1cfbefeb96172109
Instruction Fuzzy Hash: 61321D30E1061A9FCB14EF65D8945ADB7B2FFC9300F50C66AD409BB364EB70A985CB91

Function 066D7E50 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066D818D
$_q, xrefs: 066D8199

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: 0366c78a829ebf7d515316b5dea6944d45ce8abdf755eccc3ef10ca08bda7753
Instruction ID: a2946934b667e9ffb480c953d020a9dc8faa3a75ed94f9a6d69b8cd186e02be9
Opcode Fuzzy Hash: 0366c78a829ebf7d515316b5dea6944d45ce8abdf755eccc3ef10ca08bda7753
Instruction Fuzzy Hash: 47029A30F002069FDB54DF68D998AAEBBA2FF84344F248529D415EB394DB35EC46CB81

Function 066D5258 Relevance: 1.8, Strings: 1, Instructions: 595
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 066D55A3

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 588253c0b33d8ece5e2110df5b074e7b711503cd3963413f2ad07edab45430e0
Instruction ID: 805c2444418d86c27effd4fec9344248f1bbb655e81729338ff057759064410a
Opcode Fuzzy Hash: 588253c0b33d8ece5e2110df5b074e7b711503cd3963413f2ad07edab45430e0
Instruction Fuzzy Hash: 6E22CF75E002199FDF64CBA4C4806AEBBF2FF88325F24856AD44AAB744DB35DC41CB91

Function 015C70B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 015C7127

Memory Dump Source

Source File: 0000000C.00000002.2506519629.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15c0000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 7de739e2edb0e42c0081d9e79ad8357aeffddc10a1646c03bb3f762e44f5e67c
Instruction ID: 49b1821b78707ddfcde7b8dadcc84cac47a16f509017d3c4e23b7563d7f05e99
Opcode Fuzzy Hash: 7de739e2edb0e42c0081d9e79ad8357aeffddc10a1646c03bb3f762e44f5e67c
Instruction Fuzzy Hash: A92114B1C002598FDB10CF9AD885BEEBBF4BF49310F14845AE459B7250D778A944CFA1

Function 066D66C0 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957ccf56757946e59aa01f401ec5a6a03e76cd33083c79b521da4e4175312055
Instruction ID: 569cd9e207c1102a7ab69752a79052caf3b5dcb64d6e56fdd827764ec5674ebb
Opcode Fuzzy Hash: 957ccf56757946e59aa01f401ec5a6a03e76cd33083c79b521da4e4175312055
Instruction Fuzzy Hash: 77629A30E002099FDB54DB68D994AADBBF2FF88314F148569E406EB394DB35EC46CB91

Function 066DC250 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c06b09285e5ce1df5304938761ee4c51d13d9f640f6f969f1ad2b7c9f4422a3
Instruction ID: 18c7909c7d28ef618ba6c0de211086870bdea80f01429c86958878b6f3db3769
Opcode Fuzzy Hash: 9c06b09285e5ce1df5304938761ee4c51d13d9f640f6f969f1ad2b7c9f4422a3
Instruction Fuzzy Hash: 43327E30F102099FDB54DF68D990AADBBB6FB88310F508529E505EB364DB39EC46CB91

Function 066DB2F0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb3a741731269b6ca19db99fa247d2528cb45be5348cd66f1edcb0cd3744b3d
Instruction ID: 7e70c6cc868be3d03d7b12d439b2269ee6331c9b8f09e91962284aa55cd65af2
Opcode Fuzzy Hash: beb3a741731269b6ca19db99fa247d2528cb45be5348cd66f1edcb0cd3744b3d
Instruction Fuzzy Hash: BC2293B0E102099BDF64CF69D5807AEB7F1FB45310F658829E409EB399DA38DC85CB91

Function 066DAD98 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066DAF0C
$_q, xrefs: 066DAF47
$_q, xrefs: 066DAF3B
$_q, xrefs: 066DAF64
$_q, xrefs: 066DAEB9
$_q, xrefs: 066DAEC5
$_q, xrefs: 066DAF70
$_q, xrefs: 066DAF18

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 433e626283fdf63f71580aecb188146b7ab806d57c22ae778489b755e4efc0b6
Instruction ID: 67360bdd57641bee83b58c87eb15f1992919eac3dfa1424ff3faf46394341c34
Opcode Fuzzy Hash: 433e626283fdf63f71580aecb188146b7ab806d57c22ae778489b755e4efc0b6
Instruction Fuzzy Hash: 60E16D70E1020A9FDB65DFA8D9906AEB7B2FF84304F508529E409EB358DB74DC46CB91

Function 066DB718 Relevance: 8.0, Strings: 6, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066DBCA9
$_q, xrefs: 066DBC75
$_q, xrefs: 066DBC69
$_q, xrefs: 066DBCDD
$_q, xrefs: 066DBC9D
$_q, xrefs: 066DBCD1

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-155944776
Opcode ID: 80054ffdd2415c00ff77526c41cb8e58f9e88b2f4f247b2bcb88bc3f1b90b67c
Instruction ID: 6dbad00da91c01e3ddaad68a0738ebe9ae796bded70d3884ad7b3c41cdc32b64
Opcode Fuzzy Hash: 80054ffdd2415c00ff77526c41cb8e58f9e88b2f4f247b2bcb88bc3f1b90b67c
Instruction Fuzzy Hash: 47028DB0E0020A9FDFA4CF68D5806ADB7B1FB85300F25856AD419EB359DB74EC46CB91

Function 066D9218 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066D9294
$_q, xrefs: 066D92CF
$_q, xrefs: 066D92C3
$_q, xrefs: 066D9288

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: f47ad8dec5d749dcf5a68279a14c9e56dbb915b9e19c9f2dd5aac23d597b089f
Instruction ID: d4c4def83187697aa9a27168bf0c04c7e44e024009145a624983867cc9780423
Opcode Fuzzy Hash: f47ad8dec5d749dcf5a68279a14c9e56dbb915b9e19c9f2dd5aac23d597b089f
Instruction Fuzzy Hash: F3915930F1020A9FDB54DF64D9507AEB7F2FB89304F108669C909EB798EA749C46CB91

Function 066DD018 Relevance: 4.5, Strings: 3, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066DD41F
$_q, xrefs: 066DD40B
$_q, xrefs: 066DD413

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q
API String ID: 0-2441406858
Opcode ID: eeab22de4a17a19b72e3cbed4b0330d680ee4eb9f82235913206b6eddb17630a
Instruction ID: 4b479a2e2c85694e5d1bf55368522d728562ee774f5ff88705d8d6042d7ea642
Opcode Fuzzy Hash: eeab22de4a17a19b72e3cbed4b0330d680ee4eb9f82235913206b6eddb17630a
Instruction Fuzzy Hash: 2B621D30A0020A9FCB55EF78D590A5DB7F2FF84304B648A68D005AF369DB75ED4ACB81

Function 066D4820 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fdq, xrefs: 066D4F2D
\Odq, xrefs: 066D49D7
XPdq, xrefs: 066D494D

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: fdq$XPdq$\Odq
API String ID: 0-727959394
Opcode ID: 5c4a195e9c72054599dce468ca5afee7bfc6114f3836fd9f4cd812d9ab43c730
Instruction ID: 700a1e6fb3d1de8cc1e9793fa68917e8ed8d4a06136aa1bc5a7a1743bde94368
Opcode Fuzzy Hash: 5c4a195e9c72054599dce468ca5afee7bfc6114f3836fd9f4cd812d9ab43c730
Instruction Fuzzy Hash: 2E615C71E002099FEB54DFA5C8547AEBAF6FF88340F208529D60AEB394DE754C05CB91

Function 066D9208 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 066D92C3
$_q, xrefs: 066D9288

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: 27f432df43508be95918e570f0d1be243df20b7c26a0c33b1278c4f8d41e228c
Instruction ID: 66c6ae76f3ff8509d5965432f99cbde72b3ac5600ffebadfbded7c96d7a8a13b
Opcode Fuzzy Hash: 27f432df43508be95918e570f0d1be243df20b7c26a0c33b1278c4f8d41e228c
Instruction Fuzzy Hash: 1A515D30F1020A9FDB54DF74D9507AE77F6EB89310F108669C909EB794EA349C46CB91

Function 05A9F228 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 07eb0af9f230d2de775fd182339d9e892d9f2ab565bb9c21d5f814379360804e
Instruction ID: 7ed38a4acb078b2707b40a3a9f6abe787a51127ead5a796044d10df54edcbc9a
Opcode Fuzzy Hash: 07eb0af9f230d2de775fd182339d9e892d9f2ab565bb9c21d5f814379360804e
Instruction Fuzzy Hash: 86814970A00B159FDB29DF29D444B6ABBF1FF88304F10892DD49AD7A54D734E849CB90

Function 015CF2A8 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506519629.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8e1e33afc5b758e0ff1ba5959230c3424eb3dedf78be6e25a6f5b9843ff0c2
Instruction ID: efca02ecb9bcffc6d5cccabe6611b68385529e4634f2864e3156447c3d5344b9
Opcode Fuzzy Hash: eb8e1e33afc5b758e0ff1ba5959230c3424eb3dedf78be6e25a6f5b9843ff0c2
Instruction Fuzzy Hash: B6412272E043998FCB04CFB9D8146AEBFF5AF89210F1485ABD504EB251EB749845CBE1

Function 015C70A8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 015C7127

Memory Dump Source

Source File: 0000000C.00000002.2506519629.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15c0000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 9a957136d02932a24473aed5e63a39d3d2491b3b0c001de9fc1b973afe64e386
Instruction ID: cf1ae81f4d3688fc27cd32372e86a6f3e1f83ceed786c58557f03c8439622ede
Opcode Fuzzy Hash: 9a957136d02932a24473aed5e63a39d3d2491b3b0c001de9fc1b973afe64e386
Instruction Fuzzy Hash: 9E2124B1D002598FDB14CF9AD484BEEBBF4BF88310F15846AE459B7250D3789945CF60

Function 05A97058 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A970E7

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f239b1e6dc57463e322f0e6842832e837c925ed06fe7a5ef38e0638771035a98
Instruction ID: 44624932708b5a9bb80da4141bcd3fc580a66889d4d713ff2edc409d6115a453
Opcode Fuzzy Hash: f239b1e6dc57463e322f0e6842832e837c925ed06fe7a5ef38e0638771035a98
Instruction Fuzzy Hash: 8F21E3B5D10219EFDB10CFAAD984ADEBBF8FB48310F14841AE958A3210D374A944CFA1

Function 05A97060 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A970E7

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 482adb5a5a8f749638a816abada402e4c0332a4c2135963c294b4fc6aa9ac0a0
Instruction ID: 1c9b24f5f1ad679fd84153a72e0a8437829a2a3ef012c6d16d1fb544291f918d
Opcode Fuzzy Hash: 482adb5a5a8f749638a816abada402e4c0332a4c2135963c294b4fc6aa9ac0a0
Instruction Fuzzy Hash: EB21E2B5D10219AFDB10CFAAD984ADEBBF8FB48310F14801AE918A3310D374A944CFA1

Function 05A9F678 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 05A9F6EA

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9ba06d8546b61874f00bf8e6c3687140d0c8660bce047f7bd6923b35edc5238e
Instruction ID: 38f3adb8a1a6b1941e1ca756a998623bb4bccbb206b923dacd9d4b87822782aa
Opcode Fuzzy Hash: 9ba06d8546b61874f00bf8e6c3687140d0c8660bce047f7bd6923b35edc5238e
Instruction Fuzzy Hash: F12103B6C042499FDB14DFAAD844ADEFBF8FB48310F10841AE529B7210C775A949CFA5

Function 015CF390 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 015CF3F7

Memory Dump Source

Source File: 0000000C.00000002.2506519629.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15c0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: eeffb69b559a5dd35efe6b4905b7f0f3062fda573da6aa677d14bad8020f5932
Instruction ID: 3dedc3c21d35f45c91ebb1d2272240ba40303cee6b836afd52e82e30df950a0b
Opcode Fuzzy Hash: eeffb69b559a5dd35efe6b4905b7f0f3062fda573da6aa677d14bad8020f5932
Instruction Fuzzy Hash: 5F110DB1C002599BDB10DFAAD444B9EFBF4BB48720F11816AD818B7240D378A944CFA1

Function 05A9F680 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 05A9F6EA

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 642b8867e0afacc5eafb4ae87d1a3e67fce8ea1487de3e235af86729a64fe6ca
Instruction ID: 5a5a0300a2ffac80967e571928fa294cd92c2bb62b949449fb2d9d97dc158369
Opcode Fuzzy Hash: 642b8867e0afacc5eafb4ae87d1a3e67fce8ea1487de3e235af86729a64fe6ca
Instruction Fuzzy Hash: 1211F3B6C003499FDB14CFAAD444ADEFBF8BB48310F14842AD529B7210C375A545CFA5

Function 05A9E15C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,05A9F244), ref: 05A9F47E

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: beab45e7fa3c702dc2b639def831ccf74eed817c274addc9272d5321951e645b
Instruction ID: 68dd950ba49e4d5df2ef0122af985f831e2025d7d88e44f235527e4701ae1aec
Opcode Fuzzy Hash: beab45e7fa3c702dc2b639def831ccf74eed817c274addc9272d5321951e645b
Instruction Fuzzy Hash: D8113FB1C003088FDB14DF9AD448A9EFBF4FB88214F10C42AD929B7214D378A945CFA1

Function 05A97120 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05A970E7

Memory Dump Source

Source File: 0000000C.00000002.2513092198.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5a90000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9ed47063cc50a43ab1abbc693a839160dc31a46306d6f98c41257d54001ea623
Instruction ID: a26ac6864ae3b23e980b5e095ad1e73078f71b79c64498b5f01ea39ba84ce749
Opcode Fuzzy Hash: 9ed47063cc50a43ab1abbc693a839160dc31a46306d6f98c41257d54001ea623
Instruction Fuzzy Hash: 6DF0E2328193848ECB21DBA9E4183CDBFF0AF46310F18C04BC059E7262C2784049CB72

Function 066D4810 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPdq, xrefs: 066D494D

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: XPdq
API String ID: 0-1708276200
Opcode ID: ad67f1abecc74d2f465a17a89ed2769fdadc13cab4b74df876cdd87fdcd28b60
Instruction ID: d30b62cc4c69879a45a6793af8c00511161a2bcbaab606d3d642cfc97aad9230
Opcode Fuzzy Hash: ad67f1abecc74d2f465a17a89ed2769fdadc13cab4b74df876cdd87fdcd28b60
Instruction Fuzzy Hash: AA415D74F102099FDB54DFA5C854BAEBBF6FF88700F20852AD245AB395DA744C05CB91

Function 066DDB85 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH_q, xrefs: 066DDCE1

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: aafc15bc38d5b39b85b1ab6640fe385a97cdf72ab579c073d4fc737e40bc000a
Instruction ID: 953d32bc4a55bd3b6d51e283710be9a61b642465226c7f063ab1bb59b688484d
Opcode Fuzzy Hash: aafc15bc38d5b39b85b1ab6640fe385a97cdf72ab579c073d4fc737e40bc000a
Instruction Fuzzy Hash: A0417E70E0024A9FDB65EF64C5546AEBBB6BF85344F20492AE406E7344DB749846CB81

Function 066D2297 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH_q, xrefs: 066D23E3

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 6da962a879867ffbe070c3bd218c7b5375debebbea6a8759033d4ee2675dee96
Instruction ID: d6f743a72e0d914dfccfda2bb6b34ca58706914ae4b4a3c9e4ccc9d564301464
Opcode Fuzzy Hash: 6da962a879867ffbe070c3bd218c7b5375debebbea6a8759033d4ee2675dee96
Instruction Fuzzy Hash: F631CD30F002018FDB599B74C4646AF7BEAEB85240F154538E506EB394EE39DD06CB91

Function 066D22A8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH_q, xrefs: 066D23E3

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH_q
API String ID: 0-2397113591
Opcode ID: 2f01268bcdc1fbcee69cfc9c97245c516082884df59d7f7b15e4a35109ec1f0c
Instruction ID: 6d22e373da98769f4732e74c30e3b99e0dbf98243a4b46968c6627dac32b7827
Opcode Fuzzy Hash: 2f01268bcdc1fbcee69cfc9c97245c516082884df59d7f7b15e4a35109ec1f0c
Instruction Fuzzy Hash: 4631BE30F002019FDB599B74C56466F7BEAAB89204F144528E506EB394DE38DD06CBA1

Function 066D4709 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Odq, xrefs: 066D4715

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \Odq
API String ID: 0-4257893106
Opcode ID: 3d70a1c0e8bb0df75f5f64294da86e9acdbbf332aef9001b58447a72d816c2ec
Instruction ID: 22e95958c5f03eb82ea6f37d27f2cae92f755bdf9779974711643ffe2698ef82
Opcode Fuzzy Hash: 3d70a1c0e8bb0df75f5f64294da86e9acdbbf332aef9001b58447a72d816c2ec
Instruction Fuzzy Hash: 57F0FE34E20119EFDB54DF94E8597AEBBB6FF84701F204519E502A7294CB741C45CBC0

Function 066D2B93 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33775afe951c879d4c50d2594be73c27813957bddea415c2ad21b746e143248
Instruction ID: b04a024483089a426c85654bbebf9cf279f1e4dab1b9c8423413d3c91e064d40
Opcode Fuzzy Hash: c33775afe951c879d4c50d2594be73c27813957bddea415c2ad21b746e143248
Instruction Fuzzy Hash: 78027734E006048FCBA4CB64C994AADBBF2FF85354F54C8A9D519AB360DB35ED46CB81

Function 066D5EB8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d7b6bb6437cad8ccb7d435c48c83e47f616ce4084d4c9d56f24ef198892d90
Instruction ID: faf71d9e2083eb737becc2317c6682b9e4e134974c79bf7ab5bda3f682e20495
Opcode Fuzzy Hash: 90d7b6bb6437cad8ccb7d435c48c83e47f616ce4084d4c9d56f24ef198892d90
Instruction Fuzzy Hash: 216180B1F401214FDB549A7EC88466FBADBAFC4224B154439E80EDB364DE75DD0287D2

Function 066D3F59 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6235eada911cc4bfa25c888c789a4d6d873773278dc71ca4beb0318c08c341fd
Instruction ID: e779a64b2bc64bbdc4ee324b97c3a126c8fe76529c1f37acf12b42ebc9488090
Opcode Fuzzy Hash: 6235eada911cc4bfa25c888c789a4d6d873773278dc71ca4beb0318c08c341fd
Instruction Fuzzy Hash: 82814930F1020A9BDB54DFA8D5907AEB7F2EF88304F108529D50AEB394EE35DC468B91

Function 066D4274 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156e38e94af5072a38650e7164f4e1bd05d4e92c861785cdb382de4c1a08e811
Instruction ID: c6f4b3c807a2299a8cf01577f1fd2ce0a4d7e95de304e4d7883d2d4f524c3106
Opcode Fuzzy Hash: 156e38e94af5072a38650e7164f4e1bd05d4e92c861785cdb382de4c1a08e811
Instruction Fuzzy Hash: 36914D34E1061A8BDF60DF68C880B9DB7B1FF89304F208699D549AB355DB70AE85CF91

Function 066D4288 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f4053deff625695de4b089e3e9aa809aabe71652a7d46d72db6b29074f4b5a
Instruction ID: f68f75a8ab32b1dfae9046a217a3097a69568144bbffcad932821a8033a6d8d4
Opcode Fuzzy Hash: 80f4053deff625695de4b089e3e9aa809aabe71652a7d46d72db6b29074f4b5a
Instruction Fuzzy Hash: AE913C34E1061A8BDF60DF68C880B9DB7B1FF89304F208699D549AB355DB70AE85CF91

Function 066DEBF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e70a85b41e7f585bfa3cc837e34241d161faa5734f948697daa2e2e5c6d3560
Instruction ID: 71bd6b8b98a56e4b4bf22d7424d2f45b74acacd567513d3d9a877a2ed5caa5e8
Opcode Fuzzy Hash: 0e70a85b41e7f585bfa3cc837e34241d161faa5734f948697daa2e2e5c6d3560
Instruction Fuzzy Hash: F971F570E002099FDB54DFA9C994AADBBF6FF88300F148429E415EB368DB35AC46CB50

Function 066DEBE3 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc92f72f16580704ddd79aa7bfe64298e25df619dde3be1182b0bc64c7c96f7c
Instruction ID: f95a1706090b7436db570ec0b6f95050d2df9c74f31d9e23a823dbbb4a7b6c06
Opcode Fuzzy Hash: cc92f72f16580704ddd79aa7bfe64298e25df619dde3be1182b0bc64c7c96f7c
Instruction Fuzzy Hash: E8711630E002499FDB54DBA9C990AADBBF6FF88300F148429E019EB364DB31A846CB50

Function 066DFD58 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac278c06a159a3db2f79c072809a6f7f3570cefdbc86d62b69b68985094141
Instruction ID: 86d375b7c7e42bea17827dbaa0ac0f4aeec22b1b4087d7ef13980d3d7418f8f3
Opcode Fuzzy Hash: aaac278c06a159a3db2f79c072809a6f7f3570cefdbc86d62b69b68985094141
Instruction Fuzzy Hash: 6F51CD31E00109AFCF64EFB8E4546ADBBB2FF89315F10886AE10AE7351DB359955CB81

Function 066DF700 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60935b3b7bf5f69b5b926ccbc5f1ad729851a9df57cdc5e1a4a0eb3988c35b3
Instruction ID: 8d4432f0ec85701e100bd867de6f1fc6de4c9b85d14ce89491cf4f11c4db3361
Opcode Fuzzy Hash: d60935b3b7bf5f69b5b926ccbc5f1ad729851a9df57cdc5e1a4a0eb3988c35b3
Instruction Fuzzy Hash: D451C870F10205ABEF645A7CD99476F26AAE789710F20483DE40FD73A8C97DCC4583A2

Function 066DF710 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916738630c60d9892b912bb82b2aec7a72d64e0270df39b322086e04549b4421
Instruction ID: cf331c9c7cb6c0d9daf2f1696038cc8ba8d303fca27e790cb66a3ac647d842ae
Opcode Fuzzy Hash: 916738630c60d9892b912bb82b2aec7a72d64e0270df39b322086e04549b4421
Instruction Fuzzy Hash: 5C51B470F10216ABEF645A6CD99476F26AAD789710F20483EE40FD73A8C97DCC4583A2

Function 066D5249 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8205759dc75b3fc031ddeeed7723669c5afe8315bf529b900c7a7333aec89c13
Instruction ID: ba4b62b3ad19ff173c4415ac2dde3675cefb608c2fc70c31c888fea8519c6c26
Opcode Fuzzy Hash: 8205759dc75b3fc031ddeeed7723669c5afe8315bf529b900c7a7333aec89c13
Instruction Fuzzy Hash: 5651B371E106198BDF64CB68C480BBEBBB2FB45310F248926E416DBB85D774DC91CB91

Function 066D50C8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96445a6c1941d5aa7fcb6748c961c5731f484377c312b5f1422d335977f2ba6
Instruction ID: 2bb39e1e2b72a53408f85d11455a9eec4990ecb68ff4300b8a2c498b5354c63e
Opcode Fuzzy Hash: b96445a6c1941d5aa7fcb6748c961c5731f484377c312b5f1422d335977f2ba6
Instruction Fuzzy Hash: EA414D71E106099FDF70CEA9DCC1AAFF7B2FB94314F10492AE216D7A50D330A9598B91

Function 066D45A8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57b84bdd45866cc891fe07c7938150a8e7feb97253fa919a7bd6f4f9934155d
Instruction ID: 1edc3a37c19561026bffb639b1428b27f18578bd8b252a14883b2cbbdf99d298
Opcode Fuzzy Hash: a57b84bdd45866cc891fe07c7938150a8e7feb97253fa919a7bd6f4f9934155d
Instruction Fuzzy Hash: 72416D30E102049FDB54DB69C494BAEBBF2FF89305F258569E40ADB3A0CA35DC45CB91

Function 066D4598 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d44203a2de6d8abb86f032fbb198c29cb657ae6ee490ae99d4e67e7f6df3a4
Instruction ID: 22eef99e6ee0bcde6bbde4ba9758a2f3423babfd5c7ca945985c73bab9fc1e74
Opcode Fuzzy Hash: e2d44203a2de6d8abb86f032fbb198c29cb657ae6ee490ae99d4e67e7f6df3a4
Instruction Fuzzy Hash: E4416B30E101099FDB54DB69C494BAEBBF2FF89304F258569E40ADB3A0DA35DC45CB91

Function 066D2158 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5090ebce082e11d9c94026a0ad3182b57c28812e7742f21c2f5fa1f7d387aae
Instruction ID: 78b37da6e044f3e556b6485d5553bdb10e9ecb2d668f2f3b37edcb4b2431e11a
Opcode Fuzzy Hash: a5090ebce082e11d9c94026a0ad3182b57c28812e7742f21c2f5fa1f7d387aae
Instruction Fuzzy Hash: 0F317030E1024A9BCB58CF64D8A46AEF7B6FF89304F10C529EA06E7754DB71AD46CB50

Function 066D2168 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb74d888d0c23a333e1eedfca30426a06d4c3a039b39a0dc95c7db46f16a4105
Instruction ID: 1eaabfd45b7a85077c9fbc53d419a3ad50bb1fc6a8ac6842e0bcb1ac8e9735f5
Opcode Fuzzy Hash: fb74d888d0c23a333e1eedfca30426a06d4c3a039b39a0dc95c7db46f16a4105
Instruction Fuzzy Hash: FC316130E1024A9BCB58CF64D8A469EF7BAFF89300F10C529EA06E7354DB71AD46CB50

Function 066D3B61 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578f0e0c8794e238f16f388edadb19150c087d2cb36a1522b7f5e7668ab59e93
Instruction ID: 014ec63da8c25d81ac3c43ee8b9c59feb0c8611252ddf5743be7e6f8bfda3d5e
Opcode Fuzzy Hash: 578f0e0c8794e238f16f388edadb19150c087d2cb36a1522b7f5e7668ab59e93
Instruction Fuzzy Hash: 8F215A75E002169FDB50DFA9D980AAEB7F5EB48610F108129E905F7390E735D9418B92

Function 066D3B70 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153b1d92b91ef36f24d6d15a8afe89ec1d70967b76b9197f99a056e8072a6738
Instruction ID: 91c06ea3802896903c74cb1a5c5d09bb8e47166bc236d2546732305e2ab2250d
Opcode Fuzzy Hash: 153b1d92b91ef36f24d6d15a8afe89ec1d70967b76b9197f99a056e8072a6738
Instruction Fuzzy Hash: 8B216975E002169FDB50DFA9D980AAEBBF1EB48710F108029E905F7390E739DC418B92

Function 012FD006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2505038531.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_12fd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5740bd773a9022021e7db8d1d05be83290a3ee60798617d0fcb09f5bff0a02e
Instruction ID: e0f99567bf5448b09888fd6f09d80722ad7340e33730cd7a724a6dd2d513c5a0
Opcode Fuzzy Hash: c5740bd773a9022021e7db8d1d05be83290a3ee60798617d0fcb09f5bff0a02e
Instruction Fuzzy Hash: 5F313C7110D3C49FD703CB64D994711BF71AF47214F2985EBD9898F2A3C23A980ACB62

Function 012FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2505038531.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_12fd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13a7ac40d9f62f4aca3fb67709188ca484e17d89cda4eb75a57d1a516876670
Instruction ID: 3df429bfcfe8a58f1e4f91977cf81cbccc0cac5a3862f7a353394d8597f2dd9c
Opcode Fuzzy Hash: e13a7ac40d9f62f4aca3fb67709188ca484e17d89cda4eb75a57d1a516876670
Instruction Fuzzy Hash: 1C2122715142089FDB11CF68C9C0B26FB65FB84314F20C5BDEA494B356C77AD446CA62

Function 066D3C80 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85254fd8dfe8ee359674eb322e062a2a07aa6890a47a57266807a79dd83e8cd9
Instruction ID: 898c3da8af89ba57d7790d9c32b190a1d4ba6c84c6ca1126d7a69575fa1f5470
Opcode Fuzzy Hash: 85254fd8dfe8ee359674eb322e062a2a07aa6890a47a57266807a79dd83e8cd9
Instruction Fuzzy Hash: FE11A131F101299BDB549A78D8546EF73AAEBC9311F008839C50AF7340EE64DC028BE2

Function 066D3EB7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85777052d1c3e9a806596c955eb4a4010ff1e05b734c1966c59be7fe6122d76b
Instruction ID: 4cbc21d8f5fc79b9344504cb3a0214e458ebc5fe618be63d524698815f2cd87b
Opcode Fuzzy Hash: 85777052d1c3e9a806596c955eb4a4010ff1e05b734c1966c59be7fe6122d76b
Instruction Fuzzy Hash: 0401D231F001450FDB61893CA4107AFBBE6DFCA620F24887AE10AD7356E965CC028391

Function 066D3939 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a96c7376574f9f29030f96c811844397d2047a8490dbdc32f5e4474319a835e
Instruction ID: b62d955704133eb45bb13658f1854d8b5db19e407163003f88ad86aae41c58b5
Opcode Fuzzy Hash: 2a96c7376574f9f29030f96c811844397d2047a8490dbdc32f5e4474319a835e
Instruction Fuzzy Hash: 1D21EDB1D01259AFCB00CFAAD885ADEFFB4BB49310F10816AE918B7340D375A944CFA5

Function 066DA3D1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34203a3d15e80aeca2e1b981b10cd135833e7a8b3e525b080e10fd5f7b1028ef
Instruction ID: a3a5d3c1b50689e759c66dfd19c21abf6f03839cf00b5563c24a1b831d8f30d1
Opcode Fuzzy Hash: 34203a3d15e80aeca2e1b981b10cd135833e7a8b3e525b080e10fd5f7b1028ef
Instruction Fuzzy Hash: 56012631F041085BCB90DA6CE96476F77DAEB86B10F108938E60ED7358DE25EC064791

Function 066DEE61 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7330535a20f55dabf5d0e8b413eb54814163b8b8a3a64bd7722758f74e27fc8
Instruction ID: e2bd0347bfd6c8cd95276557b9ea751e0ac680f76222599290f2f9f3912e7821
Opcode Fuzzy Hash: f7330535a20f55dabf5d0e8b413eb54814163b8b8a3a64bd7722758f74e27fc8
Instruction Fuzzy Hash: 5101A231F005154BCBA4DA3CD890B2FB7DAEBC9614F10883DE60ACB359EE26DC064389

Function 066D3C71 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2db75bcf9fe323f497951c43c16487eeeb5977066a80d4cd5a9a9012b710b1
Instruction ID: 310d84fb94c9549b3d126a0b4c53890026707db9a2d589da1f1ddc62132fa13e
Opcode Fuzzy Hash: 2b2db75bcf9fe323f497951c43c16487eeeb5977066a80d4cd5a9a9012b710b1
Instruction Fuzzy Hash: 7101A732F100295BDB949978DC546EF73AADBC9711F004535C50AF7380EF658C0647E2

Function 066D3940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e334459a30372768d1c8864a2341d1b8ee14e84d365e1e101f310aee8d5be3ff
Instruction ID: f3f2628a523827f20e14689b920f82b622a58022aa566a89d9978244be9604d3
Opcode Fuzzy Hash: e334459a30372768d1c8864a2341d1b8ee14e84d365e1e101f310aee8d5be3ff
Instruction Fuzzy Hash: 3F11CBB1D01259ABCB00DF9AD884ACEFBB8BB49310F50812AE918B7300D375A944CBA5

Function 066D3EC8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7479b9aca7905b16b8b03cc822602714a113a79c3b5196bb954d5899148f4dd9
Instruction ID: 4af0c19c3227e1a126be6df4346498da5ee290330a6d25c43526bb156cc40695
Opcode Fuzzy Hash: 7479b9aca7905b16b8b03cc822602714a113a79c3b5196bb954d5899148f4dd9
Instruction Fuzzy Hash: 3701D131F0001A4BDB60D96DE51072BB3DADBCAB60F20883AF20ED7395EE65DC024392

Function 066DEE70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68e6fae3e234b2761fc0e6639cee76517716fb1b840caea2837516f92c37c8c
Instruction ID: e759af834207293c5a1f668cd4740d3f880d30f32a4392dd6ce38368db00b00e
Opcode Fuzzy Hash: c68e6fae3e234b2761fc0e6639cee76517716fb1b840caea2837516f92c37c8c
Instruction Fuzzy Hash: F201A431F104150BCBA4DA3CD450B2F77DAEBC9A20F10883DE20ACB354EE26DC064395

Function 066DA3E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b808f726e1e8582b862e2ec579064ddb793cf39aab0bd464e5700f50df1ae3
Instruction ID: 1122858390b37d0fe0facc86c26dd408a8b04727aa5cf831faf117252b359520
Opcode Fuzzy Hash: 19b808f726e1e8582b862e2ec579064ddb793cf39aab0bd464e5700f50df1ae3
Instruction Fuzzy Hash: 72018131F041155BDB50DAACE85476FB3DAEB86B10F108839E60AD7758EE25DC068791

Function 066DAFE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0814f10cbab314fc1a1ab9ed3cccaffc3de7e9220f7d4e1a10b1d2c262bb2617
Instruction ID: ca5b927021087a72809eda8260a8e0bf8f84854c5f621db115ac7d23230aa271
Opcode Fuzzy Hash: 0814f10cbab314fc1a1ab9ed3cccaffc3de7e9220f7d4e1a10b1d2c262bb2617
Instruction Fuzzy Hash: 1601F4B1E102098BDF608A68D5407AEBBB8EB453A0F01443AD51AD7344D6319C4587C1

Function 066D6540 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f071f009fd8f13b834cddc8114a417ce97935dbc7681002993181d968c921b
Instruction ID: f236454ae6ea49e3fe9298b2d091336e08140841d0789a7d86eb7017d2c2a2bf
Opcode Fuzzy Hash: 04f071f009fd8f13b834cddc8114a417ce97935dbc7681002993181d968c921b
Instruction Fuzzy Hash: 2EE04871E2010DA7DB50DEB4CD8579AB7B9F701244F2085A5D409CB246E536DA428750

Non-executed Functions

Function 066D7770 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$_q, xrefs: 066D78D5
$_q, xrefs: 066D7D0C
$_q, xrefs: 066D78A4
$_q, xrefs: 066D7C61
$_q, xrefs: 066D78B0
$_q, xrefs: 066D7D22
$_q, xrefs: 066D7C6D
$_q, xrefs: 066D78E1
$_q, xrefs: 066D7D00
$_q, xrefs: 066D7D16

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-698649689
Opcode ID: fc57a20e62abdaffe1b3a2ab957b35d586630c34c4edbcc0b6158e12e6730505
Instruction ID: 483b60ea29f680cc0fbef86f4ea60731b933534757b17d6defe17a65c17638c0
Opcode Fuzzy Hash: fc57a20e62abdaffe1b3a2ab957b35d586630c34c4edbcc0b6158e12e6730505
Instruction Fuzzy Hash: 7B123E30E0061ADFDB68DF65C954AADBBF2BF88304F208569D509AB364DB709D45CF81

Function 066DAA00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$_q, xrefs: 066DAB51
$_q, xrefs: 066DABBE
$_q, xrefs: 066DABB2
$_q, xrefs: 066DAB5D
$_q, xrefs: 066DAB88
$_q, xrefs: 066DAB7C
$_q, xrefs: 066DAB02
$_q, xrefs: 066DAAF6

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-2216122830
Opcode ID: 5082ec3afec723db351031cf015bd8f36c419a00d2ee639c39b1794cf0175321
Instruction ID: ae5f319adb3d37f113160815b9c4883d2e538e50ad5b6699261389bc7ec38da7
Opcode Fuzzy Hash: 5082ec3afec723db351031cf015bd8f36c419a00d2ee639c39b1794cf0175321
Instruction Fuzzy Hash: 23916E30E1420ADFEB68DFA4D954BAE7BB6FF84700F108529E401AB394DB749C46CB91

Function 066D7170 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$_q, xrefs: 066D74AC
$_q, xrefs: 066D7684
$_q, xrefs: 066D7452
.5wq, xrefs: 066D71CB
$_q, xrefs: 066D74B8
$_q, xrefs: 066D7678
$_q, xrefs: 066D760C

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: .5wq$$_q$$_q$$_q$$_q$$_q$$_q
API String ID: 0-3129995876
Opcode ID: 4705923a4f4a6215a03842482f075bb58a5b529dc0cb1c1b539aca2e2b988857
Instruction ID: 5e4b118b2849658994729020272ad6b6c66a3e4942913786fb21e35cdd493a71
Opcode Fuzzy Hash: 4705923a4f4a6215a03842482f075bb58a5b529dc0cb1c1b539aca2e2b988857
Instruction Fuzzy Hash: 22F13034E00209DFDB59DFA4D554A6EBBB2FFC4345F248568D405AB3A8DB39AC42CB42

Function 066D84A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$_q, xrefs: 066D86FA
$_q, xrefs: 066D8706
$_q, xrefs: 066D876B
$_q, xrefs: 066D875F

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 461c4004a7ee9ba30f240494f2f480e30e2f6383d1722e4d210b711d1a5557b3
Instruction ID: 9fd6ac4622acccdb85ab3f80ae56e3c0281d72c7e8f34227a8fecfad1e28ab9a
Opcode Fuzzy Hash: 461c4004a7ee9ba30f240494f2f480e30e2f6383d1722e4d210b711d1a5557b3
Instruction Fuzzy Hash: F2B13C30E1020A9FDB54DF65C9986AEB7B2FF84304F24896DD406AB398DB75DC46CB80

Function 066D88B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR_q, xrefs: 066D89AB
$_q, xrefs: 066D8943
LR_q, xrefs: 066D89FA
$_q, xrefs: 066D8937

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR_q$LR_q$$_q$$_q
API String ID: 0-2912794808
Opcode ID: 0478061351aa0f610eac1c0ba93f30ad5c093b7e238315cde34522e26216abe2
Instruction ID: 5ef5dc616e558563a558345f46b76c8a25a50b47fe6631f149816fd64465462d
Opcode Fuzzy Hash: 0478061351aa0f610eac1c0ba93f30ad5c093b7e238315cde34522e26216abe2
Instruction Fuzzy Hash: 0351BD30F102069FDB58DF28C844A6AB7E2FF88300F14856CE406AB3A5DA34EC05CB92

Function 066DAD88 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$_q, xrefs: 066DAF0C
$_q, xrefs: 066DAF3B
$_q, xrefs: 066DAF64
$_q, xrefs: 066DAEB9

Memory Dump Source

Source File: 0000000C.00000002.2513859014.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_66d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $_q$$_q$$_q$$_q
API String ID: 0-1171383116
Opcode ID: 3de08672ca996f4af894b4d6f9c2d4d288bc5b91afa49bec5ae58b7963f64f20
Instruction ID: 2f17c59da21cbc4edb11ecd9b4cb8c9b2cbd0ef7d6fa9ffd36b40bf59d2b925a
Opcode Fuzzy Hash: 3de08672ca996f4af894b4d6f9c2d4d288bc5b91afa49bec5ae58b7963f64f20
Instruction Fuzzy Hash: 84518D70E142069FDFA4DFA4D9806AEB7B6FB88700F548969E405EB354DB34EC42CB91

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe

Function 01287318 Relevance: 6.7, Strings: 5, Instructions: 443
COMMON

Function 012848B0 Relevance: 6.5, Strings: 5, Instructions: 252
COMMON

Function 081741BF Relevance: 5.6, Instructions: 5644
COMMON

Function 081741D8 Relevance: 5.6, Instructions: 5633
COMMON

Function 08114418 Relevance: 5.2, Instructions: 5170
COMMON

Function 0128D870 Relevance: 4.1, Strings: 3, Instructions: 323
COMMON

Function 07405510 Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Function 01288B18 Relevance: 4.6, Strings: 3, Instructions: 815
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre